Roadmap - GitProxy v2 and beyond!

[jescalada]

Roadmap

As discussed in previous community calls, GitProxy is direly in need of a Roadmap so that contributors can see more clearly the order in which things ought to be developed and merged into the project. It'll also help us start developing v2 on the right foot.

I've decided to write a quick draft after looking at all the open issues and PRs. I'm classifying most issues roughly based on need (engagement), difficulty and whether they'll cause breaking changes with our current setup.

Feel free to add the issues that are relevant to your organization!

Note: We might want to reorder these according to our perceived priority (my default sorting is older issues first).

Easy wins

Anything that we could probably get done within a day or two.

• feat: allow git-proxy to be configured both by environment as well as config file(s) #382
• Create a new slogan for GitProxy #505
• A reviewer must provide a reason when rejecting a push 💬  #605
• Run a hosted demo of the GitProxy dashboard ☁️  #627
• Default config not loaded due to excessive validation #654
• Support filter by file with file pattern and literal configuration #745
• Add Apache-2.0 license headers to source code #1002 (PR ready)
• Define and publicise our standards for testing and CI gating #1019
• Improve default admin user creation #1022
• Validate that a project doesn't already exist in GitProxy before creation (to avoid duplicates) #1028
• Restrict developers from overriding blocked pushes #1031
• Z_DATA_ERROR during push parsing #1040
• Validate attestation against config #1041

Need, fixes and minor releases

Fixes and non-breaking features that will provide significant value to users.

• SSH support #27
• Patch oriented workflow #61
• Contribute in personal capacity #64
• git push hangs with Git Proxy on macOS #510
• Implement a license inventory ⚖️  #594 and related PRs
• proposal: refactor configuration code #743
• Expose proxy support within GitProxy itself for air gapped environments #759
• Cypress tests require data created by mocha tests, but should be self-contained #978
• optimize pullRemote for large repos #985
• Add support for pushing tags git push --tags #986
• (bug) scanDiff fails on force pushes #1008
• docs/samples: example pull plugin fails to import PullActionPlugin #1088
• Support additional email addresses for users #1104

Need, but may cause breaking changes

Anything that requires deep refactoring/architectural changes may fall in this category. We will likely release these in GitProxy v3.

• Git Proxy 2.x architecture #425
  • Lots of architectural changes here that will help pave the way for new features
• Open Policy Agent checks #99
• Add first class support for WASM-backed plugins  #463
  • Depends on Git Proxy 2.x architecture #425
• Extend GitProxy to Handle All GitHub Communications and Reviews #910
  • Super valuable, may not strictly require v3 but changes are expected to be large
• Commits should be associated with users via email rather than the git user.name config #946, Repositories should be identified and retrieved via URL rather than name #950
  • Planned for v2 release
• Feature Request: User Creation Endpoint and CLI Command #980

Nice-to-have, tech debt fixes

We don't strictly need these, but they'll help improve maintainability and user/developer experience.

Tech Debt

• Increase test coverage to 80% ⚡️  #240
  • Almost there, just a few % left
• TypeScript and ESM support #276
  • Almost there, just a few PRs left to merge refactor: refactor git-proxy-cli to TS + ESM #1065 refactor: Refactor service module to TS + ESM #1063
  • Related: Add TypeScript to the Project #927
• e2e testing of git-proxy  #394
  • We do have E2E tests set up, we just need more coverage
  • Related: Extend Cypress tests for dashboard pages and components #624
• Replace console.log with structured logging #399
  • There is a PR for this almost ready to merge Replace console.log with structured logging  #508
• Bump OSSF score above 9.0 ⬆️  #694
  • PR ready for this test: Implement fuzz tests for processors #1115
• Remove usages of trimTrailingDotGit #1113

UI/UX-related

• Implement Developer Stats Widget #50
• Implement dashboard widgets #51
• Asynchronous management of a push request  #428
• Replace MUI v4 styling with Tailwind #1106

[kriswest]

I've just added an issue I think should be considered for the roadmap:

• Email notifications for reviews #1121

[kriswest]

The collection and classification of the issues is great step towards a roadmap. From here a plan needs putting together and agreeing for what order or prioritisation is applied.

I am obviously very keen to see these go in, so that other work doesn't continue to conflict with them (in particular by continuing to handle repos by name in all the various parts of Git Proxy):

• Commits should be associated with users via email rather than the git user.name config #946, Repositories should be identified and retrieved via URL rather than name #950
  • Planned for v2 release

[jescalada]

@kriswest Should we perhaps have a meeting before the next community meeting to discuss the priorities and start working on some fixes? I'm happy to develop other organizations' priority features in the meantime while waiting for our own features to go through the pipeline.

