Repository Sync & Governance

DEC GA-FS — Git Advanced Fleet Sync

Multi-platform Git synchronization with cross-platform policy enforcement, supply-chain verification, SBOM capture, and signed-commit validation
What it is
A policy-governed Git mirror and sync engine with an open-source single-node core and a commercial Fleet edition for multi-instance orchestration. Replaces ad-hoc scripts and cron jobs with parallel workers, a web UI, cross-platform policy enforcement, supply-chain verification, and an immutable audit ledger.
Handles
GitHub, GitLab, Gitea, Bitbucket over SSH or HTTPS. Branches, tags, notes, and arbitrary refspecs. Private-to-public sync is gated and ledgered by default.
Does
Parallel worker-driven mirror sync (one-way or bidirectional); branch / tag / notes refspec filtering; cross-platform policy enforcement (same policy applied consistently across multiple Git hosts); supply-chain verification on incoming refs; SBOM capture per commit and per release tag; signed-commit validation (GPG + Sigstore); fast-forward-only enforcement on protected branches; conflict detection; private-to-public authorization ledger; per-repo and per-mirror audit trail. Dependency-graph attestation, release-provenance sealing, and pipeline coordination are on the roadmap (target 2027).
Architecture
Core–subcore topology (deployable with or without agents). The OSS core is a single-node sync engine. GA-FS Fleet runs a central core that federates many subcore sync instances across teams, regions, or tenants — shared policy, central audit plane.
Deployment
OSS core runs anywhere Python runs. GA-FS Fleet is a Linux-based appliance (on-prem bare metal, VM, or cloud appliance VM) coordinating multiple sync instances across teams and sites.
Editions
Open-source core (free) · Fleet Enterprise. See edition comparison →
Designed for
Head of Platform Engineering, VP Engineering, SRE leads managing mirror relationships between internal and external Git platforms who need governance + auditability.

Your team has repositories scattered across GitHub, GitLab, and Gitea. Keeping them in sync means scripts, cron jobs, SSH keys, and hoping nobody forgets to push to the other remote. GA-FS replaces all of that with a web UI and parallel workers. One-way mirrors, bidirectional sync, branch filtering, conflict detection — configured from your browser, governed by policy, audited by design.

Your repos are scattered across providers. Your sync strategy isn't keeping up.

Teams with repos on multiple Git platforms waste time on manual sync scripts. Someone wrote a cron job two years ago and nobody remembers how it works. When it breaks, nobody notices until a deployment pulls stale code.

There's no governance — anyone can accidentally push internal code to a public repo. A single misconfigured remote turns a private codebase into an open one, and you only find out when someone outside the company opens an issue.

And there's no visibility. Who synced what, when, why? When something goes wrong, the forensics start with "check the cron logs on that one server" — if the server still exists, and if the logs weren't rotated last week.

How GA-FS Works

Multi-Provider Sync

GitHub, GitLab, Gitea — managed from one dashboard. Add providers, configure credentials, and see every sync relationship in a single view. No more juggling remotes across platforms.

Branch-Level Filtering

Sync only main, release/*, not the whole repo. Keep feature branches private, share only what's ready. Filter by pattern — include, exclude, or both.

Parallel Workers

Fork-per-repo concurrency with resource-aware scheduling. Sync hundreds of repositories without bottlenecking on a single process. The worker daemon scales to your fleet, not the other way around.

Sync Governance

Private-to-public sync is blocked by default. Every authorization is recorded in an immutable ledger. Admins can block specific sync directions, and the system enforces visibility checks before any push leaves the network.

Fleet Orchestration

Manage multiple sync instances from one control plane. Register instances, push credentials, enforce fleet-wide governance policies, and view aggregated sync status across every team and site. (Commercial — GA-FS Fleet)

Debug Taps

tcpdump for git syncs — verify source accessibility and target delivery. When a sync fails, you don't guess. You see exactly what the worker attempted, what the remote returned, and where the pipeline broke.

One sync tool can't reach every repo. A fleet can.

Real corporate networks aren't flat. Your GitHub is on the public internet, behind your egress proxy. Your internal GitLab is on the LAN with no route to the outside. Your lab Gitea is on a segregated VLAN behind another firewall. The customer-hosted instance is across a B2B VPN. The secure-enclave GitLab is in a network that can't talk to anything else at all.

A single sync tool — SaaS, self-hosted, doesn't matter — sits in one network segment. It can reach some of those repos. The rest are dark to it. This is why most teams end up with three or four separate sync setups, each in a different network zone, each managed by hand, each with no idea the others exist.

GA-FS solves this physically. Place a core instance wherever the network can reach the repos. One in the DMZ for GitHub. One on the internal LAN for the corporate GitLab. One in the lab VLAN for the dev Gitea. One inside the secure enclave for the regulated repos. Each core handles only what it can reach — and Fleet sits at the boundary where it can talk to all the cores via a simple REST API. The cores never have to talk to each other directly. Fleet aggregates the view and the governance.

A single sync tool can govern only the repos it can reach. A fleet of cores, one in each network zone, governs them all through a shared control plane — and presents one view of who synced what, when, and why.

Architecture

GA-FS is split into an open source core and a commercial fleet layer. The open source core handles limited local and remote syncs as a single instance. Our commercial Fleet product adds advanced capabilities and additional features such as multi-instance orchestration, instance and site rebalancing, and centralized governance. Fleet can manage configurations centrally — or allow local configurations to remain local but visible to other instances in the fleet.

Open Source Core (git-advanced-multisync)
  Web UI + REST API       Configure providers, profiles, mappings
  Worker Daemon           Fork-per-repo parallel sync
  Sync Engine             Clone, check conflicts, push (ff-only/force/reject)
  Governance              Authorization ledger, admin blocks, visibility checks

Commercial (GA-FS Fleet)
  Fleet Dashboard         Aggregated view across all instances
  Instance Manager        Register, provision, health-check
  Credential Manager      Central token store, push to instances
  Fleet Binding           Cores lock to one Fleet, audit trail

Two Editions

The open source core handles limited local and remote syncs as a single instance. The commercial Fleet product adds advanced capabilities and additional features for organizations running multiple instances across teams and sites.

Open Source Core (Apache 2.0)

A fully featured single-instance sync engine. Limited local and remote syncs across GitHub, GitLab, and Gitea. Web UI, parallel workers, branch filtering, sync governance, syslog forwarding. Free forever.

github.com/DEC-LLC/git-advanced-multisync

GA-FS Fleet (Commercial)

Adds advanced capabilities on top of the open source core:

  • Multi-instance orchestration — manage every core instance from one dashboard
  • Instance and site rebalancing — move workloads between instances as load shifts or sites grow
  • Centralized configuration — push provider credentials, sync profiles, and policies to all instances at once
  • Local-but-visible mode — let local admins keep their own configurations while making them visible (read-only) to the rest of the fleet
  • Cross-instance governance ledger — every authorization decision across every instance, in one audit trail
  • Fleet binding lock — once a core is registered, no rogue Fleet can take it over

Wondering how GA-FS compares to what you do today?

Read: GA-FS vs Cron Scripts and Hope →

Register Your Interest

Get pricing, a demo, and early access to GA-FS Fleet. We'll be in touch within one business day.

Or call us — contact info at the bottom of every page.

Stop duct-taping your repo sync. Govern it.

GA-FS gives you parallel sync, branch filtering, and governance — configured from your browser, audited by design. The open source core is free. Fleet adds orchestration when you need it.

Get the Open Source Core Talk to Us