A one-way GitHub-to-Draft'n Run synchronisation rule that watches a repository folder and deploys graph changes when code is pushed. GitHub is a service for storing code and tracking changes.

Use it to receive GitHub webhooks, fetch repository files, and synchronise graph changes into Draft'n Run.

It keeps changes made in the GitHub repository moving into Draft'n Run without requiring manual imports. Authentication uses a GitHub App rather than a user's OAuth login.

git-sync — Cursor rule for Cursor by Scopeo

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Clone the repo

git clone --depth 1 https://github.com/Scopeo/draftnrun

Made for: Cursor.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/rules/scopeo/draftnrun/git-sync.svg)](https://agentmods.dev/rules/scopeo/draftnrun/git-sync)

Your own site

<a href="https://agentmods.dev/rules/scopeo/draftnrun/git-sync"><img src="https://agentmods.dev/badge/rules/scopeo/draftnrun/git-sync.svg" alt="Measured on agentmods" height="20"></a>

Per session 457 This file is loaded in full into every session.

When invoked 457 The same file — it is already loaded in full.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00457	$0.00457
Opus 5	$0.00229	$0.00229
Sonnet 5	$0.00091	$0.00091
Haiku 4.5	$0.00046	$0.00046

Measured 2d ago against content hash 14392127ba76, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-07, from the pricing page.

Security

Grade A, and why

git-sync scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.cursor/rules/git-sync.mdc · 39 lines

What it actually says

Git Sync

GitHub-to-Draft'n Run one-way sync using a GitHub App. Watches a GitHub repo folder and deploys graph changes on push.

Key Files

ada_backend/routers/git_sync_router.py — webhook receiver + CRUD endpoints
ada_backend/workers/git_sync_queue_worker.py — Redis queue worker that executes sync_graph_from_github
ada_backend/services/git_sync_service.py — import_from_github, sync_graph_from_github, disconnect_sync
ada_backend/services/github_client.py — GitHub App auth (JWT → installation token) + file fetch
ada_backend/repositories/git_sync_repository.py — GitSyncConfig CRUD
ada_backend/database/models.py — GitSyncConfig model

Auth: GitHub App (not OAuth)

No Nango involved. Auth is via JWT signed with the App's private key (RS256).
JWT is exchanged for a short-lived installation access token (~1 hour).
Env vars: GITHUB_APP_ID, GITHUB_APP_PRIVATE_KEY, GITHUB_APP_WEBHOOK_SECRET.

Webhook

ONE global webhook URL configured on the GitHub App ({ADA_URL}/webhooks/github)
ONE global webhook secret (GITHUB_APP_WEBHOOK_SECRET env var)
No per-repo webhook registration needed — the GitHub App receives events for all installed repos
Endpoint is public, secured by HMAC-SHA256
Webhook handler enqueues jobs to ada_git_sync_queue Redis queue (non-blocking); GitSyncQueueWorker processes them

Sync Strategy

Git sync does not touch the user's draft. On each push it creates a fresh graph runner from the GitHub JSON, tags it, and promotes it directly to production. The draft remains untouched so in-progress edits are never lost.

Data Model

github_owner + github_repo_name — stored as separate columns (not combined owner/repo). The model exposes a github_repo property for the combined form when needed (e.g. GitHub API calls).

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2d ago First seen · 39 lines · 457 tokens per session scan A 14392127ba76

Subscribe to this mod's changes

git-sync is a cursor rule published in the GitHub repository Scopeo/draftnrun (30 stars, last pushed 4d ago), licensed Apache-2.0. It adds 457 tokens to every session, about $0.0023 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-04.

Git and workflow

git-sync

Getting it into your agent

Wrote this? Show the measurements

What it costs to keep this loaded

Grade A, and why

Nothing flagged

What it actually says

Git Sync

Key Files

Auth: GitHub App (not OAuth)

Webhook

Sync Strategy

Data Model

See Also

What this file has done since we first saw it

Other cursor rules, from other repositories

git-commit-attribution

skill-management

iris

rebase-only-merged-agents

git-workflow

release-checklist