From f1770e29813edf2a71aa51b61d1cae2d35fa99be Mon Sep 17 00:00:00 2001
From: Noley Holland <hollandnoley@gmail.com>
Date: Thu, 11 Jun 2026 12:48:15 -0700
Subject: [PATCH 01/10] Add username and caCertificate fields to GitToken with
 migration

---
 .../20260611-01-EE-extend-gittoken-generic.js | 19 +++++++++++++++++++
 forge/ee/db/models/GitToken.js                |  8 ++++++++
 2 files changed, 27 insertions(+)
 create mode 100644 forge/db/migrations/20260611-01-EE-extend-gittoken-generic.js

diff --git a/forge/db/migrations/20260611-01-EE-extend-gittoken-generic.js b/forge/db/migrations/20260611-01-EE-extend-gittoken-generic.js
new file mode 100644
index 0000000000..3f36aee4df
--- /dev/null
+++ b/forge/db/migrations/20260611-01-EE-extend-gittoken-generic.js
@@ -0,0 +1,19 @@
+const { DataTypes } = require('sequelize')
+
+module.exports = {
+    /**
+     * upgrade database
+     * @param {QueryInterface} context Sequelize.QueryInterface
+     */
+    up: async (context, Sequelize) => {
+        await context.addColumn('GitTokens', 'username', {
+            type: DataTypes.STRING,
+            allowNull: true
+        })
+        await context.addColumn('GitTokens', 'caCertificate', {
+            type: DataTypes.TEXT,
+            allowNull: true
+        })
+    },
+    down: async (context, Sequelize) => { }
+}
diff --git a/forge/ee/db/models/GitToken.js b/forge/ee/db/models/GitToken.js
index 32cc90fef0..67f1bc340c 100644
--- a/forge/ee/db/models/GitToken.js
+++ b/forge/ee/db/models/GitToken.js
@@ -15,6 +15,14 @@ module.exports = {
             type: DataTypes.STRING,
             allowNull: false,
             default: 'github'
+        },
+        username: {
+            type: DataTypes.STRING,
+            allowNull: true
+        },
+        caCertificate: {
+            type: DataTypes.TEXT,
+            allowNull: true
         }
     },
     associations: function (M) {

From d32529ccf9c3c4335d5a79fc14cf9b6af95068c7 Mon Sep 17 00:00:00 2001
From: Noley Holland <hollandnoley@gmail.com>
Date: Thu, 11 Jun 2026 13:07:18 -0700
Subject: [PATCH 02/10] Add generic Git backend for arbitrary HTTPS servers

---
 forge/ee/lib/gitops/backends/generic.js | 168 ++++++++++++++++++++++++
 1 file changed, 168 insertions(+)
 create mode 100644 forge/ee/lib/gitops/backends/generic.js

diff --git a/forge/ee/lib/gitops/backends/generic.js b/forge/ee/lib/gitops/backends/generic.js
new file mode 100644
index 0000000000..d1552c0642
--- /dev/null
+++ b/forge/ee/lib/gitops/backends/generic.js
@@ -0,0 +1,168 @@
+const { exec } = require('node:child_process')
+const { existsSync } = require('node:fs')
+const fs = require('node:fs/promises')
+const os = require('node:os')
+const path = require('node:path')
+const { promisify } = require('node:util')
+const execPromised = promisify(exec)
+
+const { encryptValue, decryptValue } = require('../../../../db/utils')
+
+const { cloneRepository } = require('./utils')
+
+module.exports.init = async function (app) {
+    /**
+     * Push a snapshot to a git repository
+     * @param {Object} repoOptions
+     * @param {String} repoOptions.token
+     * @param {String} repoOptions.url
+     * @param {String} repoOptions.branch
+     * @param {String} repoOptions.username
+     * @param {Object} snapshot
+     * @param {Object} options
+     * @param {Object} options.sourceObject what produced the snapshot
+     * @param {Object} options.user who triggered the pipeline
+     * @param {Object} options.pipeline details of the pipeline
+     */
+    async function pushToRepository (repoOptions, snapshot, options) {
+        let workingDir
+        try {
+            const branch = repoOptions.branch || 'main'
+            if (!/^https:\/\//i.test(repoOptions.url)) {
+                throw new Error('Only HTTPS git URLs are supported')
+            }
+            const url = new URL(repoOptions.url)
+            url.username = repoOptions.username ? repoOptions.username : 'x-access-token'
+            url.password = repoOptions.token
+
+            workingDir = await fs.mkdtemp(path.join(os.tmpdir(), 'flowfuse-git-repo-'))
+
+            // 3. clone repo
+            await cloneRepository(url, branch, workingDir)
+
+            // 4. set username/email
+            await execPromised('git config user.email "no-reply@flowfuse.com"', { cwd: workingDir })
+            await execPromised('git config user.name "FlowFuse"', { cwd: workingDir })
+            // For local dev - disable gpg signing in case its set in global config
+            await execPromised('git config commit.gpgsign false', { cwd: workingDir })
+
+            // 5. export snapshot
+            const exportOptions = {
+                credentialSecret: repoOptions.credentialSecret,
+                components: {
+                    flows: true,
+                    credentials: true
+                }
+            }
+            const result = await app.db.controllers.Snapshot.exportSnapshot(snapshot, exportOptions)
+            const snapshotExport = app.db.views.ProjectSnapshot.snapshotExport(result)
+            if (snapshotExport.settings?.settings?.palette?.npmrc) {
+                const enc = encryptValue(repoOptions.credentialSecret, snapshotExport.settings.settings?.palette?.npmrc)
+                snapshotExport.settings.settings.palette.npmrc = { $: enc }
+            }
+            const snapshotFile = path.join(workingDir, repoOptions.path || 'snapshot.json').replace(/"/g, '')
+            await fs.writeFile(snapshotFile, JSON.stringify(snapshotExport, null, 4))
+
+            // 6. stage file
+            await execPromised(`git add "${snapshotFile}"`, { cwd: workingDir })
+
+            // 7. commit
+            await execPromised(`git commit -m "Update snapshot\n\nSnapshot updated by FlowFuse Pipeline '${options.pipeline.name.replace(/"/g, '')}', triggered by ${options.user.username.replace(/"/g, '')}"`, { cwd: workingDir })
+
+            try {
+                // 8. push
+                await execPromised('git push', { cwd: workingDir })
+            } catch (err) {
+                const output = err.stdout + err.stderr
+                if (/unable to access/.test(output)) {
+                    const result = new Error('Permission denied')
+                    result.code = 'invalid_token'
+                    result.cause = err
+                    throw result
+                }
+                let error
+                const m = /fatal: (.*)/.exec(output)
+                if (m) {
+                    error = new Error('Failed to push repository: ' + m[1])
+                } else {
+                    error = Error('Failed to push repository')
+                }
+                error.cause = err
+                throw error
+            }
+        } finally {
+            if (workingDir) {
+                try {
+                    await fs.rm(workingDir, { recursive: true, force: true })
+                } catch (err) {}
+            }
+        }
+    }
+
+    /**
+     * Push a snapshot to a git repository
+     * @param {Object} repoOptions
+     * @param {String} repoOptions.token
+     * @param {String} repoOptions.url
+     * @param {String} repoOptions.branch
+     * @param {String} repoOptions.username
+     */
+    async function pullFromRepository (repoOptions) {
+        let workingDir
+        try {
+            const branch = repoOptions.branch || 'main'
+            if (!/^https:\/\//i.test(repoOptions.url)) {
+                throw new Error('Only HTTPS git URLs are supported')
+            }
+            const url = new URL(repoOptions.url)
+            url.username = repoOptions.username ? repoOptions.username : 'x-access-token'
+            url.password = repoOptions.token
+
+            workingDir = await fs.mkdtemp(path.join(os.tmpdir(), 'flowfuse-git-repo-'))
+
+            // 3. clone repo
+            await cloneRepository(url, branch, workingDir)
+
+            const snapshotFile = path.join(workingDir, repoOptions.path || 'snapshot.json').replace(/"/g, '')
+
+            if (!existsSync(snapshotFile)) {
+                throw new Error('Snapshot file not found in repository')
+            }
+
+            try {
+                const snapshotContent = await fs.readFile(snapshotFile, 'utf8')
+                const snapshot = JSON.parse(snapshotContent)
+                if (snapshot.settings?.env) {
+                    const keys = Object.keys(snapshot.settings.env)
+                    keys.forEach((key) => {
+                        const env = snapshot.settings.env[key]
+                        if (env.hidden && env.$) {
+                            // Decrypt the value if it is encrypted
+                            env.value = decryptValue(repoOptions.credentialSecret, env.$)
+                            delete env.$
+                        }
+                    })
+                }
+                if (snapshot.settings?.settings?.palette?.npmrc) {
+                    const npmrc = snapshot.settings.settings.palette.npmrc
+                    if (typeof npmrc === 'object' && npmrc.$) {
+                        snapshot.settings.settings.palette.npmrc = decryptValue(repoOptions.credentialSecret, npmrc.$)
+                    }
+                }
+                return snapshot
+            } catch (err) {
+                throw new Error('Failed to read snapshot file: ' + err.message)
+            }
+        } finally {
+            if (workingDir) {
+                try {
+                    await fs.rm(workingDir, { recursive: true, force: true })
+                } catch (err) {}
+            }
+        }
+    }
+    return {
+        pushToRepository,
+        pullFromRepository
+    }
+}