[kriswest]

I'd be happy to join a work party on the Roadmap - in prep for discussing it at the next community meeting. This week is looking tight, I've only got a few gaps on Thursday. The following week Monday and Tuesday are when I have the most gaps. K

…

-- [cid:c1c81bdc-963c-43b7-ae4e-9de60e6a36e5] Kris West (he/him) Principal Engineer | Open Source Program Office (OSPO) ***@***.******@***.***> | +44 7715104292 250 Bishopsgate, London, EC2M 4AA natwestgroup.com The information classification of this email is Confidential unless otherwise stated. [cid:a2962729-020a-4e6f-8da1-231ed2045c36] Do you have a question? Join us on Discourse https://natwest.discourse.group<https://natwest.discourse.group/> (Open Source<https://natwest.discourse.group/c/open-source/57> | InnerSource<https://natwest.discourse.group/c/inner-sourcing/58>)

________________________________ From: Juan Escalada ***@***.***> Sent: 28 July 2025 5:17 PM To: finos/git-proxy ***@***.***> Cc: West, Kristopher (Architecture and Engineering, Digital X) ***@***.***>; Mention ***@***.***> Subject: Re: [finos/git-proxy] Roadmap - GitProxy v2 and beyond! (Issue #1119) ********************************************* "This is an external email. Do you know who has sent it? Can you be sure that any links and attachments contained within it are safe? If in any doubt, use the Phishing Reporter Button in your Outlook client or forward the email to ~ I've Been Phished" ********************************************* [https://avatars.githubusercontent.com/u/97265671?s=20&v=4]jescalada left a comment (finos/git-proxy#1119)<#1119 (comment)> @kriswest<https://github.com/kriswest> Should we perhaps have a meeting before the next community meeting to discuss the priorities and start working on some fixes? I'm happy to develop other organizations' priority features in the meantime while waiting for our own features to go through the pipeline. — Reply to this email directly, view it on GitHub<#1119 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AAM7PBEUARIGZHMVIHTWB533KZEITAVCNFSM6AAAAACCNJRVNWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTCMRXHE4TOMZRHE>. You are receiving this because you were mentioned.Message ID: ***@***.***> National Westminster Bank plc. Registered in England No. 929027. Registered Office: 250 Bishopsgate, London EC2M 4AA. National Westminster Bank plc is authorised by the Prudential Regulation Authority, and regulated by the Financial Conduct Authority and the Prudential Regulation Authority. The Royal Bank of Scotland plc. Registered in Scotland No. 83026. Registered Office: 36 St Andrew Square, Edinburgh EH2 2YB. The Royal Bank of Scotland plc is authorised by the Prudential Regulation Authority, and regulated by the Financial Conduct Authority and the Prudential Regulation Authority. The Royal Bank of Scotland plc and National Westminster Bank plc are authorised to act as agent for each other. The Royal Bank of Scotland plc and National Westminster Bank plc are UK chartered banks and are not chartered or licensed as banks by the United States or any individual state. This e-mail message is confidential and for use by the addressee only. If the message is received by anyone other than the addressee, please return the message to the sender by replying to it and then delete the message from your computer. Internet e-mails are not necessarily secure. The Royal Bank of Scotland plc, National Westminster Bank plc or any affiliated entity (“NatWest” or “us”) does not accept responsibility for changes made to this message after it was sent. NatWest may monitor e-mails for business and operational purposes. By replying to this message you give your consent to the monitoring of your e-mail communications with us. Whilst all reasonable care has been taken to avoid the transmission of viruses, it is the responsibility of the recipient to ensure that the onward transmission, opening or use of this message and any attachments will not adversely affect its systems or data. No responsibility is accepted by NatWest in this regard and the recipient should carry out such virus and other checks as it considers appropriate.

[coopernetes]

Thanks Juan! I cleaned up the existing milestones since they hadn't been touched for close to a year and collapsed them down into a single 2.0.0 milestone. We can start associating issues & PRs where necessary.

https://github.com/finos/git-proxy/milestone/6

It would be a good idea to triage some of the older issues. I think there is a bunch of outstanding functionality and/or bug fixes which would take priority over some of the aspirational ideas from early on in the project. Specifically, issues related to security (user management is often a pain point) and improved proxy support (removing tight coupling to GitHub, better configurability, etc) I would think are of most interest for this next major version. A good opportunity as well to uplift all the developer tooling (complete migration to TS/ESM, ESLint upgrades, etc).