Export Flows to Git with a Dry-Run Review

Push your Kestra flows to a Git repository without ever committing an unreviewed change. This blueprint mirrors flows from a namespace to a Git repo using a safe two-phase pattern: it generates a dry-run diff, alerts your team in Microsoft Teams, pauses for a human to inspect exactly what will change, then performs the real push only after approval. It solves the classic GitOps problem where automated flow exports silently overwrite or delete definitions in your Git mirror, giving you human-in-the-loop control over your source of truth.

How it works

1. The dry_run task (io.kestra.plugin.git.PushFlows with dryRun: true) computes the diff between the flows in sourceNamespace and the main branch of your repository under the _flows directory, including child namespaces, without writing anything.
2. The notify_review task (io.kestra.plugin.microsoft365.teams.TeamsIncomingWebhook) posts an adaptive card to Teams announcing that a diff is waiting, with the namespace and execution id.
3. The review task (io.kestra.plugin.core.flow.Pause) suspends the execution for up to approval_timeout (default PT1H) so a person can inspect the diff.
4. After resume, the push task (io.kestra.plugin.git.PushFlows with dryRun: false) commits and pushes the flows with a timestamped commitMessage.
5. An optional nightly_export schedule trigger (io.kestra.plugin.core.trigger.Schedule, cron 0 18 * * *, disabled by default) runs the reviewed export every evening.

What you get

• A reviewable diff before any commit lands in your Git mirror.
• Identical settings on the dry run and the real push, so the reviewed diff matches what is pushed.
• Team notifications in Microsoft Teams when a review is pending.
• Timestamped commit messages for a clear audit trail.
• Recursive export across child namespaces in one run.

Who it's for

• Platform and data engineering teams running GitOps for Kestra.
• Teams that need change control and approvals over their flow repository.
• Anyone backing up or version-controlling flows who wants safety before each push.

Why orchestrate this with Kestra

Git itself has no scheduler, no approval gate, and no notion of orchestrated steps. Kestra adds event and schedule triggers, a built-in Pause for human approval, retries on transient failures, full execution lineage over every export, and a declarative YAML definition you can version alongside the flows themselves. The dry-run-then-push pattern, the Teams alert, and the timed approval window are things a bare git push or a cron job simply cannot coordinate.

Prerequisites

• A Git repository to receive the exported flows.

Secrets

• GIT_USERNAME: Git HTTP username.
• GIT_TOKEN: Git HTTP token or password with write access to the repository.
• TEAMS_WEBHOOK_URL: Microsoft Teams incoming webhook URL for the review notification.

Quick start

1. Set GIT_USERNAME, GIT_TOKEN, and TEAMS_WEBHOOK_URL as secrets in your Kestra namespace.
2. Point the repository and source_namespace inputs at your repo and namespace.
3. Run the flow, read the dry-run diff, then resume the review Pause to push.

How to extend

• Enable the nightly_export trigger to run the reviewed export on a schedule.
• Swap the Teams notification for Slack or email, or add a link to the diff.
• Target a different branch or gitDirectory, or set includeChildNamespaces: false to scope a single namespace.
• Remove the review Pause for a fully unattended export once you trust the diff.

Links

• Git plugin documentation
• Orchestrate Git with Kestra