Git SyncFlow

Git SyncFlow
Certified
Sync a single flow from Git

Imports one flow YAML from a Git branch into a target namespace. Flow namespace is rewritten to targetNamespace. Supports dry-run to validate without saving.

yaml
type: io.kestra.plugin.git.SyncFlow

Examples

Sync a single flow from a Git repository to a specific namespace. This can be used to deploy or update individual flows.

yaml
id: sync_single_flow_from_git
namespace: company.ops

tasks:
  - id: sync_my_flow
    type: io.kestra.plugin.git.SyncFlow
    url: https://github.com/my-org/kestra-flows
    branch: main
    username: my_git_username
    password: "{{ secret('GITHUB_ACCESS_TOKEN') }}"
    targetNamespace: dev.marketing # required
    flowPath: "flows/marketing/flow.yml" # required
    kestraUrl: "http://localhost:8080"
    auth:
      username: "{{ secret('KESTRA_USERNAME') }}"
      password: "{{ secret('KESTRA_PASSWORD') }}"

Properties

auth *

Authentication information

Definitions

io.kestra.plugin.git.shared.AbstractKestraTask-Auth

apiTokenstring

API token for Bearer authentication

autobooleanstring

Defaulttrue

Automatically retrieve the URL and the credentials from Kestra's configuration if available

The default configuration can be configured globally inside the Kestra configuration file:

Set kestra.tasks.sdk.authentication.url to use a given API URL
Set kestra.tasks.sdk.authentication.api-token to use an API token
Set kestra.tasks.sdk.authentication.username and kestra.tasks.sdk.authentication.password for HTTP basic authentication The Enterprise edition also provides setting a default configuration at the Namespace of Tenant level by an administrator. Set this to false without any credentials to call a Kestra API that requires no authentication.

passwordstring

Password for HTTP Basic authentication

usernamestring

Username for HTTP Basic authentication

flowPath *string

Flow file path

Relative path to the flow YAML inside the repository.

targetNamespace *string

Target namespace

Replaces any namespace declared in the flow file.

branch string

Defaultmain

Branch to clone

Defaults to main.

connectTimeout integerstring

Default10000

HTTP connect timeout (ms)

Default 10000 ms.

dryRun booleanstring

Defaultfalse

Dry run only

When true, validates and logs without importing.

failOnMissingBranch booleanstring

Defaulttrue

Fail when the branch does not exist

When true (default), the task fails if branch does not exist on the remote. When false, a missing branch silently falls back to the repository's default branch, which can cause the wrong version of the flow to be synced.

gitConfig object

Git configuration overrides

Map of git config keys and values applied after clone, e.g.:

core.fileMode: false (ignore permission flips)
core.autocrlf: false (preserve line endings)

kestraUrl string

Kestra API URL

URL of the Kestra server API. If not set, the URL of the default SDK authentication is used, set with the kestra.tasks.sdk.authentication.url configuration property, or at the namespace or the tenant level on the Enterprise Edition. It then falls back to the kestra.url configuration property, and finally to http://localhost: 8080.

knownHosts string

Known hosts file content used for SSH host key verification

OpenSSH known_hosts-formatted content used to verify the remote server's SSH host key. If not set, the system/user known_hosts file is used. Only relevant when strictHostKeyChecking is true.

noProxy booleanstring

Disable proxy for HTTP

When true, forces direct connections instead of using the JVM proxy settings.

passphrase string

Passphrase for privateKey

password string

Password or personal access token

Supplies HTTP credentials. When a PAT is used, pushes are recorded under that PAT’s user without needing authorName and authorEmail.

**GitHub PAT permissions required: **

Fine-grained PAT: Contents: Read (clone/fetch) or Contents: Read and Write (push), plus Metadata: Read (mandatory base permission). Add Workflows: Read and Write when pushing .github/workflows/ files.
Classic PAT: repo scope covers all read/write operations; add workflow when pushing workflow files.

privateKey string

PEM private key

PEM-formatted private key matching a public key registered on the Git server. Generate with ssh-keygen -t ecdsa -b 256 -m PEM.

readTimeout integerstring

Default60000

HTTP read timeout (ms)

Default 60000 ms.

strictHostKeyChecking booleanstring

Whether to verify the SSH remote server's host key

When enabled, the host key presented by the Git server is verified against knownHosts (if provided) or the system/user known_hosts file. Disabling it exposes the connection to man-in-the-middle attacks (CWE-297). Set knownHosts alongside this property for a hardened setup. The default differs by edition: disabled (false) on Kestra OSS, enabled (true) on Kestra Enterprise Edition.

trustedCaPemPath string

Extra trusted CA PEM path

Optional PEM-encoded CA bundle added to the JVM truststore; equivalent to git config http.sslCAInfo <path> for self-signed or internal CAs.

url string

Repository URL

HTTP(S) or SSH URI used for clone and push operations.

username string

Username or organization

Used for HTTP basic authentication and as a fallback commit author.

Outputs

flowId string

The ID of the synced flow

namespace string

The namespace of the synced flow

revision integer

The new revision number of the flow

Azure

Enterprise

Tasks that integrate Microsoft Azure services into Kestra enterprise workflows.

CloudDataInfrastructure

Elasticsearch

Tasks that query and write to Elasticsearch clusters for search, indexing, bulk ingestion, and ES|QL.

DataInfrastructure

Git SyncFlowCertifiedSync a single flow from Git

More Plugins in this Category

Azure

Elasticsearch

Git SyncFlow
Certified
Sync a single flow from Git