Many of you already version your projects with Git. The hard part is everything after the commit: reviewing changes, testing them, and deploying the same version to dev, test and production gateways without manual exports or copying files around. Git Pro handles those steps.
What it does
Native integration with GitHub, GitLab and Gitea, whether cloud-hosted or self-hosted on your own network
Git workflow in the Designer: commit, push, pull and switch branches without leaving Ignition
Automated deployments: push to a branch or merge a pull/merge request, and the target gateway updates automatically
Pipeline-friendly: runs inside GitHub Actions, GitLab CI or Gitea Actions so you can add checks and approvals before anything reaches production
Environment promotion: the same versioned project moves from dev → staging → production
Full traceability: you always know which commit is running on which gateway, and rolling back is just a Git revert
Although it might be the easiest, I would not recommend exposing your Ignition gateway to internet if that is not already part of the applicative use case. If you still want to go down that path I'd recommend that you setup some network filtering to limit the exposure.
Having everything on-prem would be the ideal solution provided that you don't mind the extra hosting for the Git provider and the extra sys admin work involved.
Also establishing a VPN as proposed by @pturmel unfortunately doesn't seem possible with Github or Gitlab as SaaS.
If the callback points at a reverse proxy on the public internet, that only forwards (via VPN) appropriate API endpoints to the actual gateway, then I don't see why they couldn't be made to work.