Governed GitOps delivery

FleetAMP accepts change intent, resolves authorized targets, validates compatibility, creates an immutable repository preview, and requires approval before execution is queued. It does not create repositories or pipelines.

Workflow

Step	Record	Purpose
Register	Repository connection	Defines provider, repository, branch, allowed root, and permitted groups
Validate	Connection validation	Proves current repository and branch access
Propose	Component lifecycle request	Freezes operation, component, target scope, method, and versions
Resolve	Compatibility validation	Snapshots eligible targets and blocking findings
Approve	Component approval	Applies four-eyes review to exact evidence
Prepare	Execution plan and preview	Resolves the safe path and renders files and diff
Approve preview	Preview approval	Authorizes exact preview hashes
Queue	Execution outbox request	Creates immutable provider work
Deliver	Append-only events	Records dry-run or provider progress
Observe	Statistics and audit	Exposes status, retries, actors, and outcomes

Configure credentials

The UI stores only a reference such as secret://github/production. FleetAMP resolves it at runtime from its configured secret source. Never put the token in a connection, preview, configuration file, or Git commit.

For GitHub pull-request delivery, use a fine-grained token limited to the selected repository with Contents read/write and Pull requests read/write permissions.

Register and validate a connection

1. Open Administration → Integrations.
2. Enter a name and select GitHub, GitLab, or Azure DevOps.
3. Complete only the provider-specific fields shown.
4. Select an existing repository and branch.
5. Set a relative allowed root such as fleetamp/groups.
6. Select permitted FleetAMP groups.
7. Enter the credential reference and save.
8. Select Test connection.

Validation evidence expires after the configured TTL. Self-hosted provider hosts must use HTTPS and be explicitly allowed.

Propose and approve delivery

1. Open Deployments and create the required lifecycle proposal.
2. Select the ownership group, optional labels, and GitOps delivery.
3. Resolve targets and fix blocking compatibility findings.
4. Assign a different eligible reviewer and obtain approval.
5. Select a currently validated repository connection.
6. Generate the immutable GitOps preview.
7. Confirm the path remains below the allowed root and review every file.
8. Submit the exact preview for approval.
9. Queue the approved preview.
10. Follow progress in GitOps execution monitor.

A changed plan, preview, connection snapshot, branch, or path requires new approval.

Start with dry-run

Enable the worker while keeping provider writes disabled. Dry-run validates and records execution without committing or opening a pull request.

Enable real GitHub writes only after dry-run succeeds against a dedicated test repository. GitLab and Azure DevOps repository writes may remain unavailable depending on the installed FleetAMP release; check its release notes.

Security checklist

• Use a dedicated test repository and least-privilege credential.
• Keep provider writes disabled by default.
• Restrict every connection to explicit FleetAMP groups.
• Use a relative allowed root and inspect the resolved path.
• Never approve your own proposal or preview.
• Revalidate expired connection evidence.
• Confirm audit data contains references and hashes, not credentials.