From c99cc4378e41604f9e720722068e87645d8925c0 Mon Sep 17 00:00:00 2001
From: Noley Holland <hollandnoley@gmail.com>
Date: Thu, 11 Jun 2026 13:32:08 -0700
Subject: [PATCH 03/10] Wire generic Git provider through dispatch and UI

---
 forge/ee/db/models/PipelineStageGitRepo.js    |  2 ++
 forge/ee/lib/gitops/index.js                  |  5 +++++
 forge/ee/routes/gitops/index.js               |  3 ++-
 frontend/src/assets/icons/git.svg             |  7 +++++++
 .../pages/application/PipelineStage/form.vue  | 21 +++++++++----------
 .../Settings/dialogs/CreateGitTokenDialog.vue | 16 ++++++++++++--
 .../GenericInstructions.vue                   | 17 +++++++++++++++
 7 files changed, 57 insertions(+), 14 deletions(-)
 create mode 100644 frontend/src/assets/icons/git.svg
 create mode 100644 frontend/src/pages/team/Settings/dialogs/components/CreateGitTokenDialog/GenericInstructions.vue

diff --git a/forge/ee/db/models/PipelineStageGitRepo.js b/forge/ee/db/models/PipelineStageGitRepo.js
index 21453fc974..c2696bbabf 100644
--- a/forge/ee/db/models/PipelineStageGitRepo.js
+++ b/forge/ee/db/models/PipelineStageGitRepo.js
@@ -103,6 +103,7 @@ module.exports = {
                             await app.gitops.pushToRepository({
                                 token: gitToken.token,
                                 tokenType: gitToken.type,
+                                username: gitToken.username,
                                 url: this.url,
                                 branch: this.branch,
                                 credentialSecret: this.credentialSecret,
@@ -156,6 +157,7 @@ module.exports = {
                         const snapshotContent = await app.gitops.pullFromRepository({
                             token: gitToken.token,
                             tokenType: gitToken.type,
+                            username: gitToken.username,
                             url: this.url,
                             branch: this.pullBranch || this.branch,
                             credentialSecret: this.credentialSecret,
diff --git a/forge/ee/lib/gitops/index.js b/forge/ee/lib/gitops/index.js
index 1850221528..a8789ec1a3 100644
--- a/forge/ee/lib/gitops/index.js
+++ b/forge/ee/lib/gitops/index.js
@@ -15,6 +15,7 @@ module.exports.init = async function (app) {
     // load backends
     const github = await require('./backends/github').init(app)
     const azure = await require('./backends/azure').init(app)
+    const generic = await require('./backends/generic').init(app)
 
     // Set the git feature flag
     app.config.features.register('gitIntegration', true, true)
@@ -36,6 +37,8 @@ module.exports.init = async function (app) {
             await github.pushToRepository(repoOptions, snapshot, options)
         } else if (repoOptions.tokenType === 'azure') {
             await azure.pushToRepository(repoOptions, snapshot, options)
+        } else if (repoOptions.tokenType === 'generic') {
+            await generic.pushToRepository(repoOptions, snapshot, options)
         }
     }
 
@@ -51,6 +54,8 @@ module.exports.init = async function (app) {
             return github.pullFromRepository(repoOptions)
         } else if (repoOptions.tokenType === 'azure') {
             return azure.pullFromRepository(repoOptions)
+        } else if (repoOptions.tokenType === 'generic') {
+            return generic.pullFromRepository(repoOptions)
         }
     }
 
diff --git a/forge/ee/routes/gitops/index.js b/forge/ee/routes/gitops/index.js
index 931047384f..69869d770d 100644
--- a/forge/ee/routes/gitops/index.js
+++ b/forge/ee/routes/gitops/index.js
@@ -49,7 +49,8 @@ module.exports = async function (app) {
                 name: body.name,
                 token: body.token,
                 TeamId: request.team.id,
-                type: body.type || 'github'
+                type: body.type || 'github',
+                username: body.username || ''
             })
             // TODO: audit log
             // await app.auditLog.Project.project.httpToken.created(request.session.User, null, request.project, body)
diff --git a/frontend/src/assets/icons/git.svg b/frontend/src/assets/icons/git.svg
new file mode 100644
index 0000000000..f87f253478
--- /dev/null
+++ b/frontend/src/assets/icons/git.svg
@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round">
+    <circle cx="6" cy="6" r="2.5" />
+    <circle cx="6" cy="18" r="2.5" />
+    <circle cx="18" cy="9" r="2.5" />
+    <path d="M6 8.5v7" />
+    <path d="M18 11.5c0 3-2.5 4-6 4" />
+</svg>
diff --git a/frontend/src/pages/application/PipelineStage/form.vue b/frontend/src/pages/application/PipelineStage/form.vue
index 4d81102feb..6507b93c41 100644
--- a/frontend/src/pages/application/PipelineStage/form.vue
+++ b/frontend/src/pages/application/PipelineStage/form.vue
@@ -659,18 +659,15 @@ export default {
         repoStageHasCredentialSecret () {
             return this.stage.gitRepo?.credentialSecret
         },
+        selectedGitTokenType () {
+            const tok = this.gitTokens.find(t => t.value === this.input.gitTokenId)
+            return tok?.type
+        },
         gitPlaceholder () {
-            if (this.input.gitTokenId) {
-                for (const i in this.gitTokens) {
-                    const tok = this.gitTokens[i]
-                    if (tok.value === this.input.gitTokenId) {
-                        if (tok.type === 'github') {
-                            return 'e.g. https://github.com/[org]/[repo]'
-                        } else if (tok.type === 'azure') {
-                            return 'e.g. https://dev.azure.com/[org]/_git/[repo]'
-                        }
-                    }
-                }
+            if (this.selectedGitTokenType === 'azure') {
+                return 'e.g. https://dev.azure.com/[org]/_git/[repo]'
+            } else if (this.selectedGitTokenType === 'generic') {
+                return 'e.g. https://git.example.com/org/repo.git'
             }
             return 'e.g. https://github.com/[org]/[repo]'
         }
@@ -688,6 +685,8 @@ export default {
         'input.url' (newUrl, oldUrl) {
             if (newUrl === '') {
                 this.errors.url = ''
+            } else if (this.selectedGitTokenType === 'generic') {
+                this.errors.url = /^https:\/\//i.test(newUrl) ? '' : 'Please enter a valid HTTPS repository URL'
             } else if (!/^https:\/\/github\.com\/[^/]+\/[^/]+$/.test(newUrl) && !/^https:\/\/dev\.azure\.com\/[^/]+\/_git\/[^/]+$/.test(newUrl)) {
                 this.errors.url = 'Please enter a valid GitHub or Azure DevOps repository URL'
             } else {
diff --git a/frontend/src/pages/team/Settings/dialogs/CreateGitTokenDialog.vue b/frontend/src/pages/team/Settings/dialogs/CreateGitTokenDialog.vue
index e989214139..9ae9ff40eb 100644
--- a/frontend/src/pages/team/Settings/dialogs/CreateGitTokenDialog.vue
+++ b/frontend/src/pages/team/Settings/dialogs/CreateGitTokenDialog.vue
@@ -12,6 +12,7 @@
             <form class="space-y-6 mt-4 mb-2">
                 <FormRow v-model="input.name" data-form="token-name" :error="errors.name">Name</FormRow>
                 <FormRow v-model="input.token" data-form="token-value">Token</FormRow>
+                <FormRow v-if="input.type === 'generic'" v-model="input.username" data-form="username">Username</FormRow>
             </form>
         </template>
     </ff-dialog>
@@ -21,11 +22,13 @@
 import { markRaw } from 'vue'
 
 import AzureInstructions from './components/CreateGitTokenDialog/AzureInstructions.vue'
+import GenericInstructions from './components/CreateGitTokenDialog/GenericInstructions.vue'
 import GitHubInstructions from './components/CreateGitTokenDialog/GitHubInstructions.vue'
 
 import teamApi from '@/api/team.js'
 
