Every commit, every deploy, every line — on GitHub

Nothing ships
without a green check.

Pagayo lives on GitHub end to end. Every line of code, every pull request, every CI run, every deploy — written down, reviewed, tested, and traceable to the commit that started it. The platform is built the way it runs: small steps, green checks, no surprises.

Visit github.com ↗

Repositories, one platform

100%

Changes via pull request

Commits direct to main

∞

Green checks before deploy

The toolbelt

Twelve GitHub features. One workflow.

Pagayo uses GitHub for far more than hosting code. From review to release, from secrets to scanning — here is the full set, and what each one does day to day.

Pull requests Review

Every change reviewed before it touches main.
Actions CI/CD

Build, test, and deploy on every push.
Packages Registry

Shared packages: schema, design, config.
Environments Deploys

Staging and production, gated and approved.
Secrets Vault

Credentials per environment, never in code.
Releases Versions

Tagged versions for every shared package.
Issues Tracking

Bugs, ideas, follow-ups — written down, in order.
Projects Planning

The week-by-week roadmap behind the Build Log.
Dependabot Security

Watches every dependency, opens PRs for updates.
CodeQL Scanning

Static analysis for vulnerabilities on every push.
Branches Workflow

feature/batch-staging-* → main, never the other way.
Copilot Reviews

AI reviewer on every PR before a human looks.

How it fits together

Six layers, one workflow.

Repositories, pull requests, CI/CD, environments, packages, security — every part of building Pagayo runs on a GitHub primitive. Here is what each one does.

01 Repositories

Thirteen repos, one platform

Each piece of Pagayo, in its own house.

Pagayo is not a monorepo. It is thirteen focused repositories — storefront, api-stack, edge, workflows, schema, design, config, marketing, and a few more — each with its own concerns, its own tests, and its own deploy pipeline. They share types and contracts through a handful of versioned packages, and nothing else. One change, in one place, with a clear blast radius.

storefront, api-stack, edge, workflows — runtime services
schema, design, config — shared, versioned packages
marketing, vault, maintenance, docs — supporting repos

02 Pull requests · Reviews

Every change is a pull request

No commits to main. Not by anyone. Not ever.

Every line of Pagayo arrives through a pull request from a feature branch (feature/batch-staging-YYYYMMDD). Branch protection enforces it. Copilot opens an automated review on every PR — looking for missed tests, broken types, and obvious bugs — before a human ever reads it. Lint, typecheck, and tests must all be green. Then the PR gets merged, and only then does the change become real.

Branch protection: no direct pushes to main
Copilot reviews every PR automatically
Lint + typecheck + tests required, no override

03 GitHub Actions

Continuous integration, on every push

The build is green, or the change does not ship.

Every push to every branch fires GitHub Actions: install, lint, typecheck, run the unit tests, run the integration tests, build the workers, build the static site, run smoke tests against staging. If any step fails, the PR cannot merge. If everything passes, the workflow can deploy. Same workflow on macOS for development, on Linux for CI — same Node version, same npm version, same lockfile. No "works on my machine".

Lint, typecheck, unit, integration, smoke — on every push
.nvmrc + node-version-file — dev and CI on the same Node
Workflows owned per repo, with shared release-playbooks

04 Environments · Releases

Staging first. Always.

Every change rides the same path: branch → staging → main → production.

Nothing reaches production without spending time on staging first. Every feature branch deploys to a staging environment automatically. Smoke tests run against it. Pagayo validates it. Only then does the branch merge to main, which kicks off the production deploy through GitHub Environments — with explicit approval gates, audit logs, and the ability to roll back to the previous tagged release in seconds.

feature/batch-staging-YYYYMMDD → staging (auto)
main → production (approval gate)
Tagged releases for every deploy, instant rollback

05 Packages · npm registry

Shared code, versioned

Three packages every repo depends on. Bumped on purpose.

@pagayo/schema (database schemas), @pagayo/design (CSS tokens and components), and @pagayo/config (URLs, endpoints, policy) live in their own repos and publish to GitHub Packages. Consumer repos pin exact versions in their package-lock. A change in design doesn't touch storefront until storefront chooses to upgrade — and the consumer-update gets its own pull request, its own review, and its own staging run.

Tag → Publish workflow on every shared package
Consumers pin exact versions in their lockfile
Drift checks: local dist vs published version, in CI

06 Dependabot · CodeQL · Secrets

Security as a workflow

Every dependency, every scan, every secret — accounted for.

Dependabot watches every package across every repo, opens pull requests for security and version updates, and waits for CI to validate them. CodeQL runs static analysis on every push, looking for the patterns that turn small bugs into large incidents. Secrets live in GitHub Environments — never in code, never in commits — and audit logs record every access. Branch protection, signed commits, required reviewers: all of it, all the time.

Dependabot PRs for security and version updates
CodeQL static analysis on every push
Secrets per environment, audited, never in code

Why this matters for you

A platform you can trust the boring parts of.

Most "you'll never see this" parts of running software online are where the danger lives — unreviewed changes, untested deploys, forgotten secrets, surprise dependency upgrades, "we'll fix it later" branches. Pagayo doesn't have those, because GitHub doesn't let it.

Every change goes through the same path. Every deploy ends with a green check and a tag you can roll back to. Every secret lives somewhere we can audit. The discipline is built into the tools, not into anyone's memory — which is what makes it possible to keep shipping every week, indefinitely, with one person at the keyboard and a small army of agents helping out.

Start selling today.
Grow with the platform.

Free to start. All features included. Yours to leave whenever you want — most never do.

Start Free → Compare Plans

Have an idea, a question, or a feature you wish existed? Get in touch — we listen.

Nothing ships without a green check.