Run remote workflows
Run workflows from git refs, understand versioning and resolution, and manage first-run consent.
Ref syntax
Remote workflow refs follow a go mod-style syntax:
host/owner/repo[/subpath][@ref]Examples:
cori run github.com/org/workflows/translate_product_sheets_fr
cori run github.com/org/workflows/translate_product_sheets_fr@v1
cori run github.com/org/workflows/translate_product_sheets_fr@v1.1.12
cori run github.com/org/workflows/translate_product_sheets_fr@a3f9c2dSee Reference: Remote refs for the full grammar.
Version resolution
| Ref | Resolves to |
|---|---|
No @ref | Highest semver tag |
@v1 | Highest tag matching v1.*.* |
@v1.2 | Highest tag matching v1.2.* |
@v1.1.12 | Exact tag (immutable) |
@a3f9c2d (7+ hex chars) | Exact commit SHA (immutable) |
Mutable refs (@v1, no ref) re-resolve to the latest matching version on each run. Immutable refs (exact tags, SHAs) always point to the same code.
Re-resolving with --update
By default, Cori uses the cached version of a ref. To force re-resolution:
cori run --update github.com/org/workflows/translate@v1First-run consent
The first time you run a workflow from a remote ref, Cori shows you what it's about to execute and asks for confirmation. This is a security feature — you're consenting to run code from an external source.
To skip the prompt (for CI or scripting):
cori run --yes github.com/org/workflows/translate@v1.1.12
# Or set the environment variable:
CORI_ASSUME_YES=1 cori run github.com/org/workflows/translate@v1.1.12--yes skips the consent prompt. Only use it with pinned immutable refs (exact tags or SHAs) where you know exactly what code will run.
Git authentication
Cori uses your existing git credential helper and SSH agent. It stores no git credentials itself. If you can git clone the repository, cori run can fetch from it.
Allowed hosts
By default, Cori allows refs from github.com, gitlab.com, and bitbucket.org. To add custom hosts, configure them in ~/.cori/config.toml:
[remotes]
hosts = ["github.com", "gitlab.com", "bitbucket.org", "git.mycompany.com"]Not in v1
There is no cori push, cori pull, or built-in git sync. Publishing a workflow means pushing it to a git repository with a version tag; sharing it means giving someone the ref. There is no hub or marketplace.