@flowwright/plugin-git

The git chores every pipeline ends up needing — checkout, clone, tag, push, and a ready-made credentialed checkout stage — packaged up so you don't rewrite them each time. They're thin wrappers over the @flowwright/core sh primitive (array form, no shell), so every command is recorded into the execution-plan IR and visible in flow explain.

Step helpers (call inside a stage body)

import { checkout, gitTag, gitPush } from "@flowwright/plugin-git";

stage("Checkout", async () => {
  await checkout("[email protected]:acme/api.git", { ref: "main", depth: 1, submodules: true });
});

stage("Release", async () => {
  await gitTag("v1.2.0", { message: "release v1.2.0", push: true });
});

• checkout(url, { ref?, dir?, depth?, submodules?, fetchTags? })
• gitClone(url, dir?), gitCheckout(ref)
• gitTag(name, { message?, push? }), gitPush({ remote?, ref?, tags? })

checkoutStage() — a ready-made stage

import { pipeline } from "@flowwright/core";
import { checkoutStage } from "@flowwright/plugin-git";

export default pipeline({
  name: "api",
  stages: [
    checkoutStage("[email protected]:acme/api.git", { ref: "main", credential: "deploy-key" }),
    // ...stages that `needs: ["checkout"]`
  ],
});

credential binds an sshPrivateKey credential: the key is materialized to a temp file exposed as GIT_SSH_KEY, and git is routed over it via GIT_SSH_COMMAND — the key value never enters the IR or the logs.

@flowwright/plugin-std re-exports checkout/gitCheckout/gitClone from this package for backwards compatibility.