Depot CLI: Depot CI commands reference | CLI | Depot Docs
depot ci migrate
Migrates GitHub Actions workflows to Depot CI. The command runs two phases: it validates your environment with a preflight check, then copies and transforms your selected workflows into .depot/workflows/.
depot ci migrate
After migration, the command reports any secrets and variables referenced by the migrated workflows and directs you to depot ci migrate secrets-and-vars for importing them.
Each phase is also available as a standalone subcommand:
depot ci migrate preflight: validate authentication and repository access for the selected forgedepot ci migrate workflows: copy and transform workflowsdepot ci migrate secrets-and-vars: import secrets and variables into Depot CI
Flags
| Flag | Description |
|---|---|
--yes, -y |
Migrate all discovered workflows and overwrite matching files under .depot/ without prompting. |
--overwrite |
Overwrite matching files in an existing .depot/ directory without prompting. |
--forge <forge> |
Forge that hosts the repository and sends CI events, github or origin. Default github. |
--org <id> |
Specify a Depot organization ID (required if you belong to more than one organization) |
--token <token> |
Depot API token |
Every depot ci migrate subcommand accepts --forge and --yes. Use --forge=origin for a native Origin repository. A repository that syncs with GitHub uses the default github. --forge=origin needs Depot CLI v2.102.7 or newer.
depot ci migrate preflight
Validates that you are authenticated, detects the repository for the selected forge from your git remote, and checks the access required to migrate it.
depot ci migrate preflight
depot ci migrate preflight --forge=origin
With --forge=github, the command checks that the Depot Code Access GitHub App is installed with the correct permissions and repository access. If the app is not installed or needs updated permissions, the command prints a link to configure it.
With --forge=origin, the command checks that the Origin repository is available to your Depot organization, then prints the detected repository.
Flags
| Flag | Description |
|---|---|
--forge <forge> |
Forge that hosts the repository and sends CI events, github or origin. Default github. |
--yes, -y |
Run in non-interactive mode |
--org <id> |
Specify a Depot organization ID (required if you belong to more than one organization) |
--token <token> |
Depot API token |
depot ci migrate workflows
Copies workflows from .github/workflows/ into .depot/workflows/, applying Depot CI compatibility transformations and inline comments documenting any changes.
depot ci migrate workflows
What depot ci migrate workflows does
- Discovers all workflow files in
.github/workflows/. - Analyzes each workflow for compatibility with Depot CI.
- Prompts you to select which workflows to migrate.
- With
--forge=origin, sends the selected workflow contents to Depot for Origin compatibility analysis. - Copies selected workflows and all other non-symlink files under
.github/workflows/to.depot/workflows/, and copies local actions from.github/actions/to.depot/actions/. - Applies compatibility fixes (for example, mapping
ubuntu-latesttodepot-ubuntu-latest). - Disables jobs that use unsupported features and adds inline comments explaining what changed.
- Reports any secrets and variables detected in the migrated workflows.
What gets copied
| Source | Destination |
|---|---|
.github/workflows/<selected>.yml |
.depot/workflows/<selected>.yml |
.github/workflows/<other-file> |
.depot/workflows/<other-file> |
.github/actions/ |
.depot/actions/ |
Other files can include helper scripts, configuration files, and non-workflow YAML files. The command preserves their relative paths and permissions, but skips symlinks.
Flags
With --forge=origin, the command also prints Origin compatibility findings for actions that Origin cannot support in the mode your workflow uses. Findings don't block the migration: Depot still writes the selected workflows. See Origin compatibility findings.
What gets transformed
The command applies three kinds of changes to migrated workflows, documented with inline comments:
runs-onlabels are remapped from GitHub runner labels (likeubuntu-latest) to their Depot equivalents.- Unsupported triggers (like
releaseorissues) are removed from theon:block with a comment explaining why. - Jobs with unsupported features are commented out entirely, with a
DISABLEDcomment noting the reason. .github/path references in copied workflow and action files are rewritten to their.depot/equivalents.