 import AzureIcon from '@/assets/icons/azure.svg'
+import GitIcon from '@/assets/icons/git.svg'
 import GitHubIcon from '@/assets/icons/github.svg'
 import FormRow from '@/components/FormRow.vue'
 import { CascadingSelector, OptionTileSelector } from '@/components/variant-selector/index.js'
@@ -51,6 +54,7 @@ export default {
                 this.input.name = ''
                 this.input.token = ''
                 this.input.type = 'github'
+                this.input.username = ''
                 this.$refs.dialog.show()
             }
         }
@@ -60,7 +64,8 @@ export default {
             input: {
                 name: '',
                 token: '',
-                type: 'github'
+                type: 'github',
+                username: ''
             },
             errors: {},
             providerTree: {
@@ -77,6 +82,11 @@ export default {
                         id: 'azure',
                         component: markRaw(AzureInstructions),
                         props: { label: 'Azure DevOps', icon: AzureIcon }
+                    },
+                    {
+                        id: 'generic',
+                        component: markRaw(GenericInstructions),
+                        props: { label: 'Other / Self-hosted', icon: GitIcon }
                     }
                 ]
             }
@@ -92,6 +102,7 @@ export default {
         'input.type' () {
             this.input.name = ''
             this.input.token = ''
+            this.input.username = ''
             this.errors = {}
         }
     },
@@ -101,7 +112,8 @@ export default {
                 name: this.input.name.trim(),
                 token: this.input.token,
                 team: this.team.id,
-                type: this.input.type
+                type: this.input.type,
+                username: this.input.username
             }
             this.$emit('token-creating')
             teamApi.createGitToken(opts.team, opts).then((response) => {
diff --git a/frontend/src/pages/team/Settings/dialogs/components/CreateGitTokenDialog/GenericInstructions.vue b/frontend/src/pages/team/Settings/dialogs/components/CreateGitTokenDialog/GenericInstructions.vue
new file mode 100644
index 0000000000..7296e38387
--- /dev/null
+++ b/frontend/src/pages/team/Settings/dialogs/components/CreateGitTokenDialog/GenericInstructions.vue
@@ -0,0 +1,17 @@
+<template>
+    <section>
+        <p>Connect to any Git server (GitLab, Bitbucket, Gitea, or a self-hosted instance) over HTTPS.</p>
+        <ol class="list-decimal list-inside space-y-1 ml-2 mt-2">
+            <li>Create a Personal Access Token (or App Password) on your Git server with read &amp; write access to the repository</li>
+            <li>Enter the username associated with that token</li>
+            <li>Paste the token value into the field below</li>
+        </ol>
+    </section>
+</template>
+
+<script>
+export default {
+    name: 'GenericInstructions',
+    inheritAttrs: false
+}
+</script>

From b84fcdfa71f7f25face27552d29d754d7858133a Mon Sep 17 00:00:00 2001
From: Noley Holland <hollandnoley@gmail.com>
Date: Fri, 26 Jun 2026 11:17:33 -0700
Subject: [PATCH 04/10] Wire generic Git provider, fix types, fix vue warn for
 type prop

---
 forge/ee/db/views/PipelineStage.js                        | 8 ++++----
 frontend/src/components/icons/Git.js                      | 5 ++---
 .../pages/team/Settings/dialogs/CreateGitTokenDialog.vue  | 4 ++--
 frontend/src/types/generated.ts                           | 8 ++++----
 4 files changed, 12 insertions(+), 13 deletions(-)

diff --git a/forge/ee/db/views/PipelineStage.js b/forge/ee/db/views/PipelineStage.js
index 4f746e80ec..7722e98784 100644
--- a/forge/ee/db/views/PipelineStage.js
+++ b/forge/ee/db/views/PipelineStage.js
@@ -28,10 +28,10 @@ module.exports = function (app) {
                     pullBranch: { type: 'string' },
                     pushPath: { type: 'string' },
                     pullPath: { type: 'string' },
-                    lastPushAt: { type: 'string' },
-                    lastPullAt: { type: 'string' },
-                    status: { type: 'string' },
-                    statusMessage: { type: 'string' },
+                    lastPushAt: { type: 'string', nullable: true },
+                    lastPullAt: { type: 'string', nullable: true },
+                    status: { type: 'string', nullable: true },
+                    statusMessage: { type: 'string', nullable: true },
                     credentialSecret: { type: 'boolean' }
                 },
                 required: ['gitTokenId', 'url', 'branch', 'pullBranch', 'pushPath', 'pullPath', 'lastPushAt', 'lastPullAt', 'status', 'statusMessage', 'credentialSecret'],
diff --git a/frontend/src/components/icons/Git.js b/frontend/src/components/icons/Git.js
index 393e110cfb..b93c5a9121 100644
--- a/frontend/src/components/icons/Git.js
+++ b/frontend/src/components/icons/Git.js
@@ -3,10 +3,9 @@ const { createVNode: _createVNode, openBlock: _openBlock, createBlock: _createBl
 module.exports = {
     props: {
         type: {
-            required: true,
-            type: String
+            type: String,
+            default: ''
         }
-
     },
     render: function (_ctx, _cache) {
         const path1 = _createVNode('path', {
diff --git a/frontend/src/pages/team/Settings/dialogs/CreateGitTokenDialog.vue b/frontend/src/pages/team/Settings/dialogs/CreateGitTokenDialog.vue
index 8c9de16343..599d890fdc 100644
--- a/frontend/src/pages/team/Settings/dialogs/CreateGitTokenDialog.vue
+++ b/frontend/src/pages/team/Settings/dialogs/CreateGitTokenDialog.vue
@@ -71,7 +71,7 @@ export default {
             providerTree: {
                 id: 'root',
                 component: markRaw(OptionTileSelector),
-                props: { columns: 2 },
+                props: { columns: 3 },
                 children: [
                     {
                         id: 'github',
@@ -86,7 +86,7 @@ export default {
                     {
                         id: 'generic',
                         component: markRaw(GenericInstructions),
-                        props: { label: 'Other / Self-hosted', icon: markRaw(GitIcon) }
+                        props: { label: 'Other', icon: markRaw(GitIcon) }
                     }
                 ]
             }
diff --git a/frontend/src/types/generated.ts b/frontend/src/types/generated.ts
index 86625dec01..322e7eed80 100644
--- a/frontend/src/types/generated.ts
+++ b/frontend/src/types/generated.ts
@@ -10939,10 +10939,10 @@ export interface components {
                 pullBranch: string;
                 pushPath: string;
                 pullPath: string;
-                lastPushAt: string;
-                lastPullAt: string;
-                status: string;
-                statusMessage: string;
+                lastPushAt: string | null;
+                lastPullAt: string | null;
+                status: string | null;
+                statusMessage: string | null;
                 credentialSecret: boolean;
             };
             /** @enum {string} */

From 9fc82474603e082c83b68288b9094769965a4304 Mon Sep 17 00:00:00 2001
From: Noley Holland <hollandnoley@gmail.com>
Date: Fri, 26 Jun 2026 11:40:32 -0700
Subject: [PATCH 05/10] Setup for CA certs

---
 forge/ee/db/models/PipelineStageGitRepo.js    |  2 +
 forge/ee/lib/gitops/backends/generic.js       | 42 +++++++++++++++----
 forge/ee/lib/gitops/backends/utils.js         |  4 +-
 forge/ee/routes/gitops/index.js               |  3 +-
 .../Settings/dialogs/CreateGitTokenDialog.vue | 13 +++++-
 5 files changed, 51 insertions(+), 13 deletions(-)

diff --git a/forge/ee/db/models/PipelineStageGitRepo.js b/forge/ee/db/models/PipelineStageGitRepo.js
index c2696bbabf..df40da2e1b 100644
--- a/forge/ee/db/models/PipelineStageGitRepo.js
+++ b/forge/ee/db/models/PipelineStageGitRepo.js
@@ -104,6 +104,7 @@ module.exports = {
                                 token: gitToken.token,
                                 tokenType: gitToken.type,
                                 username: gitToken.username,
+                                caCertificate: gitToken.caCertificate,
                                 url: this.url,
                                 branch: this.branch,
                                 credentialSecret: this.credentialSecret,
@@ -158,6 +159,7 @@ module.exports = {
                             token: gitToken.token,
                             tokenType: gitToken.type,
                             username: gitToken.username,
+                            caCertificate: gitToken.caCertificate,
                             url: this.url,
                             branch: this.pullBranch || this.branch,
                             credentialSecret: this.credentialSecret,
diff --git a/forge/ee/lib/gitops/backends/generic.js b/forge/ee/lib/gitops/backends/generic.js
index d1552c0642..0c8289db78 100644
--- a/forge/ee/lib/gitops/backends/generic.js
+++ b/forge/ee/lib/gitops/backends/generic.js
@@ -26,6 +26,7 @@ module.exports.init = async function (app) {
      */
     async function pushToRepository (repoOptions, snapshot, options) {
         let workingDir
+        let caFile
         try {
             const branch = repoOptions.branch || 'main'
             if (!/^https:\/\//i.test(repoOptions.url)) {
@@ -37,14 +38,21 @@ module.exports.init = async function (app) {
 
             workingDir = await fs.mkdtemp(path.join(os.tmpdir(), 'flowfuse-git-repo-'))
 
+            let gitEnv = process.env
+            if (repoOptions.caCertificate) {
+                caFile = `${workingDir}-ca.pem`
+                await fs.writeFile(caFile, repoOptions.caCertificate)
+                gitEnv = { ...process.env, GIT_SSL_CAINFO: caFile }
+            }
+
             // 3. clone repo
-            await cloneRepository(url, branch, workingDir)
+            await cloneRepository(url, branch, workingDir, gitEnv)
 
