Add --repo flag for repo-scoped CI secrets and variables

[121watts]

Summary

• Add --repo owner/name flag to depot ci secrets and depot ci vars subcommands (add, list, remove).
• Switch from depot.ci.v1 to the deployed depot.ci.v2 org/repo RPCs for secret and variable management.
• When --repo is omitted, behavior is unchanged (org-wide).

What was happening

The CLI could only manage org-wide secrets and variables. Repo-specific overrides had to be managed through the web UI.

What happens now

depot ci secrets add DB_URL --repo owner/repo --value "..." creates a repo-scoped secret that overrides the org-wide value at runtime. depot ci secrets list --repo owner/repo shows both org-wide and repo-specific entries with a scope column. Same pattern for variables.

Companion PRs:

• API: depot/api#3119 (merged)
• App: depot/app#2378

Made with Cursor

---

Note

Medium Risk
Medium risk because it changes how the CLI calls secret/variable management APIs (migrating to ci.v2) and adds new repo-scoped paths, which could impact configuration workflows if scoping or routing is incorrect.

Overview
Enables repo-scoped CI secrets and variables in the CLI via a new --repo owner/repo flag on depot ci secrets and depot ci vars (add, list, remove), including updated help text and output that shows a scope column when repo context is provided.

Switches secret/variable operations from depot.ci.v1 to depot.ci.v2 RPCs, adding org vs repo branching in pkg/api/ci.go (new Scope field in returned metadata and list calls that can return both org-wide and repo-specific entries when --repo is set).

^{Written by Cursor Bugbot for commit 7cd4c48. This will update automatically on new commits. Configure here.}

[linear]

DEP-3330 Allow secret/variable to apply to specific repo or all

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Stale v1 client constructors are now unused dead code
  • Removed the unused v1 client constructors newCISecretServiceClient and newCIVariableServiceClient as all API functions now use v2 clients.

Or push these changes by commenting:

@cursor push a9b7073dcb

Preview (a9b7073dcb)

diff --git a/pkg/api/ci.go b/pkg/api/ci.go
--- a/pkg/api/ci.go
+++ b/pkg/api/ci.go
@@ -103,11 +103,6 @@
 	return allRuns, nil
 }
 
-func newCISecretServiceClient() civ1connect.SecretServiceClient {
-	baseURL := baseURLFunc()
-	return civ1connect.NewSecretServiceClient(getHTTPClient(baseURL), baseURL, WithUserAgent())
-}
-
 func newCISecretServiceV2Client() civ2connect.SecretServiceClient {
 	baseURL := baseURLFunc()
 	return civ2connect.NewSecretServiceClient(getHTTPClient(baseURL), baseURL, WithUserAgent())
@@ -195,11 +190,6 @@
 	return err
 }
 
-func newCIVariableServiceClient() civ1connect.VariableServiceClient {
-	baseURL := baseURLFunc()
-	return civ1connect.NewVariableServiceClient(getHTTPClient(baseURL), baseURL, WithUserAgent())
-}
-
 func newCIVariableServiceV2Client() civ2connect.VariableServiceClient {
 	baseURL := baseURLFunc()
 	return civ2connect.NewVariableServiceClient(getHTTPClient(baseURL), baseURL, WithUserAgent())