Remote refs reference
Full syntax and resolution rules for git-based remote workflow references.
Syntax
host/owner/repo[/subpath][@ref]All three components — host, owner, repo — are required. Subpath and ref are optional.
Examples:
github.com/org/workflows
github.com/org/workflows/translate_product_sheets_fr
github.com/org/workflows/translate_product_sheets_fr@v1
github.com/org/workflows/translate_product_sheets_fr@v1.1.12
github.com/org/workflows/translate_product_sheets_fr@a3f9c2d
git@github.com:org/workflows.git/translate_product_sheets_fr@v1.0.0Resolution rules
| Ref form | Resolves to |
|---|---|
No @ref | Highest semver tag in the repository |
@v1 | Highest tag matching v1.*.* |
@v1.2 | Highest tag matching v1.2.* |
@v1.1.12 | Exact tag — immutable |
@a3f9c2d (7+ hex characters) | Exact commit SHA — immutable |
Prefix matching (@v1, @v1.2) re-resolves to the latest matching version on each run (unless cached — use --update to force re-resolution).
Immutable refs (exact semver tags, SHAs with 7+ characters) always resolve to the same code. Use immutable refs in production and CI.
Re-resolving with --update
cori run --update github.com/org/workflows/translate@v1Without --update, Cori uses the cached version. --update forces a fetch of the latest matching version.
SSH form
git@github.com:org/workflows.git/translate@v1.0.0Cori supports the SSH git URL form. Uses your SSH agent for authentication.
Trust and consent
The first time you run from a remote ref, Cori shows you the workflow manifest and asks for your confirmation. This is a security feature — you're consenting to execute code from an external source.
Pin information is stored in ~/.cori/cache/remote/pins.json. Trust decisions are in ~/.cori/cache/remote/trust.json.
To skip the prompt:
cori run --yes github.com/org/workflows/translate@v1.1.12
# or
CORI_ASSUME_YES=1 cori run github.com/org/workflows/translate@v1.1.12Only skip consent for immutable refs where you know exactly what code is being run.
Allowed hosts
Default allowed hosts: github.com, gitlab.com, bitbucket.org.
To add custom hosts:
# ~/.cori/config.toml
[remotes]
hosts = ["github.com", "gitlab.com", "bitbucket.org", "git.mycompany.com"]Or via cori config:
cori config set remotes.hosts '["github.com", "gitlab.com", "git.mycompany.com"]'Authentication
Cori uses your existing git credential helper and SSH agent. It stores no git credentials itself. Any repository you can git clone can be used as a remote ref source.