             // 4. set username/email
-            await execPromised('git config user.email "no-reply@flowfuse.com"', { cwd: workingDir })
-            await execPromised('git config user.name "FlowFuse"', { cwd: workingDir })
+            await execPromised('git config user.email "no-reply@flowfuse.com"', { cwd: workingDir, env: gitEnv })
+            await execPromised('git config user.name "FlowFuse"', { cwd: workingDir, env: gitEnv })
             // For local dev - disable gpg signing in case its set in global config
-            await execPromised('git config commit.gpgsign false', { cwd: workingDir })
+            await execPromised('git config commit.gpgsign false', { cwd: workingDir, env: gitEnv })
 
             // 5. export snapshot
             const exportOptions = {
@@ -64,14 +72,14 @@ module.exports.init = async function (app) {
             await fs.writeFile(snapshotFile, JSON.stringify(snapshotExport, null, 4))
 
             // 6. stage file
-            await execPromised(`git add "${snapshotFile}"`, { cwd: workingDir })
+            await execPromised(`git add "${snapshotFile}"`, { cwd: workingDir, env: gitEnv })
 
             // 7. commit
-            await execPromised(`git commit -m "Update snapshot\n\nSnapshot updated by FlowFuse Pipeline '${options.pipeline.name.replace(/"/g, '')}', triggered by ${options.user.username.replace(/"/g, '')}"`, { cwd: workingDir })
+            await execPromised(`git commit -m "Update snapshot\n\nSnapshot updated by FlowFuse Pipeline '${options.pipeline.name.replace(/"/g, '')}', triggered by ${options.user.username.replace(/"/g, '')}"`, { cwd: workingDir, env: gitEnv })
 
             try {
                 // 8. push
-                await execPromised('git push', { cwd: workingDir })
+                await execPromised('git push', { cwd: workingDir, env: gitEnv })
             } catch (err) {
                 const output = err.stdout + err.stderr
                 if (/unable to access/.test(output)) {
@@ -96,6 +104,11 @@ module.exports.init = async function (app) {
                     await fs.rm(workingDir, { recursive: true, force: true })
                 } catch (err) {}
             }
+            if (caFile) {
+                try {
+                    await fs.rm(caFile, { force: true })
+                } catch (err) {}
+            }
         }
     }
 
@@ -109,6 +122,7 @@ module.exports.init = async function (app) {
      */
     async function pullFromRepository (repoOptions) {
         let workingDir
+        let caFile
         try {
             const branch = repoOptions.branch || 'main'
             if (!/^https:\/\//i.test(repoOptions.url)) {
@@ -120,8 +134,15 @@ module.exports.init = async function (app) {
 
             workingDir = await fs.mkdtemp(path.join(os.tmpdir(), 'flowfuse-git-repo-'))
 
+            let gitEnv = process.env
+            if (repoOptions.caCertificate) {
+                caFile = `${workingDir}-ca.pem`
+                await fs.writeFile(caFile, repoOptions.caCertificate)
+                gitEnv = { ...process.env, GIT_SSL_CAINFO: caFile }
+            }
+
             // 3. clone repo
-            await cloneRepository(url, branch, workingDir)
+            await cloneRepository(url, branch, workingDir, gitEnv)
 
             const snapshotFile = path.join(workingDir, repoOptions.path || 'snapshot.json').replace(/"/g, '')
 
@@ -159,6 +180,11 @@ module.exports.init = async function (app) {
                     await fs.rm(workingDir, { recursive: true, force: true })
                 } catch (err) {}
             }
+            if (caFile) {
+                try {
+                    await fs.rm(caFile, { force: true })
+                } catch (err) {}
+            }
         }
     }
     return {
diff --git a/forge/ee/lib/gitops/backends/utils.js b/forge/ee/lib/gitops/backends/utils.js
index 7b069317f5..b8bffd3d91 100644
--- a/forge/ee/lib/gitops/backends/utils.js
+++ b/forge/ee/lib/gitops/backends/utils.js
@@ -2,9 +2,9 @@ const { exec } = require('node:child_process')
 const { promisify } = require('node:util')
 const execPromised = promisify(exec)
 
-async function cloneRepository (url, branch, workingDir) {
+async function cloneRepository (url, branch, workingDir, env) {
     try {
-        await execPromised(`git clone -b ${branch} --depth 1 --single-branch ${url.toString()} .`, { cwd: workingDir })
+        await execPromised(`git clone -b ${branch} --depth 1 --single-branch ${url.toString()} .`, { cwd: workingDir, env })
     } catch (err) {
         const output = err.stdout + err.stderr
         // Token does not have access to clone the repo
diff --git a/forge/ee/routes/gitops/index.js b/forge/ee/routes/gitops/index.js
index 69869d770d..a1b69c611b 100644
--- a/forge/ee/routes/gitops/index.js
+++ b/forge/ee/routes/gitops/index.js
@@ -50,7 +50,8 @@ module.exports = async function (app) {
                 token: body.token,
                 TeamId: request.team.id,
                 type: body.type || 'github',
-                username: body.username || ''
+                username: body.username || '',
+                caCertificate: body.caCertificate || ''
             })
             // TODO: audit log
             // await app.auditLog.Project.project.httpToken.created(request.session.User, null, request.project, body)
diff --git a/frontend/src/pages/team/Settings/dialogs/CreateGitTokenDialog.vue b/frontend/src/pages/team/Settings/dialogs/CreateGitTokenDialog.vue
index 599d890fdc..89d43fd442 100644
--- a/frontend/src/pages/team/Settings/dialogs/CreateGitTokenDialog.vue
+++ b/frontend/src/pages/team/Settings/dialogs/CreateGitTokenDialog.vue
@@ -13,6 +13,11 @@
                 <FormRow v-model="input.name" data-form="token-name" :error="errors.name">Name</FormRow>
                 <FormRow v-model="input.token" data-form="token-value">Token</FormRow>
                 <FormRow v-if="input.type === 'generic'" v-model="input.username" data-form="username">Username</FormRow>
+                <FormRow v-if="input.type === 'generic'" data-form="ca-certificate">
+                    CA Certificate (optional)
+                    <template #description>Only needed for self-hosted servers that use a private certificate authority.</template>
+                    <template #input><textarea v-model="input.caCertificate" class="font-mono w-full" rows="6" placeholder="-----BEGIN CERTIFICATE-----&#10;...&#10;-----END CERTIFICATE-----" /></template>
+                </FormRow>
             </form>
         </template>
     </ff-dialog>
@@ -55,6 +60,7 @@ export default {
                 this.input.token = ''
                 this.input.type = 'github'
                 this.input.username = ''
+                this.input.caCertificate = ''
                 this.$refs.dialog.show()
             }
         }
@@ -65,7 +71,8 @@ export default {
                 name: '',
                 token: '',
                 type: 'github',
-                username: ''
+                username: '',
+                caCertificate: ''
             },
             errors: {},
             providerTree: {
@@ -103,6 +110,7 @@ export default {
             this.input.name = ''
             this.input.token = ''
             this.input.username = ''
+            this.input.caCertificate = ''
             this.errors = {}
         }
     },
@@ -113,7 +121,8 @@ export default {
                 token: this.input.token,
                 team: this.team.id,
                 type: this.input.type,
-                username: this.input.username
+                username: this.input.username,
+                caCertificate: this.input.caCertificate
             }
             this.$emit('token-creating')
             teamApi.createGitToken(opts.team, opts).then((response) => {

From ef65384089723e3eb44b6790d8be15efa31faf52 Mon Sep 17 00:00:00 2001
From: Noley Holland <hollandnoley@gmail.com>
Date: Fri, 26 Jun 2026 12:01:18 -0700
Subject: [PATCH 06/10] Harden all git invocations against shell injection by
 switching to execFile with argument arrays, add spec, fix validation form err

---
 forge/ee/lib/gitops/backends/generic.js       | 17 ++++----
 forge/ee/lib/gitops/backends/utils.js         |  6 +--
 .../pages/application/PipelineStage/form.vue  | 27 +++++++-----
 test/unit/forge/ee/db/models/GitToken_spec.js | 43 +++++++++++++++++++
 4 files changed, 72 insertions(+), 21 deletions(-)
 create mode 100644 test/unit/forge/ee/db/models/GitToken_spec.js

diff --git a/forge/ee/lib/gitops/backends/generic.js b/forge/ee/lib/gitops/backends/generic.js
index 0c8289db78..6b619e124c 100644
--- a/forge/ee/lib/gitops/backends/generic.js
+++ b/forge/ee/lib/gitops/backends/generic.js
@@ -1,10 +1,10 @@
-const { exec } = require('node:child_process')
+const { execFile } = require('node:child_process')
 const { existsSync } = require('node:fs')
 const fs = require('node:fs/promises')
 const os = require('node:os')
 const path = require('node:path')
 const { promisify } = require('node:util')
-const execPromised = promisify(exec)
+const execFilePromised = promisify(execFile)
 
 const { encryptValue, decryptValue } = require('../../../../db/utils')
 
