What problem does it solve? Migrating GitHub Actions workflows to Depot runners, accelerated caches, or container builds risks breaking matrices, reusable-workflow contracts, permissions, and publication pipelines when done as a naive label swap. This Skill enforces an evidence-driven, behavior-preserving migration process that blocks unsafe or unverifiable edits. ## Core Features & Use Cases - Complete workflow graph audit: Inventories triggers, permissions, environments, matrices, reusable callers and callees, expressions, cache steps, builds, and downstream consumers before any change. - Evidence-gated migration: Requires verified Depot App installation, repository scope, runner group, documented runner labels, and project/OIDC/registry evidence only where the affected seam needs it. - Transactional, drift-safe editing: Hashes every target, re-reads before mutation, blocks on concurrent drift, and leaves blocked paths byte-identical. - Security boundaries: Treats pull_request_target as privileged and blocks granting Depot, registry, or publication authority to untrusted execution. - Use Case: A team wants to move a multi-platform container publication workflow to Depot. The Skill traces per-platform digests through artifacts and manifest assembly, verifies the documented integration matches the existing shape, and applies a minimal patch only after all equivalence gates pass. ## Quick Start Audit this repository's GitHub Actions workflows and migrate eligible jobs to Depot runners while preserving all existing behavior.
