## `depot ci migrate`

Migrates GitHub Actions workflows to Depot CI. The command runs two phases: it validates your environment with a preflight check, then copies and transforms your selected workflows into `.depot/workflows/`.

```
depot ci migrate
```

After migration, the command reports any secrets and variables referenced by the migrated workflows and directs you to [`depot ci migrate secrets-and-vars`](/content/docs/cli/reference/depot-ci#depot-ci-migrate-secrets-and-vars/index.html) for importing them.

Each phase is also available as a standalone subcommand:

- [`depot ci migrate preflight`](/content/docs/cli/reference/depot-ci#depot-ci-migrate-preflight/index.html): validate authentication and repository access for the selected forge
- [`depot ci migrate workflows`](/content/docs/cli/reference/depot-ci#depot-ci-migrate-workflows/index.html): copy and transform workflows
- [`depot ci migrate secrets-and-vars`](/content/docs/cli/reference/depot-ci#depot-ci-migrate-secrets-and-vars/index.html): import secrets and variables into Depot CI

### Flags

| Flag | Description |
| --- | --- |
| `--yes`, `-y` | Migrate all discovered workflows and overwrite matching files under `.depot/` without prompting. |
| `--overwrite` | Overwrite matching files in an existing `.depot/` directory without prompting. |
| `--forge <forge>` | Forge that hosts the repository and sends CI events, `github` or `origin`. Default `github`. |
| `--org <id>` | Specify a Depot organization ID (required if you belong to more than one organization) |
| `--token <token>` | Depot API token |

Every `depot ci migrate` subcommand accepts `--forge` and `--yes`. Use `--forge=origin` for a native [Origin](/content/docs/ci/integrations/origin/index.html) repository. A repository that syncs with GitHub uses the default `github`. `--forge=origin` needs Depot CLI v2.102.7 or newer.

* * *

### `depot ci migrate preflight`

Validates that you are authenticated, detects the repository for the selected forge from your git remote, and checks the access required to migrate it.

```
depot ci migrate preflight
depot ci migrate preflight --forge=origin
```

With `--forge=github`, the command checks that the Depot Code Access GitHub App is installed with the correct permissions and repository access. If the app is not installed or needs updated permissions, the command prints a link to configure it.

With `--forge=origin`, the command checks that the Origin repository is available to your Depot organization, then prints the detected repository.

#### Flags

| Flag | Description |
| --- | --- |
| `--forge <forge>` | Forge that hosts the repository and sends CI events, `github` or `origin`. Default `github`. |
| `--yes`, `-y` | Run in non-interactive mode |
| `--org <id>` | Specify a Depot organization ID (required if you belong to more than one organization) |
| `--token <token>` | Depot API token |

* * *

### `depot ci migrate workflows`

Copies workflows from `.github/workflows/` into `.depot/workflows/`, applying Depot CI compatibility transformations and inline comments documenting any changes.

```
depot ci migrate workflows
```

#### What `depot ci migrate workflows` does

1. Discovers all workflow files in `.github/workflows/`.
2. Analyzes each workflow for compatibility with Depot CI.
3. Prompts you to select which workflows to migrate.
4. With `--forge=origin`, sends the selected workflow contents to Depot for Origin compatibility analysis.
5. Copies selected workflows and all other non-symlink files under `.github/workflows/` to `.depot/workflows/`, and copies local actions from `.github/actions/` to `.depot/actions/`.
6. Applies compatibility fixes (for example, mapping `ubuntu-latest` to `depot-ubuntu-latest`).
7. Disables jobs that use unsupported features and adds inline comments explaining what changed.
8. Reports any secrets and variables detected in the migrated workflows.

#### What gets copied

| Source | Destination |
| --- | --- |
| `.github/workflows/<selected>.yml` | `.depot/workflows/<selected>.yml` |
| `.github/workflows/<other-file>` | `.depot/workflows/<other-file>` |
| `.github/actions/` | `.depot/actions/` |

Other files can include helper scripts, configuration files, and non-workflow YAML files. The command preserves their relative paths and permissions, but skips symlinks.

#### Flags

With `--forge=origin`, the command also prints Origin compatibility findings for actions that Origin cannot support in the mode your workflow uses. Findings don't block the migration: Depot still writes the selected workflows. See [Origin compatibility findings](/content/docs/ci/integrations/origin#origin-compatibility-findings/index.html).

#### What gets transformed

The command applies three kinds of changes to migrated workflows, documented with inline comments:

- **`runs-on` labels** are remapped from GitHub runner labels (like `ubuntu-latest`) to their Depot equivalents.
- **Unsupported triggers** (like `release` or `issues`) are removed from the `on:` block with a comment explaining why.
- **Jobs with unsupported features** are commented out entirely, with a `DISABLED` comment noting the reason.
- **`.github/` path references** in copied workflow and action files are rewritten to their `.depot/` equivalents.