Each migrated file includes a header comment listing the source workflow and a summary of all changes made. For the full compatibility matrix, see Compatibility with GitHub Actions.
depot ci migrate secrets-and-vars
Creates a one-shot GitHub Actions workflow that reads secrets and variables from your GitHub repository and imports them into Depot CI.
depot ci migrate secrets-and-vars
By default, the command detects names in .github/workflows/ and .depot/workflows/. It skips secrets named GITHUB_TOKEN or DEPOT_TOKEN, and variables named DEPOT_TOKEN.
The command commits a temporary branch containing a one-shot workflow, without touching your worktree, then prints the git push command for it. You push the branch yourself, and you have five minutes before the migration intent expires. Once pushed, the workflow runs, imports your existing secrets and variables into Depot CI, and removes the temporary remote branch.
With --forge=origin, the command detects the Origin remote instead of a GitHub remote, and reads the values from that repository.
Flags
| Flag | Description |
|---|---|
--yes, -y |
Accepted but has no effect. This subcommand runs without a preview or confirmation prompt. |
--forge <forge> |
Forge that hosts the repository and sends CI events, github or origin. Default github. |
--branch-prefix <prefix> |
Prefix for the temporary migration branch. The intent ID is appended. Default depot-migrate-secrets-. |
--secrets <name> |
Secret name to include; can be repeated to select multiple. Omit to include all. |
--vars <name> |
Variable name to include; can be repeated to select multiple. Omit to include all. |
--org <id> |
Specify a Depot organization ID (required if you belong to more than one organization) |
--token <token> |
Depot API token |
depot ci run
Submits a workflow to Depot CI and starts a run against your local working tree, without requiring a push to GitHub first. It's the fastest way to test a workflow against changes you're actively working on.
depot ci run --workflow .depot/workflows/ci.yml
If you have local changes relative to your branch's remote state, the CLI automatically detects them and uploads a patch to Depot Cache. The CLI injects a patch-application step into each selected job that contains an actions/checkout step. For branches that exist on the remote, the patch contains only unpushed changes. For local-only branches, the patch is relative to the default branch.
The CLI detects GitHub, Origin, and Depot Code repositories from your git remotes. For repositories mirrored into Depot Code, it defaults to GitHub or Origin. Use --forge to select a specific forge.
Flags
| Flag | Description |
|---|---|
--workflow <path> |
Path to the workflow YAML file (required) |
--job <name> |
Job name to run; can be repeated to select multiple jobs. Omit to run all jobs. |
--ssh |
Start the run and connect to the job's sandbox via interactive terminal. Requires exactly one --job. |
--ssh-after-step <n> |
Insert an SSH debug session (via tmate) after the nth step (1-based). Requires exactly one --job. |
--follow, -f |
Stream the triggered run's logs once it starts. Cannot be combined with --ssh or --ssh-after-step. |
--repo <name> |
Repository to use instead of detecting one from git remotes |
--forge <forge> |
Repository forge: github, origin, or depot |
--org <id> |
Organization ID (required when user is a member of multiple organizations) |
--token <token> |
Depot API token |
Run specific jobs
Pass --job one or more times to run a subset of jobs defined in the workflow:
depot ci run --workflow .depot/workflows/ci.yml --job build --job test
Jobs not listed are excluded from the submitted workflow. If a requested job name does not exist in the workflow, the command exits with an error listing the available jobs.
Debug with SSH
Use --ssh to start the run and immediately connect to the job's sandbox via an interactive terminal:
depot ci run --workflow .depot/workflows/ci.yml --job build --ssh
Use --ssh-after-step to insert a tmate debug session after a specific step in a single job. This lets you SSH into the runner at that point in the workflow to inspect state interactively.
depot ci run --workflow .depot/workflows/ci.yml --job build --ssh-after-step 3
Both --ssh and --ssh-after-step require exactly one --job to be specified. The two flags are mutually exclusive: pass one or the other, not both.
Follow live logs
Use --follow (or -f) to stream the run's logs as soon as it starts, without a separate depot ci logs call:
depot ci run --workflow .depot/workflows/ci.yml --job test --follow
When you request a single --job, the command follows that job's logs. Otherwise it selects the job automatically when the run has only one, or prompts you to pick when several are running. --follow cannot be combined with --ssh or --ssh-after-step.