GitProxy Roadmap: v3

[jescalada]

GitProxy v3 Roadmap

An overview of where GitProxy is headed and what the community wants. Previous issue #1119.

Status: Draft, to be reviewed in next Community call
Last reviewed: 2026-09-25
Next review: 2026-10-05
Source: 26 Aug 2026 roadmap meeting minutes and comments (#1702)

Overview

#	Item	Tier	Size	Status
1	Plugin system extensions	1	🔴	🟠
2	Event hooks & notifications	1	🟡	🟠
3	Security: zero known CVEs	1	🟡	🟠
4	Open source lifecycle governance	2	🔴	⚪
5	PostgreSQL backend	2	🟡	🟠
6	Additional maintainers	2	N/A	⚪
7	UI accessibility	2	🟡	🔵
8	Push annotations	3	🟡	⚪
9	Pre-provisioned users and roles	3	🟢	⚪
10	Contribution policy requirements	3	🟡	⚪
11	Project onboarding improvements, ingress governance	3	🔴	⚪
12	Fork management	3	🔴	🔵
13	Better TLS support, OpenShift integration	3	🟢	⚪
14	Performance & scalability	3	🟡	🟠
15	UI assets in npm package	3	🟢	🟠

Glossary

Each issue is classified according to importance, size and status. Use :circle: emojis or :check_mark: to change the status.

Category	Description	Values
Importance	Measures how critical the feature is, depending on how many organisations "need" it	Tier 1: raised by 3+ orgs, Tier 2: raised by 2 orgs (or an org's #1 priority), Tier 3: raised by a single org
Size	Estimated effort	🟢 Easy win, 🟡 Medium, 🔴 Large (or breaking)
Status	Development progress	⚪ Not started, 🔵 Issue drafted, 🟠 In progress, ✅ Done

---

Tier 1: high demand

1. Plugin system extensions

Size: 🔴 | Owners: @jescalada, @dcoric, @06kellyjac, @goldensyntax | Blocks: 2, 10, 11, 12

Currently, the plugin system only works for chain steps, and is limited to running at the start of the chain. Many other issues in the roadmap depend on this: event-handler hooks, contribution policy checks, onboarding hooks, supply chain scanning for pulls, etc.

Sub-issues/PRs

• feat: revamp plugin system #1683
• Plugins at more phases of the processing chain, including pulls
• Event-based plugin types (improved event handlers)
• Clearly extensibility features/plugin documentation
• feat: supply-chain scanning plugin with chainPhase plugin hooks (RFC / discussion) #1639

2. Event hooks & notifications

Size: 🟡 | Owners: @jescalada, @andypols, @re-vlad, @dcoric | Depends on: 1 (plugin handlers)

Sub-issues/PRs

• Extensibility through Event Hooks #1449
• feat(event-handlers): introduce event handler system for GitProxy lifecycle events #1519
• Event payloads expose fields for rich notifications (e.g. review cards)
• Handler isolation, failing/slow handler don't affect subsequent events
• Email notifications for reviews #1121
• Slack notifications
• Microsoft Teams notifications

3. Security: zero known CVEs

Size: 🟡 | Owners: @tabathad, @finos/git-proxy-maintainers

Attaining (and maintaining) zero known CVEs was raised by three orgs and is expected to help adoption.

Sub-issues/PRs

• Review dependabot config and ensure that PRs that resolve current CVEs are clearly labelled #1667
• ci: separate CVE vs evergreen Dependabot PRs #1749
• Triage and remediate AI-assisted scan findings
• Publish a dependency update policy document

---

Tier 2: medium demand OR an organisation's top pick

4. Open source lifecycle governance

Size: 🔴 | Owners: @andypols | Depends on: 8

Extend GitProxy beyond pushes to cover other upstream contributions.

Sub-issues

• Support issue/comment creation through GitProxy
• Allow raising pull requests with pre-approved PR content
• Add review process and auditable logs for issue/copmment/PR creation
• Branch-aware handling of subsequent pushes (replace/close superseded reviews)

5. PostgreSQL backend

Size: 🟡 | Owners: @dcoric, @jescalada

Sub-issues

• feat: PostgreSQL sink backend #1687 final postgres implementation PR
• Add guide on how to migrate from existing backend(s)

6. Additional maintainers

Size: N/A | Owners: @grovesy, @mcleo-d

Sub-issues

• Document process for nominating maintainers
• Onboard new maintainers

7. UI accessibility

Size: 🟡 | Owners: @goldensyntax (lead), @andypols, @fabiovincenzi

Sub-issues

• Ensure Git Proxy user interfaces meet WCAG 2.2 Level AA accessibility requirements #1363
• Accessibility review of new UI
• Make remediation issues for any findings

---

Tier 3: raised by a single organisation

8. Push annotations

Size: 🟡 | Enables: 4

Sub-issues

• Attach notes/metadata to pushes via UI or custom annotation handling

9. Pre-provisioned users and roles

Size: 🟢 | Owners: @sam-holmes2, @coopernetes

Sub-issues

• Admins can create users and assign roles before first login

10. Contribution policy requirements

Size: 🟡 | Depends on: 1, 2

Sub-issues

• Add configurable push requirements (training, documentation, admin approval)
• Display check results to reviewers/admins
• Connect with event hook/plugin system

11. Project onboarding improvements, ingress governance

Size: 🔴 | Owners: @sam-holmes2, @coopernetes | Depends on: 1

Sub-issues

• Allow users to request new projects to proxy
• Automate onboarding with configurable checks/review steps
• Optionally allow first pull + push review before admin involvement
• Health warnings and auditable logs for project ingress

12. Fork management

Size: 🔴 | Owners: @sam-holmes2, @coopernetes

Sub-issues

• Automate the sync of in-house forks with upstream repositories #1240
• Fork creation as a first-class GitProxy feature (organisation-owned forks)

13. Better TLS support, OpenShift integration

Size: 🟢 | Owners: @rajeevr-g, @Andreybest

Sub-issues

• Investigate TLS hand-off from OpenShift to the container
• Document or fix supported TLS termination setups

14. Performance & scalability

Size: 🟡 | Owners: @jescalada

Sub-issues

• Publish current throughput/concurrency results, including large repos
• Benchmark many-mirrored-repo scenarios
• Improve hot spots if needed

15. UI assets in npm package

Size: 🟢 | Owners: @andypols, @goldensyntax, @fabiovincenzi

Sub-issues

• UI files are not present in 2.0 and 2.1 NPM packages #1704
• CI check that fails the release if UI assets are missing

---

Adding your desired features

If you want to extend or modify this list with your organisation's priorities, please leave a comment with your desired features, ranked by importance. If a feature is requested by multiple organisations, it will be upgraded to the next tier.

Picking up an issue

If you've started working on an issue, leave a comment here so maintainers can keep this roadmap up-to-date.

Missing sub-issues

If any roadmap item is missing a sub-issue, open an issue for it and/or link it here.

Updates/comments

This issue is reviewed at each roadmap meeting. Maintainers will update the tiers, status and sub-issues based on any comments posted.