Each migrated file includes a header comment listing the source workflow and a summary of all changes made. For the full compatibility matrix, see [Compatibility with GitHub Actions](/content/docs/ci/compatibility/index.html).

* * *

### `depot ci migrate secrets-and-vars`

Creates a one-shot GitHub Actions workflow that reads secrets and variables from your GitHub repository and imports them into Depot CI.

```
depot ci migrate secrets-and-vars
```

By default, the command detects names in `.github/workflows/` and `.depot/workflows/`. It skips secrets named `GITHUB_TOKEN` or `DEPOT_TOKEN`, and variables named `DEPOT_TOKEN`.

The command commits a temporary branch containing a one-shot workflow, without touching your worktree, then prints the `git push` command for it. You push the branch yourself, and you have five minutes before the migration intent expires. Once pushed, the workflow runs, imports your existing secrets and variables into Depot CI, and removes the temporary remote branch.

With `--forge=origin`, the command detects the Origin remote instead of a GitHub remote, and reads the values from that repository.

#### Flags

| Flag | Description |
| --- | --- |
| `--yes`, `-y` | Accepted but has no effect. This subcommand runs without a preview or confirmation prompt. |
| `--forge <forge>` | Forge that hosts the repository and sends CI events, `github` or `origin`. Default `github`. |
| `--branch-prefix <prefix>` | Prefix for the temporary migration branch. The intent ID is appended. Default `depot-migrate-secrets-`. |
| `--secrets <name>` | Secret name to include; can be repeated to select multiple. Omit to include all. |
| `--vars <name>` | Variable name to include; can be repeated to select multiple. Omit to include all. |
| `--org <id>` | Specify a Depot organization ID (required if you belong to more than one organization) |
| `--token <token>` | Depot API token |

* * *

## `depot ci run`

Submits a workflow to Depot CI and starts a run against your local working tree, without requiring a push to GitHub first. It's the fastest way to test a workflow against changes you're actively working on.

```
depot ci run --workflow .depot/workflows/ci.yml
```

If you have local changes relative to your branch's remote state, the CLI automatically detects them and uploads a patch to Depot Cache. The CLI injects a patch-application step into each selected job that contains an `actions/checkout` step. For branches that exist on the remote, the patch contains only unpushed changes. For local-only branches, the patch is relative to the default branch.

The CLI detects GitHub, Origin, and [Depot Code](/content/docs/code/overview/index.html) repositories from your git remotes. For repositories mirrored into Depot Code, it defaults to GitHub or Origin. Use `--forge` to select a specific forge.

### Flags

| Flag | Description |
| --- | --- |
| `--workflow <path>` | Path to the workflow YAML file (required) |
| `--job <name>` | Job name to run; can be repeated to select multiple jobs. Omit to run all jobs. |
| `--ssh` | Start the run and connect to the job's sandbox via interactive terminal. Requires exactly one `--job`. |
| `--ssh-after-step <n>` | Insert an SSH debug session (via tmate) after the nth step (1-based). Requires exactly one `--job`. |
| `--follow`, `-f` | Stream the triggered run's logs once it starts. Cannot be combined with `--ssh` or `--ssh-after-step`. |
| `--repo <name>` | Repository to use instead of detecting one from git remotes |
| `--forge <forge>` | Repository forge: `github`, `origin`, or `depot` |
| `--org <id>` | Organization ID (required when user is a member of multiple organizations) |
| `--token <token>` | Depot API token |

### Run specific jobs

Pass `--job` one or more times to run a subset of jobs defined in the workflow:

```
depot ci run --workflow .depot/workflows/ci.yml --job build --job test
```

Jobs not listed are excluded from the submitted workflow. If a requested job name does not exist in the workflow, the command exits with an error listing the available jobs.

### Debug with SSH

Use `--ssh` to start the run and immediately connect to the job's sandbox via an interactive terminal:

```
depot ci run --workflow .depot/workflows/ci.yml --job build --ssh
```

Use `--ssh-after-step` to insert a [tmate](https://github.com/mxschmitt/action-tmate) debug session after a specific step in a single job. This lets you SSH into the runner at that point in the workflow to inspect state interactively.

```
depot ci run --workflow .depot/workflows/ci.yml --job build --ssh-after-step 3
```

Both `--ssh` and `--ssh-after-step` require exactly one `--job` to be specified. The two flags are mutually exclusive: pass one or the other, not both.

### Follow live logs

Use `--follow` (or `-f`) to stream the run's logs as soon as it starts, without a separate `depot ci logs` call:

```
depot ci run --workflow .depot/workflows/ci.yml --job test --follow
```

When you request a single `--job`, the command follows that job's logs. Otherwise it selects the job automatically when the run has only one, or prompts you to pick when several are running. `--follow` cannot be combined with `--ssh` or `--ssh-after-step`.