Skip to main content

​
Deploy from GitHub

Two ways to get a GitHub repository running on Zavu:
  • One-off import from your terminal: npx zavudev import owner/repo (see the CLI reference).
  • Deploy on push: link the repository to a function in the dashboard, add the webhook to GitHub, and every push to the linked branch deploys automatically. This page covers that flow.

​
Linking a repository

From the terminal, in the function’s directory:
It takes owner/repo, a github.com URL, or an SSH remote, and --root for a monorepo. What it prints next depends on your project. With the Zavu GitHub App installed, that is the whole setup: pushes arrive through the app and private repositories work. Without it, the command prints a payload URL and a secret to add as a webhook in the repository yourself, and the secret is shown once. fn git status shows the link and the last deploy, fn git deploy deploys the linked branch without waiting for a push, and fn git unlink removes it. Or do the same in the dashboard: open the function and go to the Git tab:
  1. Enter the repository owner, name, and branch (and a root directory for monorepos).
  2. Zavu shows a payload URL and a webhook secret. The secret is shown once — copy it now.
  3. In the repository’s GitHub settings, add a webhook with that URL and secret, content type application/json, events: just the push event.
GitHub sends a ping when the webhook is created; from then on, every push to the linked branch fetches the repo, detects the project type, builds, and deploys through the same pipeline as npx zavudev deploy.

​
What gets detected

Anything else fails the deploy with a clear error in the Git tab’s status line. For monorepos, point the link’s root directory at the project folder.

​
Manual deploys and status

The Git tab shows the last deploy’s commit, message, and outcome, and a Deploy now button that fetches the linked branch on demand — useful after changing secrets or to retry a failed deploy. Turning Deploy on push off keeps the link but ignores pushes.

​
Security notes

  • Each link has its own webhook secret. Every delivery is verified against it (HMAC), and a signature that does not match is ignored — deliveries can never deploy another project’s function.
  • Re-linking generates a fresh secret; the old one stops working immediately.
  • Public repositories work out of the box. For private repositories, your Zavu deployment needs a GitHub token configured server-side — contact support, or use npx zavudev import with a local GITHUB_TOKEN instead.