failed to add CI variable: unauthenticated: Invalid token

[cedws]

We are trying to import our GHA secrets and variables into Depot CI.

The migrate secrets-and-vars subcommand fails when it tries to automatically create the workflow. Although there's no debug mode to confirm, I suspect behind the scenes it's failing to push because of a branch name ruleset we have.

$ depot ci migrate secrets-and-vars

This will push a GitHub Actions workflow to ClearToken/core on a temporary branch.
The workflow runs immediately, reads your existing secrets and variables,
and imports them into Depot CI. The branch is safe to delete afterwards.

Error: failed to import secrets and variables: internal: internal error

Instead I copied the workflow it generated and manually pushed it to a branch.

The workflow fails and says that the Depot token is invalid:

Error: failed to add CI variable: unauthenticated: Invalid token
Error: Process completed with exit code 1.

The repository this workflow ran in has a DEPOT_TOKEN secret and it's a valid token. I created this token under Organization settings in the UI.

Depot CLI version:

depot version 2.101.31 (2026-03-25)
https://github.com/depot/cli/releases/tag/v2.101.31

[lukevmorris]

Hi @cedws thanks for submitting the issue! Yes, we've seen a handful of similar errors where our branch name runs afoul of branch protection rules. We've just changed the format of the branch name - would you mind giving it another try?

We expect authentication to fail if you try to push the workflow manually -- for security reasons, we want to limit this operation to our app, and so we disallow other forms of authentication that would otherwise be present in our users' existing CI workflows.

[cedws]

I've tried again but it failed to create the workflow again - I already had the latest CLI version.

[lukevmorris]

Hi @cedws I have some telemetry for that request, but unfortunately all GitHub tells us is that the request to create the branch failed with Reference update failed. I'm still assuming this has to do with the format of our branch name, and so I've just released v2.101.35, which should allow you to specify your own branch name. It also wires through a more meaningful error message from the api.

[cedws]

Thanks, used --branch to override the branch and the workflow was ran successfully.