@@ -49,10 +49,10 @@ module.exports.init = async function (app) {
             await cloneRepository(url, branch, workingDir, gitEnv)
 
             // 4. set username/email
-            await execPromised('git config user.email "no-reply@flowfuse.com"', { cwd: workingDir, env: gitEnv })
-            await execPromised('git config user.name "FlowFuse"', { cwd: workingDir, env: gitEnv })
+            await execFilePromised('git', ['config', 'user.email', 'no-reply@flowfuse.com'], { cwd: workingDir, env: gitEnv })
+            await execFilePromised('git', ['config', 'user.name', 'FlowFuse'], { cwd: workingDir, env: gitEnv })
             // For local dev - disable gpg signing in case its set in global config
-            await execPromised('git config commit.gpgsign false', { cwd: workingDir, env: gitEnv })
+            await execFilePromised('git', ['config', 'commit.gpgsign', 'false'], { cwd: workingDir, env: gitEnv })
 
             // 5. export snapshot
             const exportOptions = {
@@ -72,14 +72,15 @@ module.exports.init = async function (app) {
             await fs.writeFile(snapshotFile, JSON.stringify(snapshotExport, null, 4))
 
             // 6. stage file
-            await execPromised(`git add "${snapshotFile}"`, { cwd: workingDir, env: gitEnv })
+            await execFilePromised('git', ['add', snapshotFile], { cwd: workingDir, env: gitEnv })
 
             // 7. commit
-            await execPromised(`git commit -m "Update snapshot\n\nSnapshot updated by FlowFuse Pipeline '${options.pipeline.name.replace(/"/g, '')}', triggered by ${options.user.username.replace(/"/g, '')}"`, { cwd: workingDir, env: gitEnv })
+            const commitMessage = `Update snapshot\n\nSnapshot updated by FlowFuse Pipeline '${options.pipeline.name}', triggered by ${options.user.username}`
+            await execFilePromised('git', ['commit', '-m', commitMessage], { cwd: workingDir, env: gitEnv })
 
             try {
                 // 8. push
-                await execPromised('git push', { cwd: workingDir, env: gitEnv })
+                await execFilePromised('git', ['push'], { cwd: workingDir, env: gitEnv })
             } catch (err) {
                 const output = err.stdout + err.stderr
                 if (/unable to access/.test(output)) {
diff --git a/forge/ee/lib/gitops/backends/utils.js b/forge/ee/lib/gitops/backends/utils.js
index b8bffd3d91..330251cbd9 100644
--- a/forge/ee/lib/gitops/backends/utils.js
+++ b/forge/ee/lib/gitops/backends/utils.js
@@ -1,10 +1,10 @@
-const { exec } = require('node:child_process')
+const { execFile } = require('node:child_process')
 const { promisify } = require('node:util')
-const execPromised = promisify(exec)
+const execFilePromised = promisify(execFile)
 
 async function cloneRepository (url, branch, workingDir, env) {
     try {
-        await execPromised(`git clone -b ${branch} --depth 1 --single-branch ${url.toString()} .`, { cwd: workingDir, env })
+        await execFilePromised('git', ['clone', '-b', branch, '--depth', '1', '--single-branch', url.toString(), '.'], { cwd: workingDir, env })
     } catch (err) {
         const output = err.stdout + err.stderr
         // Token does not have access to clone the repo
diff --git a/frontend/src/pages/application/PipelineStage/form.vue b/frontend/src/pages/application/PipelineStage/form.vue
index 6507b93c41..399fc39c95 100644
--- a/frontend/src/pages/application/PipelineStage/form.vue
+++ b/frontend/src/pages/application/PipelineStage/form.vue
@@ -682,16 +682,11 @@ export default {
             // If not, reset to the stages original action (if available)
             this.input.action = this.stage?.action && this.actionOptions.some((option) => option.value === this.stage.action) ? this.stage.action : null
         },
-        'input.url' (newUrl, oldUrl) {
-            if (newUrl === '') {
-                this.errors.url = ''
-            } else if (this.selectedGitTokenType === 'generic') {
-                this.errors.url = /^https:\/\//i.test(newUrl) ? '' : 'Please enter a valid HTTPS repository URL'
-            } else if (!/^https:\/\/github\.com\/[^/]+\/[^/]+$/.test(newUrl) && !/^https:\/\/dev\.azure\.com\/[^/]+\/_git\/[^/]+$/.test(newUrl)) {
-                this.errors.url = 'Please enter a valid GitHub or Azure DevOps repository URL'
-            } else {
-                this.errors.url = ''
-            }
+        'input.url' () {
+            this.validateGitUrl()
+        },
+        'input.gitTokenId' () {
+            this.validateGitUrl()
         },
         'input.pushPath' (newPushPath, oldPushPath) {
             if (newPushPath === '' && this.isFirstStage) {
@@ -725,6 +720,18 @@ export default {
         this.original.deviceGroupId = this.input.deviceGroupId
     },
     methods: {
+        validateGitUrl () {
+            const url = this.input.url
+            if (url === '') {
+                this.errors.url = ''
+            } else if (this.selectedGitTokenType === 'generic') {
+                this.errors.url = /^https:\/\//i.test(url) ? '' : 'Please enter a valid HTTPS repository URL'
+            } else if (!/^https:\/\/github\.com\/[^/]+\/[^/]+$/.test(url) && !/^https:\/\/dev\.azure\.com\/[^/]+\/_git\/[^/]+$/.test(url)) {
+                this.errors.url = 'Please enter a valid GitHub or Azure DevOps repository URL'
+            } else {
+                this.errors.url = ''
+            }
+        },
         async submit () {
             this.loading.creating = !this.isEdit
             this.loading.updating = this.isEdit
diff --git a/test/unit/forge/ee/db/models/GitToken_spec.js b/test/unit/forge/ee/db/models/GitToken_spec.js
new file mode 100644
index 0000000000..359f8f62b1
--- /dev/null
+++ b/test/unit/forge/ee/db/models/GitToken_spec.js
@@ -0,0 +1,43 @@
+const should = require('should') // eslint-disable-line
+const setup = require('../../setup')
+
+describe('GitToken Model', function () {
+    let app
+
+    before(async function () {
+        const license = 'eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImZkNDFmNmRjLTBmM2QtNGFmNy1hNzk0LWIyNWFhNGJmYTliZCIsInZlciI6IjIwMjQtMDMtMDQiLCJpc3MiOiJGbG93Rm9yZ2UgSW5jLiIsInN1YiI6IkZsb3dGdXNlIERldmVsb3BtZW50IiwibmJmIjoxNzMwNjc4NDAwLCJleHAiOjIwNzc3NDcyMDAsIm5vdGUiOiJEZXZlbG9wbWVudC1tb2RlIE9ubHkuIE5vdCBmb3IgcHJvZHVjdGlvbiIsInVzZXJzIjoxMCwidGVhbXMiOjEwLCJpbnN0YW5jZXMiOjEwLCJtcXR0Q2xpZW50cyI6NiwidGllciI6ImVudGVycHJpc2UiLCJkZXYiOnRydWUsImlhdCI6MTczMDcyMTEyNH0.02KMRf5kogkpH3HXHVSGprUm0QQFLn21-3QIORhxFgRE9N5DIE8YnTH_f8W_21T6TlYbDUmf4PtWyj120HTM2w'
+        app = await setup({ license })
+    })
+
+    after(async function () {
+        await app.close()
+    })
+
+    it('stores username and caCertificate for a generic token', async function () {
+        const cert = '-----BEGIN CERTIFICATE-----\nMIICertContent\n-----END CERTIFICATE-----'
+        const token = await app.db.models.GitToken.create({
+            name: 'generic-token',
+            token: 'secret-token',
+            type: 'generic',
+            username: 'noley',
+            caCertificate: cert,
+            TeamId: app.team.id
+        })
+        const reloaded = await app.db.models.GitToken.byId(token.id, app.team.id)
+        reloaded.should.have.property('type', 'generic')
+        reloaded.should.have.property('username', 'noley')
+        reloaded.should.have.property('caCertificate', cert)
+    })
+
+    it('leaves username and caCertificate null when omitted', async function () {
+        const token = await app.db.models.GitToken.create({
+            name: 'github-token',
+            token: 'gh-token',
+            type: 'github',
+            TeamId: app.team.id
+        })
+        const reloaded = await app.db.models.GitToken.byId(token.id, app.team.id)
+        should(reloaded.username).be.null()
+        should(reloaded.caCertificate).be.null()
+    })
+})

From ee2e0a35f5d70db0b8fde5f59a7e35ed5b96f9b6 Mon Sep 17 00:00:00 2001
From: Noley Holland <hollandnoley@gmail.com>
Date: Fri, 26 Jun 2026 12:18:17 -0700
Subject: [PATCH 07/10] Store null and fix validator

