GitOps Deployments

Rebase uses Python infrastructure-as-code as the source of deployment intent. You do not write deployment YAML. Instead, you commit normal Rebase Python code and let rebase deploy choose the correct path for the target environment.

import rebase as rb

project = rb.project("energy-forecasting")

@project.function(name="forecast")
def forecast(zone: str = "SE3") -> dict:
    return {"zone": zone}

rebase deploy deploy.py --env dev
rebase deploy deploy.py --env prod

Deployment Modes

Each workspace has environment policies for dev, staging, and prod.

Environment	Default mode	Behavior
`dev`	Direct deploy	`rebase deploy` imports the local file and deploys immediately.
`staging`	GitOps protected	`rebase deploy` creates a GitOps deployment request from committed Git source.
`prod`	GitOps protected	Same as staging; direct API deploy mutations are rejected server-side.

Protected environments require a connected GitHub repository and clean committed source. This keeps the normal Modal-like local authoring flow while preserving GitOps controls for shared environments.

Main Flow

Use the same command everywhere:

rebase deploy deploy.py --env dev

For direct environments, the CLI deploys immediately.

rebase deploy deploy.py --env prod

For protected environments, the CLI:

checks the active workspace environment policy;
verifies the file is inside the connected GitHub repository;
requires the file to be clean and committed;
creates a GitOps deployment request in Rebase;
returns the GitHub PR URL for review.

Use --plan to see the path without creating a request:

rebase deploy deploy.py --env prod --plan

Environment Policies

Inspect the current workspace policies:

rebase environment list

Protect an environment:

rebase environment protect prod --allowed-branch main

Allow direct deploys for an environment:

rebase environment unprotect dev

Environment policy enforcement happens in the Rebase API, not only in the CLI. Old CLIs and direct API calls still cannot deploy directly to a protected environment.

GitHub Requirements

Protected deploys require GitHub source backing:

rebase connect github

The connected repository must match the local Git repository. GitHub-backed deploy requests record:

Field	Purpose
Repository	Confirms the source comes from the workspace or project repo.
Source path	Points to the Python deploy file inside the repo.
Commit SHA	Pins the deployment request to immutable source.
Branch	Builds a GitHub compare or PR URL.
Plan	Stores the Rebase-generated deployment intent.

Direct vs GitOps

Command	Environment policy	Result
`rebase deploy deploy.py --env dev`	Direct	Deploys from the local file.
`rebase deploy deploy.py --env staging`	GitOps	Creates a deployment request and PR handoff.
`rebase deploy deploy.py --env prod --plan`	GitOps	Shows the plan without creating a request.
SDK `.deploy(environment="dev")`	Direct	Deploys through the API.
SDK `.deploy(environment="prod")`	GitOps protected	API rejects the direct mutation. Use CLI GitOps flow.

The --sync flag is reserved for the reconciler-based apply path. In the current implementation, protected deploys create a GitOps request and PR handoff instead of applying directly.