Git PushExecutionFiles

Git PushExecutionFiles
Certified
Push execution files to Git

Stages execution output files from the working directory or storage and pushes them to Git under gitDirectory (default _outputs). Branch is created if missing; use dryRun to only generate the diff.

yaml
type: io.kestra.plugin.git.PushExecutionFiles

Examples

Push output files generated from task to Git

yaml
id: push_exec_files
namespace: company.team

tasks:
  - id: generate
    type: io.kestra.plugin.scripts.python.Script
    taskRunner:
      type: io.kestra.plugin.core.runner.Process
    outputFiles:
      - report.txt
    script: |
      with open("report.txt", "w") as f:
          f.write("Analysis done")

  - id: push
    type: io.kestra.plugin.git.PushExecutionFiles
    files:
      - "*.txt"
    gitDirectory: analytics
    url: https://github.com/company/data-pipeline
    username: git_user
    password: "{{ secret('GITHUB_TOKEN') }}"
    branch: data-reports
    commitMessage: "Add CSV and JSON reports {{ now() }}"

Push and rename execution outputs using filesMap

yaml
id: push_with_map
namespace: company.logs

tasks:
  - id: generate
    type: io.kestra.plugin.scripts.shell.Script
    outputFiles:
      - "run.log"
    script: |
      echo "Run completed at $(date)" > run.log

  - id: push
    type: io.kestra.plugin.git.PushExecutionFiles
    filesMap:
      "run-{{ execution.id }}.log": "{{ outputs.generate.outputFiles['run.log'] }}"
    gitDirectory: logs
    url: https://github.com/company/log-archive
    username: git_user
    password: "{{ secret('GITHUB_TOKEN') }}"
    branch: logs
    commitMessage: "Archive log for run {{ execution.id }}"

Properties

auth

Kestra API authentication

Definitions

io.kestra.plugin.git.shared.AbstractCloningTask-Auth

apiTokenstring

API token for authentication.

autobooleanstring

Defaulttrue

Automatically retrieve the URL and the credentials from Kestra's configuration if available

Can be configured globally in the Kestra configuration file:

Set kestra.tasks.sdk.authentication.url for the API URL
Set kestra.tasks.sdk.authentication.api-token for API token auth
Set kestra.tasks.sdk.authentication.username and kestra.tasks.sdk.authentication.password for HTTP Basic auth The Enterprise Edition also allows an administrator to set these defaults at the namespace or the tenant level. Set this to false without any credentials to call a Kestra API that requires no authentication.

passwordstring

Password for HTTP Basic authentication.

usernamestring

Username for HTTP Basic authentication.

authorEmail string

Commit author email

If null, no author is set.

authorName string

Commit author name

Defaults to username when empty.

branch string

Defaultmain

Branch to push files

Defaults to main; created if absent.

cloneSubmodules booleanstring

Clone submodules

Default false; enable to fetch and initialize nested submodules.

commitMessage string

DefaultAdd files from execution {{ execution.id }}

Git commit message

connectTimeout integerstring

Default10000

HTTP connect timeout (ms)

Default 10000 ms.

delete booleanstring

Defaulttrue

Delete removed resources

If true (default), removes Git files that no longer exist in Kestra.

dryRun booleanstring

Defaultfalse

Dry run only

When true, writes a diff file without pushing. Default false pushes immediately.

errorOnMissing booleanstring

Defaultfalse

Fail when no files are found

If true, raises an error when nothing matches files or filesMap; default false logs a warning and skips.

files object

Glob pattern(s) for execution files

Matches files relative to the execution working directory.

filesMap objectstring

Explicit file map

Map of destination filename to source file URI (string or JSON map). Useful for wiring outputFiles from other tasks.

gitConfig object

Git configuration overrides

Map of git config keys and values applied after clone, e.g.:

core.fileMode: false (ignore permission flips)
core.autocrlf: false (preserve line endings)

gitDirectory string

Default_outputs

Destination directory

Relative path inside the repository; defaults to _outputs.

kestraUrl string

Kestra API URL

URL of the Kestra server API. If not set, the URL of the default SDK authentication is used, set with the kestra.tasks.sdk.authentication.url configuration property, or at the namespace or the tenant level on the Enterprise Edition. It then falls back to the kestra.url configuration property, and finally to http://localhost: 8080.

knownHosts string

Known hosts file content used for SSH host key verification

OpenSSH known_hosts-formatted content used to verify the remote server's SSH host key. If not set, the system/user known_hosts file is used. Only relevant when strictHostKeyChecking is true.

noProxy booleanstring

Disable proxy for HTTP

When true, forces direct connections instead of using the JVM proxy settings.

passphrase string

Passphrase for privateKey

password string

Password or personal access token

Supplies HTTP credentials. When a PAT is used, pushes are recorded under that PAT’s user without needing authorName and authorEmail.

**GitHub PAT permissions required: **

Fine-grained PAT: Contents: Read (clone/fetch) or Contents: Read and Write (push), plus Metadata: Read (mandatory base permission). Add Workflows: Read and Write when pushing .github/workflows/ files.
Classic PAT: repo scope covers all read/write operations; add workflow when pushing workflow files.

privateKey string

PEM private key

PEM-formatted private key matching a public key registered on the Git server. Generate with ssh-keygen -t ecdsa -b 256 -m PEM.

pushMode string

DefaultSYNC

Possible Values

SYNCDELETE_ONLY

Push mode

SYNC (default) writes every matched resource to the work tree and stages it, in addition to staging removals when delete is true — this is the standard push behavior, unchanged.

DELETE_ONLY stages only the removal of resources no longer present on the instance: it leaves already-pushed, still-matching resources untouched even if they changed since the last push. Use it to push a deletion without re-pushing unrelated modified resources. DELETE_ONLY implies deletion staging, so setting delete to false together with DELETE_ONLY is ignored (a warning is logged).

readTimeout integerstring

Default60000

HTTP read timeout (ms)

Default 60000 ms.

strictHostKeyChecking booleanstring

Whether to verify the SSH remote server's host key

When enabled, the host key presented by the Git server is verified against knownHosts (if provided) or the system/user known_hosts file. Disabling it exposes the connection to man-in-the-middle attacks (CWE-297). Set knownHosts alongside this property for a hardened setup. The default differs by edition: disabled (false) on Kestra OSS, enabled (true) on Kestra Enterprise Edition.