---
 forge/ee/routes/gitops/index.js                       |  4 ++--
 frontend/src/pages/application/PipelineStage/form.vue | 11 ++++++-----
 2 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/forge/ee/routes/gitops/index.js b/forge/ee/routes/gitops/index.js
index a1b69c611b..9e1d2fd85d 100644
--- a/forge/ee/routes/gitops/index.js
+++ b/forge/ee/routes/gitops/index.js
@@ -50,8 +50,8 @@ module.exports = async function (app) {
                 token: body.token,
                 TeamId: request.team.id,
                 type: body.type || 'github',
-                username: body.username || '',
-                caCertificate: body.caCertificate || ''
+                username: body.username || null,
+                caCertificate: body.caCertificate || null
             })
             // TODO: audit log
             // await app.auditLog.Project.project.httpToken.created(request.session.User, null, request.project, body)
diff --git a/frontend/src/pages/application/PipelineStage/form.vue b/frontend/src/pages/application/PipelineStage/form.vue
index 399fc39c95..7bf8c8275e 100644
--- a/frontend/src/pages/application/PipelineStage/form.vue
+++ b/frontend/src/pages/application/PipelineStage/form.vue
@@ -722,14 +722,15 @@ export default {
     methods: {
         validateGitUrl () {
             const url = this.input.url
+            const type = this.selectedGitTokenType
             if (url === '') {
                 this.errors.url = ''
-            } else if (this.selectedGitTokenType === 'generic') {
-                this.errors.url = /^https:\/\//i.test(url) ? '' : 'Please enter a valid HTTPS repository URL'
-            } else if (!/^https:\/\/github\.com\/[^/]+\/[^/]+$/.test(url) && !/^https:\/\/dev\.azure\.com\/[^/]+\/_git\/[^/]+$/.test(url)) {
-                this.errors.url = 'Please enter a valid GitHub or Azure DevOps repository URL'
+            } else if (type === 'github' || type === 'azure') {
+                this.errors.url = (/^https:\/\/github\.com\/[^/]+\/[^/]+$/.test(url) || /^https:\/\/dev\.azure\.com\/[^/]+\/_git\/[^/]+$/.test(url))
+                    ? ''
+                    : 'Please enter a valid GitHub or Azure DevOps repository URL'
             } else {
-                this.errors.url = ''
+                this.errors.url = /^https:\/\//i.test(url) ? '' : 'Please enter a valid HTTPS repository URL'
             }
         },
         async submit () {

From 43da1e58b4c217c37bc4a28416b8ac35ee078ba1 Mon Sep 17 00:00:00 2001
From: Noley Holland <hollandnoley@gmail.com>
Date: Fri, 26 Jun 2026 12:20:42 -0700
Subject: [PATCH 08/10] Fix migration file name

---
 ...token-generic.js => 20260626-01-EE-extend-gittoken-generic.js} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename forge/db/migrations/{20260611-01-EE-extend-gittoken-generic.js => 20260626-01-EE-extend-gittoken-generic.js} (100%)

diff --git a/forge/db/migrations/20260611-01-EE-extend-gittoken-generic.js b/forge/db/migrations/20260626-01-EE-extend-gittoken-generic.js
similarity index 100%
rename from forge/db/migrations/20260611-01-EE-extend-gittoken-generic.js
rename to forge/db/migrations/20260626-01-EE-extend-gittoken-generic.js

From bacbba14d481ab92673fe58944fe6cf75bd4363e Mon Sep 17 00:00:00 2001
From: Noley Holland <hollandnoley@gmail.com>
Date: Fri, 26 Jun 2026 13:06:51 -0700
Subject: [PATCH 09/10] Add proxyquire as a dev dep for new specs to cover
 generic upload case

---
 package-lock.json                             |  77 ++++++++
 package.json                                  |   1 +
 .../ee/lib/gitops/backends/generic_spec.js    | 165 ++++++++++++++++++
 .../ee/lib/gitops/backends/utils_spec.js      |  60 +++++++
 4 files changed, 303 insertions(+)
 create mode 100644 test/unit/forge/ee/lib/gitops/backends/generic_spec.js
 create mode 100644 test/unit/forge/ee/lib/gitops/backends/utils_spec.js

