# How Rebasely works

Rebasely runs entirely on Cloudflare. Every repository is its own Durable Object, a single writer that holds the repository's refs, so a push lands whole or not at all, close to where you are.

*Diagram: 1. git sends the push to the Rebasely Worker at the edge. 2. The Worker checks the token and the role and reads the refs from the repository's Durable Object. 3. It hands the pack to a push job, a Durable Object of its own. 4. The push job checks every object and stores the pack in R2. 5. It commits the push with the repository's Durable Object, which moves the refs in one step. 6. The repository sends one event per updated ref, which starts Actions and notifications.*

*A push: the Worker checks it, a push job stores the pack, and the repository's own Durable Object moves the refs.*

## What happens on a push

### 1. The Worker takes the request

git talks to the Rebasely Worker at the Cloudflare location nearest to you, over HTTPS. The Worker checks your token and your role in the organization, and asks the repository's Durable Object for its refs.

### 2. A push job checks the pack

Each push gets a Durable Object of its own. It reads the pack, checks every object the way `git fsck --strict` does, scans for leaked Rebasely tokens and private keys, and stores the pack in R2. Large or unusual pushes are verified with real git in a sandbox first.

### 3. The repository commits it

The repository's Durable Object checks the ref updates against protection rules and live branches and moves every ref in one step. Then it reports the result to git and sends one event per updated ref, which starts [Actions](https://rebasely.com/docs/actions) and notifications.

## The pieces

| Piece | What it does |
| --- | --- |
| Worker | Serves the web pages, the API, MCP and git over HTTPS; checks every request's credential and permissions. |
| Repository (Durable Object) | One per repository: its refs, live branches, sandboxes, pull request state and outbox of events. |
| Push job (Durable Object) | One per push: checks and stores the pack, then commits it with the repository. |
| R2 | Packs and objects, and Actions logs, artifacts and caches. |
| D1 | Accounts, organizations, tokens and other data that is not a repository's. |
| Cloudflare Sandboxes | Actions jobs, and the real git that verifies unusual pushes. |

## Reads

Clones and fetches are served from the repository's packs in R2, through the Worker. A private repository the reader cannot see answers exactly like one that does not exist, for git, the API, MCP and the web pages.

> **Note:** Rebasely's own architecture is described in its [.rebasely folder](https://rebasely.com/docs/dot-rebasely) the same way you can describe yours.

---

Source: https://rebasely.com/docs/how-it-works