Your CI stops waiting on clones.
Every job that checks out a large repository spends its opening minutes pulling history it will never read. Point the checkout at a read-only, provably-fresh mirror and that step stops being the one you wait on — your deploy path survives an origin outage as well, and nobody changes a remote to get it.
Reads at the edge of your CI
Smart HTTP v2 for stock git ≥ 2.30, and SSH for runners that prefer it. Full clones stream as precomputed byte ranges; incremental fetches ship only the suffix your runner is missing;--depth 1 is served from a self-contained snapshot artifact.
A mirror is cloned constantly and pushed never, which is exactly where CDN offload pays best: opt a runner in with one git config and the bulk of every clone comes from the nearest edge instead of a node.
The freshness contract
A webhook lands your push on the mirror in seconds; a 60-second poll is the loss-recovery floor. If CI asks for a commit we don't have, we fetch it from origin synchronously within a bounded budget — or answer with an explicit 404 naming your origin. Origin down? Last-known state serves with X-Weft-Staleness set. Never a silent stale miss.
Setup is pasting a URL
Paste github.com/acme/widget and press check. A public origin mirrors immediately — no credentials, nothing to install. A private one leads you through installing the GitHub app once per organization, then shows you a list of the repositories that install can read, so you pick one instead of hunting for an installation id. The screen follows the first sync and ends on the clone command.
Read-only is a feature
Pushes to the mirror are rejected in-band —remote error: this mirror is read-only; push to the origin: … — so nothing about your write path, reviews, or permissions changes. Private repos stay private: fetches use short-lived installation tokens from your GitHub App grant.
The renewal artifact, built in
Per-repo clone p50/p99, bytes served, requests absorbed, and freshness lag — in the dashboard, over the API, and as CSV. The ROI case writes itself at renewal.