Open-source, agent-first GitHub and GitHub Actions alternative that runs on your own Cloudflare account: git hosting, pull requests, code review and drop-in GitHub Actions YAML on Workers, Durable Objects, R2 and Containers.
Environment settings: deployment branches and environment secrets in the web UI #308
Settings → Environments → (environment) said "Change it with the REST API" for deployment branches and had nowhere to put environment secrets. Both are now on the page.
Deployment branches: a Kumo radio in the protection rules form with No restriction, Protected branches only and Selected branches and tags, saved by Save protection rules. A form without the field leaves the policy alone.
Branch and tag patterns: shown once Selected branches and tags is saved; add a pattern (branches or tags, Kumo select) or remove one.
Environment secrets: names with last update, Delete, and a name and value form, like the repository secrets box. Values are never shown. Adding the first secret to an unrestricted environment sets it to protected branches only (existing server behaviour, now stated in the hint).
Same server-side checks as the API (people with the admin role, never agents) and the same audit events (environment.update, environment.branch_policy.create/delete, environment.secret.set/delete).
Docs: actions/environments and actions/secrets-and-variables now describe the web UI.
Tested: typecheck, build, and the "GitHub REST compatibility" e2e, extended to drive the page's forms: add a secret (policy becomes protected only), switch to selected, add and remove a tag pattern, check the page lists the secret name but never its value, switch back to no restriction, delete the secret.
Requested by Can · project thread
Settings → Environments → (environment) said "Change it with the REST API" for deployment branches and had nowhere to put environment secrets. Both are now on the page.
environment.update,environment.branch_policy.create/delete,environment.secret.set/delete).Tested: typecheck, build, and the "GitHub REST compatibility" e2e, extended to drive the page's forms: add a secret (policy becomes protected only), switch to selected, add and remove a tag pattern, check the page lists the secret name but never its value, switch back to no restriction, delete the secret.
🤖 Generated with Claude Code
https://claude.ai/code/session_0111z4cdbfHSp6ssggDFN2Nb