diff --git a/package-lock.json b/package-lock.json
index 02d08884f4..58ffb4f958 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -131,6 +131,7 @@
                 "postcss-loader": "^8.1.1",
                 "postcss-preset-env": "^9.1.3",
                 "promptly": "^3.2.0",
+                "proxyquire": "^2.1.3",
                 "sass": "^1.97.3",
                 "sass-loader": "^16.0.2",
                 "should": "^13.2.3",
@@ -14303,6 +14304,20 @@
             "resolved": "https://registry.npmjs.org/file-uri-to-path/-/file-uri-to-path-1.0.0.tgz",
             "integrity": "sha512-0Zt+s3L7Vf1biwWZ29aARiVYLx7iMGnEUl9x33fbB/j3jR81u/O2LbqK+Bm1CDSNDKVtJ/YjwY7TUd5SkeLQLw=="
         },
+        "node_modules/fill-keys": {
+            "version": "1.0.2",
+            "resolved": "https://registry.npmjs.org/fill-keys/-/fill-keys-1.0.2.tgz",
+            "integrity": "sha512-tcgI872xXjwFF4xgQmLxi76GnwJG3g/3isB1l4/G5Z4zrbddGpBjqZCO9oEAcB5wX0Hj/5iQB3toxfO7in1hHA==",
+            "dev": true,
+            "license": "MIT",
+            "dependencies": {
+                "is-object": "~1.0.1",
+                "merge-descriptors": "~1.0.0"
+            },
+            "engines": {
+                "node": ">=0.10.0"
+            }
+        },
         "node_modules/fill-range": {
             "version": "7.1.1",
             "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz",
@@ -16038,6 +16053,16 @@
                 "url": "https://github.com/sponsors/ljharb"
             }
         },
+        "node_modules/is-object": {
+            "version": "1.0.2",
+            "resolved": "https://registry.npmjs.org/is-object/-/is-object-1.0.2.tgz",
+            "integrity": "sha512-2rRIahhZr2UWb45fIOuvZGpFtz0TyOZLf32KxBbSoUCeZR495zCKlWUKKUByk3geS2eAs7ZAABt0Y/Rx0GiQGA==",
+            "dev": true,
+            "license": "MIT",
+            "funding": {
+                "url": "https://github.com/sponsors/ljharb"
+            }
+        },
         "node_modules/is-path-cwd": {
             "version": "2.2.0",
             "resolved": "https://registry.npmjs.org/is-path-cwd/-/is-path-cwd-2.2.0.tgz",
@@ -18476,6 +18501,13 @@
             "resolved": "https://registry.npmjs.org/module-details-from-path/-/module-details-from-path-1.0.4.tgz",
             "integrity": "sha512-EGWKgxALGMgzvxYF1UyGTy0HXX/2vHLkw6+NvDKW2jypWbHpjQuj4UMcqQWXHERJhVGKikolT06G3bcKe4fi7w=="
         },
+        "node_modules/module-not-found-error": {
+            "version": "1.0.1",
+            "resolved": "https://registry.npmjs.org/module-not-found-error/-/module-not-found-error-1.0.1.tgz",
+            "integrity": "sha512-pEk4ECWQXV6z2zjhRZUongnLJNUeGQJ3w6OQ5ctGwD+i5o93qjRQUk2Rt6VdNeu3sEP0AB4LcfvdebpxBRVr4g==",
+            "dev": true,
+            "license": "MIT"
+        },
         "node_modules/moment": {
             "version": "2.29.4",
             "resolved": "https://registry.npmjs.org/moment/-/moment-2.29.4.tgz",
@@ -21309,6 +21341,18 @@
             "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-1.1.0.tgz",
             "integrity": "sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg=="
         },
+        "node_modules/proxyquire": {
+            "version": "2.1.3",
+            "resolved": "https://registry.npmjs.org/proxyquire/-/proxyquire-2.1.3.tgz",
+            "integrity": "sha512-BQWfCqYM+QINd+yawJz23tbBM40VIGXOdDw3X344KcclI/gtBbdWF6SlQ4nK/bYhF9d27KYug9WzljHC6B9Ysg==",
+            "dev": true,
+            "license": "MIT",
+            "dependencies": {
+                "fill-keys": "^1.0.2",
+                "module-not-found-error": "^1.0.1",
+                "resolve": "^1.11.1"
+            }
+        },
         "node_modules/pseudomap": {
             "version": "1.0.2",
             "resolved": "https://registry.npmjs.org/pseudomap/-/pseudomap-1.0.2.tgz",
@@ -35894,6 +35938,16 @@
             "resolved": "https://registry.npmjs.org/file-uri-to-path/-/file-uri-to-path-1.0.0.tgz",
             "integrity": "sha512-0Zt+s3L7Vf1biwWZ29aARiVYLx7iMGnEUl9x33fbB/j3jR81u/O2LbqK+Bm1CDSNDKVtJ/YjwY7TUd5SkeLQLw=="
         },
+        "fill-keys": {
+            "version": "1.0.2",
+            "resolved": "https://registry.npmjs.org/fill-keys/-/fill-keys-1.0.2.tgz",
+            "integrity": "sha512-tcgI872xXjwFF4xgQmLxi76GnwJG3g/3isB1l4/G5Z4zrbddGpBjqZCO9oEAcB5wX0Hj/5iQB3toxfO7in1hHA==",
+            "dev": true,
+            "requires": {
+                "is-object": "~1.0.1",
+                "merge-descriptors": "~1.0.0"
+            }
+        },
         "fill-range": {
             "version": "7.1.1",
             "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz",
@@ -37067,6 +37121,12 @@
                 "has-tostringtag": "^1.0.0"
             }
         },
+        "is-object": {
+            "version": "1.0.2",
+            "resolved": "https://registry.npmjs.org/is-object/-/is-object-1.0.2.tgz",
+            "integrity": "sha512-2rRIahhZr2UWb45fIOuvZGpFtz0TyOZLf32KxBbSoUCeZR495zCKlWUKKUByk3geS2eAs7ZAABt0Y/Rx0GiQGA==",
+            "dev": true
+        },
         "is-path-cwd": {
             "version": "2.2.0",
             "resolved": "https://registry.npmjs.org/is-path-cwd/-/is-path-cwd-2.2.0.tgz",
@@ -38716,6 +38776,12 @@
             "resolved": "https://registry.npmjs.org/module-details-from-path/-/module-details-from-path-1.0.4.tgz",
             "integrity": "sha512-EGWKgxALGMgzvxYF1UyGTy0HXX/2vHLkw6+NvDKW2jypWbHpjQuj4UMcqQWXHERJhVGKikolT06G3bcKe4fi7w=="
         },
+        "module-not-found-error": {
+            "version": "1.0.1",
+            "resolved": "https://registry.npmjs.org/module-not-found-error/-/module-not-found-error-1.0.1.tgz",
+            "integrity": "sha512-pEk4ECWQXV6z2zjhRZUongnLJNUeGQJ3w6OQ5ctGwD+i5o93qjRQUk2Rt6VdNeu3sEP0AB4LcfvdebpxBRVr4g==",
+            "dev": true
+        },
         "moment": {
             "version": "2.29.4",
             "resolved": "https://registry.npmjs.org/moment/-/moment-2.29.4.tgz",
@@ -40557,6 +40623,17 @@
             "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-1.1.0.tgz",
             "integrity": "sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg=="
         },
+        "proxyquire": {
+            "version": "2.1.3",
+            "resolved": "https://registry.npmjs.org/proxyquire/-/proxyquire-2.1.3.tgz",
+            "integrity": "sha512-BQWfCqYM+QINd+yawJz23tbBM40VIGXOdDw3X344KcclI/gtBbdWF6SlQ4nK/bYhF9d27KYug9WzljHC6B9Ysg==",
+            "dev": true,
+            "requires": {
+                "fill-keys": "^1.0.2",
+                "module-not-found-error": "^1.0.1",
+                "resolve": "^1.11.1"
+            }
+        },
         "pseudomap": {
             "version": "1.0.2",
             "resolved": "https://registry.npmjs.org/pseudomap/-/pseudomap-1.0.2.tgz",
diff --git a/package.json b/package.json
index 6c4371470b..7627ba6a49 100644
--- a/package.json
+++ b/package.json
@@ -173,6 +173,7 @@
         "postcss-loader": "^8.1.1",
         "postcss-preset-env": "^9.1.3",
         "promptly": "^3.2.0",
+        "proxyquire": "^2.1.3",
         "sass": "^1.97.3",
         "sass-loader": "^16.0.2",
         "should": "^13.2.3",
diff --git a/test/unit/forge/ee/lib/gitops/backends/generic_spec.js b/test/unit/forge/ee/lib/gitops/backends/generic_spec.js
new file mode 100644
index 0000000000..e9f43b36f7
--- /dev/null
+++ b/test/unit/forge/ee/lib/gitops/backends/generic_spec.js
@@ -0,0 +1,165 @@
+const fs = require('node:fs/promises')
+const path = require('node:path')
+
+const proxyquire = require('proxyquire')
+const sinon = require('sinon')
+
+require('should')
+
+const MODULE = '../../../../../../../forge/ee/lib/gitops/backends/generic'
+
+describe('Generic git backend', function () {
+    let cloneStub, execFileStub, exportSnapshotStub, snapshotExportStub, encryptStub, decryptStub
+
+    const baseOptions = { pipeline: { name: 'My Pipeline' }, user: { username: 'alice' } }
+
+    function loadBackend () {
+        const generic = proxyquire(MODULE, {
+            'node:child_process': { execFile: execFileStub },
+            './utils': { cloneRepository: cloneStub },
+            '../../../../db/utils': { encryptValue: encryptStub, decryptValue: decryptStub }
+        })
+        const app = {
+            db: {
+                controllers: { Snapshot: { exportSnapshot: exportSnapshotStub } },
+                views: { ProjectSnapshot: { snapshotExport: snapshotExportStub } }
+            },
+            config: { domain: 'example.com' }
+        }
+        return generic.init(app)
+    }
+
+    beforeEach(function () {
+        cloneStub = sinon.stub().resolves()
+        // promisify(execFile) calls (file, args, opts, cb) — default to success
+        execFileStub = sinon.stub().callsFake((file, args, opts, cb) => cb(null, { stdout: '', stderr: '' }))
+        encryptStub = sinon.stub().returns('ENCRYPTED')
+        decryptStub = sinon.stub().returns('DECRYPTED')
+        exportSnapshotStub = sinon.stub().resolves({ flows: [] })
+        snapshotExportStub = sinon.stub().returns({ name: 'snap', settings: {} })
+    })
+
+    describe('pushToRepository', function () {
+        it('rejects non-HTTPS urls', async function () {
+            const backend = await loadBackend()
+            await backend.pushToRepository({ url: 'http://example.com/r.git' }, {}, baseOptions)
+                .should.be.rejectedWith('Only HTTPS git URLs are supported')
+        })
+
+        it('clones with embedded username/token, then commits and pushes', async function () {
+            const backend = await loadBackend()
+            await backend.pushToRepository(
+                { url: 'https://git.example.com/o/r.git', username: 'bob', token: 'tok', credentialSecret: 's', path: 'snapshot.json' },
+                {}, baseOptions
+            )
+            cloneStub.calledOnce.should.be.true()
+            const urlArg = cloneStub.firstCall.args[0]
+            urlArg.username.should.equal('bob')
+            urlArg.password.should.equal('tok')
+            // config x3 + add + commit + push
+            execFileStub.callCount.should.equal(6)
+            execFileStub.getCalls().map(c => c.args[1][0]).should.containDeep(['config', 'add', 'commit', 'push'])
+        })
+
+        it('falls back to x-access-token when no username given', async function () {
+            const backend = await loadBackend()
+            await backend.pushToRepository(
+                { url: 'https://git.example.com/o/r.git', token: 'tok', credentialSecret: 's' },
+                {}, baseOptions
+            )
+            cloneStub.firstCall.args[0].username.should.equal('x-access-token')
+        })
+
+        it('writes a CA file and passes GIT_SSL_CAINFO when caCertificate is set', async function () {
+            const backend = await loadBackend()
+            await backend.pushToRepository(
+                { url: 'https://git.example.com/o/r.git', token: 'tok', caCertificate: 'CERT', credentialSecret: 's' },
+                {}, baseOptions
+            )
+            const env = cloneStub.firstCall.args[3]
+            env.should.have.property('GIT_SSL_CAINFO')
+            env.GIT_SSL_CAINFO.should.match(/-ca\.pem$/)
+        })
+
+        it('encrypts the npmrc in the exported snapshot', async function () {
+            snapshotExportStub.returns({ name: 'snap', settings: { settings: { palette: { npmrc: 'registry=x' } } } })
+            const backend = await loadBackend()
+            await backend.pushToRepository(
+                { url: 'https://git.example.com/o/r.git', token: 'tok', credentialSecret: 's' },
+                {}, baseOptions
+            )
+            encryptStub.calledOnce.should.be.true()
+        })
+
+        it('maps an unable-to-access push failure to invalid_token', async function () {
+            execFileStub.callsFake((file, args, opts, cb) => {
+                if (args[0] === 'push') {
+                    const err = new Error('boom'); err.stdout = ''; err.stderr = 'fatal: unable to access'; return cb(err)
+                }
+                cb(null, { stdout: '', stderr: '' })
+            })
+            const backend = await loadBackend()
+            let caught
+            try {
+                await backend.pushToRepository({ url: 'https://git.example.com/o/r.git', token: 'tok', credentialSecret: 's' }, {}, baseOptions)
+            } catch (err) { caught = err }
+            caught.message.should.equal('Permission denied')
+            caught.code.should.equal('invalid_token')
+        })
+
+        it('surfaces a fatal push error message', async function () {
+            execFileStub.callsFake((file, args, opts, cb) => {
+                if (args[0] === 'push') {
+                    const err = new Error('boom'); err.stdout = ''; err.stderr = 'fatal: remote rejected'; return cb(err)
+                }
+                cb(null, { stdout: '', stderr: '' })
+            })
+            const backend = await loadBackend()
+            await backend.pushToRepository({ url: 'https://git.example.com/o/r.git', token: 'tok', credentialSecret: 's' }, {}, baseOptions)
+                .should.be.rejectedWith('Failed to push repository: remote rejected')
+        })
+    })
+
+    describe('pullFromRepository', function () {
+        it('rejects non-HTTPS urls', async function () {
+            const backend = await loadBackend()
+            await backend.pullFromRepository({ url: 'http://example.com/r.git' })
+                .should.be.rejectedWith('Only HTTPS git URLs are supported')
+        })
+
+        it('throws when the snapshot file is missing', async function () {
+            const backend = await loadBackend()
+            await backend.pullFromRepository({ url: 'https://git.example.com/o/r.git', token: 't', credentialSecret: 's' })
+                .should.be.rejectedWith('Snapshot file not found in repository')
+        })
+
+        it('reads and decrypts the snapshot file', async function () {
+            const snapshotContent = {
+                name: 'snap',
+                settings: {
+                    env: { SECRET: { hidden: true, $: 'enc' }, PLAIN: { value: 'x' } },
+                    settings: { palette: { npmrc: { $: 'encnpm' } } }
+                }
+            }
+            cloneStub.callsFake(async (url, branch, workingDir) => {
+                await fs.writeFile(path.join(workingDir, 'snapshot.json'), JSON.stringify(snapshotContent))
+            })
+            const backend = await loadBackend()
+            const result = await backend.pullFromRepository({ url: 'https://git.example.com/o/r.git', token: 't', credentialSecret: 's' })
+            result.name.should.equal('snap')
+            result.settings.env.SECRET.value.should.equal('DECRYPTED')
+            result.settings.env.SECRET.should.not.have.property('$')
+            result.settings.settings.palette.npmrc.should.equal('DECRYPTED')
+            decryptStub.callCount.should.equal(2)
+        })
+
+        it('passes GIT_SSL_CAINFO on pull when caCertificate is set', async function () {
+            cloneStub.callsFake(async (url, branch, workingDir) => {
+                await fs.writeFile(path.join(workingDir, 'snapshot.json'), JSON.stringify({ name: 'snap' }))
+            })
+            const backend = await loadBackend()
+            await backend.pullFromRepository({ url: 'https://git.example.com/o/r.git', token: 't', caCertificate: 'CERT', credentialSecret: 's' })
+            cloneStub.firstCall.args[3].should.have.property('GIT_SSL_CAINFO')
+        })
+    })
+})
diff --git a/test/unit/forge/ee/lib/gitops/backends/utils_spec.js b/test/unit/forge/ee/lib/gitops/backends/utils_spec.js
new file mode 100644
index 0000000000..1302c1c0e9
--- /dev/null
+++ b/test/unit/forge/ee/lib/gitops/backends/utils_spec.js
@@ -0,0 +1,60 @@
+const proxyquire = require('proxyquire')
+const sinon = require('sinon')
+
+require('should')
+
+const MODULE = '../../../../../../../forge/ee/lib/gitops/backends/utils'
+
+describe('gitops cloneRepository', function () {
+    let execFileStub
+    const url = new URL('https://git.example.com/o/r.git')
+
+    function load () {
+        return proxyquire(MODULE, {
+            'node:child_process': { execFile: execFileStub }
+        }).cloneRepository
+    }
+
+    function rejectWith (stderr) {
+        execFileStub.callsFake((file, args, opts, cb) => {
+            const err = new Error('boom'); err.stdout = ''; err.stderr = stderr; cb(err)
+        })
+    }
+
+    beforeEach(function () {
+        execFileStub = sinon.stub().callsFake((file, args, opts, cb) => cb(null, { stdout: '', stderr: '' }))
+    })
+
+    it('runs git clone with the expected arguments', async function () {
+        const cloneRepository = load()
+        await cloneRepository(url, 'main', '/tmp/x')
+        execFileStub.calledOnce.should.be.true()
+        execFileStub.firstCall.args[0].should.equal('git')
+        execFileStub.firstCall.args[1].should.containDeep(['clone', '-b', 'main', '--single-branch'])
+    })
+
+    it('maps unable-to-access to Permission denied', async function () {
+        rejectWith('fatal: unable to access')
+        const cloneRepository = load()
+        let caught
+        try { await cloneRepository(url, 'main', '/tmp/x') } catch (err) { caught = err }
+        caught.message.should.equal('Permission denied')
+        caught.code.should.equal('invalid_token')
+    })
+
+    it('maps a missing remote branch to Branch not found', async function () {
+        rejectWith('fatal: Remote branch main not found')
+        const cloneRepository = load()
+        let caught
+        try { await cloneRepository(url, 'main', '/tmp/x') } catch (err) { caught = err }
+        caught.message.should.equal('Branch not found')
+        caught.code.should.equal('invalid_branch')
+    })
+
+    it('surfaces a generic fatal clone error', async function () {
+        rejectWith('fatal: something broke')
+        const cloneRepository = load()
+        await cloneRepository(url, 'main', '/tmp/x')
+            .should.be.rejectedWith('Failed to clone repository: something broke')
+    })
+})

