Deploying without GitHub: ZIP upload as a first class source

Every deploy platform on the planet starts the same way. Connect your GitHub account. Pick a repository. Pick a branch. The whole experience assumes that your code lives in a Git repository on GitHub, owned by you, with a public or accessible build pipeline. For most professional developers that is a fine assumption. For everyone else, it is a wall.

We talk to a lot of users who do not look like the GitHub user. They are non technical founders who built a frontend in Lovable or v0. They are indie hackers who shipped a quick prototype from Cursor straight to a local folder. They are designers who paid an agency to build them an app, received a folder over Dropbox, and have no idea what a pull request is. For all of these people, the first step on most platforms is "create a GitHub account, learn git, push your code, then come back". That is three days of yak shaving before they can even try to deploy.

So we built ZIP upload as a first class source on Eigon. Drag a .zip file into the dashboard, give your project a name, click deploy. The same pipeline that handles GitHub repositories takes over from there. Same auto detection, same build, same infrastructure, same dashboard.

What "first class" actually means

A lot of platforms technically support a ZIP upload via some hidden CLI command or API endpoint. We did not want that. ZIP upload had to feel exactly as good as connecting GitHub or it was not worth shipping. Three things had to be true.

One source per project, always. A project is either a GitHub repository or an uploaded ZIP. Never both. We enforce this at the database level with a CHECK constraint, so there is no possible state where the system gets confused about where to pull code from. You can switch back and forth at any time and the switch is atomic.

Versioning that survives bad luck. Every upload becomes a versioned object in S3 with a timestamped key. If two team members upload at the same time, neither can clobber the other. We compute the next version inside the same atomic update that flips the project to use the new bytes, so even simultaneous uploads pick distinct slots.

The build pipeline does not care. CodeBuild, our build executor, branches at the very first step. If the project source is GitHub, it does a shallow git clone. If the project source is ZIP, it pulls the latest version from S3 and extracts it. Every downstream step (Dockerfile detection, image build, ECR push, CloudFormation template, ECS deployment) is identical from there.

How the upload itself works

The dashboard accepts .zip files via a drag and drop modal. We check the magic bytes (the first four bytes of any zip file are PK\x03\x04) so renaming a tarball does not slip through. We reject zip slip attacks by sanitising every entry path against the extraction root. Once validated, we stream the bytes straight to S3 with a multipart upload so very large bundles do not blow up memory in our control plane.

The moment the upload finishes, we trigger the same analyze pipeline that runs on a fresh GitHub connect: framework detection, language detection, entry point inference, port discovery. By the time you click back to your project page the build is already running and the dashboard is showing live progress.

Why this matters

Every PaaS platform that requires GitHub locks out a chunk of its audience. Some of those people will eventually learn git, but most will give up and go back to a $5 droplet, or worse, never deploy at all. ZIP upload is the cheapest possible escape hatch for that audience: zero new tools, zero new accounts, just the file you already have.

For experienced developers, ZIP upload is also surprisingly useful. It is the easiest way to deploy a snapshot of a private codebase to show a client, without giving them access to your repository. It is also a great test for "does my app even work in a clean environment" before you wire up CI.

Long term, our goal is that anyone with a folder of code can have it running on production AWS infrastructure in under ten minutes. ZIP upload is one of the unlocks. The CLI is another. The dashboard is the third. Pick whichever surface fits your moment.