v3 launches
It's graduation day for ngit. Version 3 is its biggest release ever, and ngit, powered by GRASP, is quickly becoming a fully fledged development solution, with CI, private repositories, software releases, and plenty more.
This is a coordinated release across the ngit family of tools: ngit v3, ngit-grasp v3, GitWorkshop v4, and the new ngit-ci 0.1.
CI is here
A lack of CI was one of the biggest things holding projects back from using ngit. We heard that loud and clear. ngit-ci 0.1 changes that.
CI should not mean swapping one forge's runner fleet for another. The vision is an open marketplace of compute providers, with a maintainer-selected coordinator choosing the right provider for each job at the right time. Projects will be able to combine their own machines with paid capacity while signed results preserve who ran what.
The first proper ngit-ci release line, version 0.1, makes the first part real. Initially, the coordinator and compute provider live within one operator's deployment, giving projects a complete self-hosted CI path built around signed Nostr events. Workflows run through act in containers or isolated QEMU/KVM microVMs, while ngit and GitWorkshop make the whole run visible, from a maintainer's request to a signed result whose provenance anyone can inspect.
Use CI with ngit or understand the Nostr CI model
Private repositories
Not every repository can be public. With ngit v3, ngit-grasp v3, and GitWorkshop v4, private repositories are now a practical end-to-end workflow. GRASP-08 defines the private GRASP service they implement. An account keeps its private services in an encrypted list, authenticates separately to their Nostr relay and Git endpoints, and confines private repository events to the repository's authenticated relays.
This release makes that path practical for self-hosters without changing the repository into an account owned by the server. The next provider work is to let operators provision many small private services alongside a public one, so teams can combine hosted and self-hosted providers for redundancy.
Basic Buzz support
Basic Buzz interoperability grew out of the same authenticated transport work. ngit can clone Buzz repositories and work with their pull requests and lifecycle status. GitWorkshop can discover them, browse their code, and view their pull requests while hiding controls for unsupported writes. This is deliberately described as basic support because Buzz and GRASP do not yet share every Git and discussion workflow.
Open source collaboration that can scale
Open source projects need moderation before they can welcome participation at scale. GRASP-03 Proactive Sync Plus provides the foundation, and ngit-grasp v3 brings it to life. It brings a project's collaboration history together on the GRASP servers its maintainers choose, so ngit and GitWorkshop can see the complete conversation without hunting across the network.
That synchronisation foundation ships today. It opens the door to maintainer-selected moderation rules that GRASP servers can apply while synchronising, so clients can respect the project's decisions without each having to implement those rules themselves, which can often be difficult to do client-side. See where moderation goes next.
Behind the scenes, ngit-grasp v3 also delivers a substantial security and performance overhaul, making GRASP services safer, leaner, and more reliable as they grow.
Safer, clearer maintainer authority
Projects change hands. Maintainers join, leave, and share responsibility. The new maintainer model handles those changes with an explicit lead, role history, and non-maintainer moderators. It gives a multi-maintainer project one recommended coordinate, keeps past actions valid after a maintainer leaves, and lets moderators manage collaboration without granting them authority over Git state.
Those substantial improvements are backwards compatible for existing repositories and confirmed maintainer relationships. A lead coordinates the roster but has no stronger Git authority than another confirmed maintainer.
One narrow authority change
Being listed by a maintainer is now only an invitation. The invitee's Git state does not become authoritative until they accept. Existing confirmed maintainer relationships continue to work without any action.
That pending-invitation interval is the SemVer reason for ngit and ngit-grasp v3 and GitWorkshop v4. Read the full compatibility explanation.
Software releases over Nostr
Think GitHub Releases without GitHub, made unstoppable through Blossom replication. From a developer machine or CI, ngit can publish signed applications, releases, and downloadable assets that belong to the project, not to one platform or download host.
GitWorkshop gives those releases a home in the browser and a guided publishing flow. The same release can distribute an Android application through Zapstore, and ngit can even update itself from its own verified release assets.
Nsites and containers too
Publishing does not stop at downloadable assets. ngit v3 also publishes nsites and verified OCI image layouts through Nostr and Blossom. Container tags remain mutable signed project state while every image blob stays content-addressed. GitWorkshop surfaces nsite previews produced by pull-request CI; container publishing is currently an ngit workflow.
The docs graduated too
ngit has grown into a family of tools, and the documentation has grown with it. This new ngit.dev brings the whole journey together, from the first install and everyday collaboration to private repositories, CI, self-hosting, protocols, and agent-ready reference.
Whether you are contributing to a project, running its infrastructure, building a client, or handing work to a coding agent, there is now one place to start and a clear path into the details.
More in ngit v3
That is not all. ngit v3 also brings:
- Local-key and bunker credentials move out of Git config by default and into the OS credential store, with an ngit-specific user-only file fallback. This reflects a changed threat model in which coding agents and other tools routinely inspect Git config, making inadvertent secret disclosure more likely.
- Pull requests can target non-default branches and form explicit or inferred stacks. Contributor PR branches are checked out on demand instead of all being downloaded during every fetch.
- Signer selection, repository selection, JSON output, agent guidance,
--force-with-lease, raw-object pushes, and ordinary Git ref tracking are more explicit and predictable. .onionrelays and clone URLs can use an available Tor proxy, while an opt-in build feature supports infrastructure using host-installed certificate authorities.
More in GitWorkshop v4
GitWorkshop v4 has plenty more of its own:
- Repository, pull-request, patch, and push histories use condensed commit graphs, including collapsed merged-in histories and clearer force-push context.
- A comparison page progressively loads commits and file diffs between branches, tags, or commit IDs.
- Keeping things efficient and responsive with shared subscriptions, incremental relay queries, on-demand Git object loads, and bounded pack parsing.
- Mobile diffs, notification gestures, grouped activity, loading states, and review controls receive a substantial usability pass.
Taken together, these releases create a development workflow in which a project's identity and policy remain with its maintainers. Git storage, repository relays, CI, and interfaces can be run by different operators without any one of them becoming the owner of the project.
These four tools are maintained in tandem by GRASP creator DanConwayDev, but they are one project family within a wider ecosystem. They implement open protocols; other clients, repository services, and CI systems can participate without adopting this particular set of tools.
The complete change lists live with the source for ngit, ngit-grasp, ngit-ci, and GitWorkshop.
Upgrade notes
As a user or maintainer, you can carry on as normal and start using the new features whenever you are ready. Existing repositories, issues, pull requests, signed events, and confirmed maintainer relationships continue to work. There is nothing you need to migrate.
You do not have to change a thing to keep working, but two small updates will help you make the most of v3:
- Log in again to move an existing plaintext signer credential into the OS credential store or protected fallback file. It remains readable until you do.
- Run
ngit skill installinside your repositories to help contributors' coding agents work better with ngit.
Back up ngit-grasp before upgrading from v2
The first ngit-grasp v3 startup performs a one-way Git storage migration before the service begins listening. Back up Git and relay data together, plan for downtime, and do not run v2 against migrated storage. Rolling back requires the pre-upgrade snapshot, not only the old binary.
What this unlocks next
This release supplies foundations rather than a finish line. The next work is focused on hosted private GRASP services beyond self-hosters, separating CI compute providers from coordinators across more platforms and architectures, and adding maintainer-defined moderation on top of synchronised repository history.