From c63f9aa3ec368745d0e3e3a3461eb0a5f8b99cb4 Mon Sep 17 00:00:00 2001
From: Noley Holland <hollandnoley@gmail.com>
Date: Fri, 26 Jun 2026 13:17:44 -0700
Subject: [PATCH 10/10] Update stale copy for github/azure only

---
 frontend/src/pages/application/PipelineStage/form.vue | 4 ++--
 frontend/src/pages/team/Settings/Integrations.vue     | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/frontend/src/pages/application/PipelineStage/form.vue b/frontend/src/pages/application/PipelineStage/form.vue
index 7bf8c8275e..eb36b087bf 100644
--- a/frontend/src/pages/application/PipelineStage/form.vue
+++ b/frontend/src/pages/application/PipelineStage/form.vue
@@ -144,7 +144,7 @@
                         Choose Git Token
                     </template>
                     <template #description>
-                        This token is used to authenticate with the GitHub or Azure DevOps API. To manage your tokens, go to <strong>Team Settings -> Integrations</strong>.
+                        This token is used to authenticate with your Git provider. To manage your tokens, go to <strong>Team Settings -> Integrations</strong>.
                     </template>
                 </FormRow>
                 <FormRow
@@ -158,7 +158,7 @@
                         Repository URL
                     </template>
                     <template #description>
-                        Only GitHub and Azure hosted repositories are currently supported.
+                        Supports GitHub, Azure DevOps, and any HTTPS Git server (GitLab, Bitbucket, self-hosted).
                     </template>
                 </FormRow>
                 <FormRow
diff --git a/frontend/src/pages/team/Settings/Integrations.vue b/frontend/src/pages/team/Settings/Integrations.vue
index 266ce097e4..30ebee4bd6 100644
--- a/frontend/src/pages/team/Settings/Integrations.vue
+++ b/frontend/src/pages/team/Settings/Integrations.vue
@@ -1,7 +1,7 @@
 <template>
-    <SectionTopMenu hero="Git Version Control" help-header="Git Version Control" info="A list of access tokens that can be used in Pipelines to connect your instances with GitHub/Azure DevOps repositories.">
+    <SectionTopMenu hero="Git Version Control" help-header="Git Version Control" info="A list of access tokens that can be used in Pipelines to connect your instances with Git repositories.">
         <template #helptext>
-            <p>Pipelines can be created to push snapshots to a connected Git repository. Currently, only GitHub.com and Azure DevOps hosted repositories are supported.</p>
+            <p>Pipelines can be created to push snapshots to a connected Git repository — GitHub, Azure DevOps, GitLab, Bitbucket, or any HTTPS Git server.</p>
             <p>Here you can manage the tokens used by your pipelines to access the repositories.</p>
         </template>
     </SectionTopMenu>
@@ -19,10 +19,10 @@
                 <span>Git Integration</span>
             </template>
             <template #message>
-                <p>Pipelines can be created to push snapshots to a connected Git repository. Currently, only GitHub.com and Azure DevOps hosted repositories are supported.</p>
+                <p>Pipelines can be created to push snapshots to a connected Git repository — GitHub, Azure DevOps, GitLab, Bitbucket, or any HTTPS Git server.</p>
                 <p>Here you can manage the tokens used by your pipelines to access the repositories.</p>
                 <template v-if="featuresCheck.isGitIntegrationFeatureEnabled">
-                    <p>To get started, create a GitHub or Azure DevOps Personal Access Token and add it here. You can then create Git Repository pipeline stages.</p>
+                    <p>To get started, create a personal access token on your Git provider and add it here. You can then create Git Repository pipeline stages.</p>
                     <ff-button
                         v-if="addEnabled"
                         class="font-normal"