> ## Documentation Index > Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt > Use this file to discover all available pages before exploring further. # Push and pull > Push workspace configuration to Git as a pull request, then pull a reviewed commit into another workspace. Enterprise Edition Push and pull require a workspace connected to a repository. See [Workspace Git sync](https://docs.tracecat.com/gitops/workspace-git-sync.md) to connect a provider and bind a workspace. ## Push and open a pull request Use the `Push` tab to push the full workspace configuration. **1. Choose a branch and commit message** On the `Push` tab, use the branch picker beside `Into` to choose an existing branch or enter a new branch name and click `Create`. Enter a commit message. New branches start from the base branch. Tracecat blocks direct pushes to both the base branch and the repository default branch. ![Git sync Push tab with grouped resource changes, target branch, and commit message](https://mintcdn.com/tracecat/5VxYc3hxgApGPNHY/img/manage-platform/git-sync-workspace-push.jpg?fit=max\&auto=format\&n=5VxYc3hxgApGPNHY\&q=85\&s=68915615f13bf795862b4b3dd7106b15) **2. Preview changes** Click `Preview` to compare with the target branch, or the base branch when creating a branch. Expand a resource group to review its file changes. Use `Preview again` after making more edits. **3. Push** Click `Push and open PR` (`Push and open MR` on GitLab); the button includes the change count after a preview. Use the adjacent menu to choose `Push only` when you want a commit without a pull request. Tracecat commits only changed files, deletes stale files, and reuses an open pull request on the same branch. The pull request body names the workspace and the publishing user's email. ### Push one resource type Each resource list page has its own `Push` button, which exports that resource type plus everything it references onto its own branch. > [tab] Tables > > ![Push tables dialog showing the source, target branch, and resulting pull request](https://mintcdn.com/tracecat/XNz10wqNQVUpF7DM/img/manage-platform/git-sync-resource-push-tables.png?fit=max\&auto=format\&n=XNz10wqNQVUpF7DM\&q=85\&s=c12de01c5f68549a426b389d8c58bf41) > [tab] Case fields > > ![Push case custom fields dialog showing the source, target branch, and resulting pull request](https://mintcdn.com/tracecat/XNz10wqNQVUpF7DM/img/manage-platform/git-sync-resource-push-case-fields.png?fit=max\&auto=format\&n=XNz10wqNQVUpF7DM\&q=85\&s=ff26ddfb79ca9f7ed5fafedcabc03a8a) > [tab] Skills > > ![Push skills dialog showing the source, target branch, and resulting pull request](https://mintcdn.com/tracecat/XNz10wqNQVUpF7DM/img/manage-platform/git-sync-resource-push-skills.png?fit=max\&auto=format\&n=XNz10wqNQVUpF7DM\&q=85\&s=a50f0e85456f55154aaba18b8fd5d898) ### Push a single workflow From the workflow builder's `Publish` dropdown, choose `Open PR` or `Push directly`; a direct push commits to the selected branch with no pull request. ![Workflow builder Publish dropdown with Open PR and Push directly options](https://mintcdn.com/tracecat/XNz10wqNQVUpF7DM/img/manage-platform/git-sync-workflow-publish.png?fit=max\&auto=format\&n=XNz10wqNQVUpF7DM\&q=85\&s=3f3c7ec5590de18a14384fb9c6fdb04d) ## Pull a commit A merged pull request changes nothing in a workspace until you or your pipeline pull that commit. **1. Choose a commit** On the `Pull` tab, use the commit picker beside `From` to choose a commit from the base branch. ![Git sync Pull tab with grouped changes, commit selector, and schedule-overwrite control](https://mintcdn.com/tracecat/5VxYc3hxgApGPNHY/img/manage-platform/git-sync-workspace-pull.jpg?fit=max\&auto=format\&n=5VxYc3hxgApGPNHY\&q=85\&s=e213fbe2f8a4e5dc8bfcf5e952e6112c) **2. Preview changes** Click `Preview` to dry-run the pull. If Tracecat cannot resolve a model, MCP integration, or secret store, choose its target in the matching dialog, then click `Save and preview again`. Use `Choose matches` to reopen unresolved choices. Resolve any validation errors before pulling. ![Match model and MCP references before pulling a commit](https://mintcdn.com/tracecat/5VxYc3hxgApGPNHY/img/manage-platform/git-sync-manual-matching.jpg?fit=max\&auto=format\&n=5VxYc3hxgApGPNHY\&q=85\&s=15a620066cce07f59eaab01175bde464) **3. Apply** Click `Pull into `; the button includes the change count after a preview. Tracecat enables it only after a successful preview for the same commit and options. A pull updates matching workspace resources and leaves schedules untouched unless you check `Overwrite schedules`. Changing the commit, schedule option, or reference matches requires another preview. > [!WARNING] > > A pull can overwrite local edits made after the preview. Coordinate workspace edits, run one push or pull at a time, and wait for it to finish before starting another. Leaving the page does not cancel an in-flight sync. A push exports the workspace state when you submit it, so preview again after editing resources. Until you publish a pulled workflow, its runs resolve actions against the workspace's current registry versions. Publishing it records the registry lock. ## Staging to production **1. Bind both workspaces** Bind staging and production workspaces to the same repository. Role assignments are per workspace, so grant `workspace_sync:sync` (`workspace-editor` and above) in each. **2. Push from staging** Build in staging, then choose `Push and open PR` (`MR` on GitLab) from its `Push` tab. **3. Review and merge** Merge the pull request in your repository, where branch protection and required reviews apply. **4. Pull into production** In production, select the merged commit, click `Preview`, then `Pull into `. Publish any workflow that needs a registry lock. ## API reference Exporting a workspace requires `workspace_sync:sync`. Reading branches and commits, pulling, and publishing one workflow also accept `workflow:sync`, so a service account holding only `workflow:sync` can pull from CI. | Action | Endpoint | Scopes | | - | - | - | | Save provider credentials | `POST /organization/vcs/{provider}/credentials` (`github` or `gitlab`) | `org:settings:update` | | Bind a repository | `PATCH /workspaces/{workspace_id}` with `settings.git_provider` and `settings.git_repo_url` | `workspace:update` | | Preview an export | `POST /workflows/sync/export/preview` | `workspace_sync:sync` | | Export and open a pull request | `POST /workflows/sync/export` | `workspace_sync:sync` | | Push one workflow | `POST /workflows/{workflow_id}/publish` | `workflow:update`, plus `workflow:sync` or `workspace_sync:sync` | | List branches and commits | `GET /workflows/sync/branches`, `GET /workflows/sync/commits?branch=` | `workflow:sync` or `workspace_sync:sync` | | Pull a commit | `POST /workflows/sync/pull` with a required `commit_sha` | `workflow:sync` or `workspace_sync:sync` | ## Related pages * See [Workspace Git sync](https://docs.tracecat.com/gitops/workspace-git-sync.md) for connecting a repository and the layout of an export. * See [Security architecture](https://docs.tracecat.com/security/architecture.md#workspace-gitops) for the GitOps model and how registry versions resolve after a pull. * See [Roles and permissions](https://docs.tracecat.com/manage-platform/rbac.md) for the scopes that gate connecting, exporting, and pulling. * See [Workflows](https://docs.tracecat.com/automations/workflows.md) for YAML export and import without Git. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.