Hosting a static site from GitHub (pull-to-host)

Pull-to-host turns a connected GitHub repo into the source of truth for a site you serve from a Turtini-managed domain. Push to the connected branch, Turtini pulls the files, scans for committed secrets, and serves them at your custom domain — no manual deploy step.

Public docs page (with audience cards, FAQ, and the full setup recipe): https://turtini.com/integrations/pull-to-host

This is the inverse of "Export to GitHub": instead of Turtini pushing rendered HTML out, Turtini pulls static files in and hosts them. Useful for sites authored entirely in code (Lovable / Bolt / Vite / hand-written HTML), or for sites that want CI to build and Turtini to serve.

To connect a hosted site:
1. Open Builder → Sites
2. Click the Host icon on the site card (next to GitHub / Re-export)
3. The setup modal opens
4. Repository — owner/repo format (e.g. acme/marketing-site). Must be a repo your connected GitHub account has push access to.
5. Branch — defaults to main. If your site needs a build (npm run build), commit the built output to a dedicated branch (e.g. dist or gh-pages) and connect that branch instead. (Turtini doesn't run build commands server-side — see "Bring-your-own-CI: auto-bootstrap a build workflow".)
6. Custom domain (optional) — add later from the site card
7. Enable preview URLs for other branches — checkbox, default ON. Pushes to non-primary branches deploy to <branch>--<siteId>.preview.turtini.com instead of clobbering production.
8. Add a build workflow to my repo — checkbox, default OFF. When checked, Turtini writes .github/workflows/turtini-deploy.yml to your repo on Connect (see linked article).
9. Click Connect & deploy

What happens behind the scenes:
• Turtini registers a webhook on the repo (push events only) with a per-site HMAC secret
• The first deploy runs synchronously — you see pass/fail in the modal
• Future pushes auto-deploy: webhook → HMAC verify → pull repo via GitHub Trees API → vulnerability scan → upload to per-site GCS bucket
• Deploys are atomic at file level: scan critical findings abort BEFORE any file lands in the bucket, so partial deploys can't happen
• A "GC" pass deletes files in the bucket that aren't in the new commit — no stale files

Limits (per deploy):
• 5_000 files
• 200 MB total bundle
• 25 MB per file
• 540s timeout (typical small sites: 5-10s)

Once connected, the site card shows:
• Hosted pill (emerald)
• Repository@branch link
• "Deploy now" button — manual re-pull without waiting for a webhook (useful for testing or recovery)
• Last deploy status, commit SHA, file count

To disconnect: from the site card, open the host menu and click Disconnect. Turtini deletes the GitHub webhook and removes the hostedSites doc. The exported files in the bucket can be optionally deleted at the same time.

Custom domain wiring (DNS): see the "Custom domains for hosted sites" article. tl;dr — your domain CNAMEs to hosted.turtini.com.