Add support for migrating from GitHub Enterprise Cloud with data residency (ghe.com)

[brianaj]

Summary

Adds support for using a GitHub Enterprise Cloud with data residency tenant (*.ghe.com) as the source of a repository migration in gh gei. Previously, the source could be github.com or GitHub Enterprise Server, but not a data residency tenant. The migration flow mirrors the existing GHES source path — the CLI calls the source tenant's migration APIs to generate an archive, downloads it, uploads to blob storage, and imports it on the target.

New CLI surface

A new --github-source-api-url option is available on:

• gh gei migrate-repo
• gh gei generate-script
• gh gei migrate-secret-alerts
• gh gei migrate-code-scanning-alerts

The value should be the API endpoint of the source data residency tenant, for example:

--github-source-api-url https://api.tenant.ghe.com

It can also be set via the GH_SOURCE_API_URL environment variable. --github-source-api-url and --ghes-api-url are mutually exclusive.

Example

gh gei migrate-repo \
  --github-source-org SOURCE_ORG \
  --source-repo SOURCE_REPO \
  --github-source-api-url https://api.tenant.ghe.com \
  --github-target-org TARGET_ORG \
  --target-repo TARGET_REPO \
  --target-repo-visibility private

If the target is also a data residency tenant, add --target-api-url and --target-uploads-url as usual.

Behavior

• Archive flow (default): mirrors the modern GHES (≥ 3.8.0) flow — start migration on source → poll for archive → the source-issued SAS URL is passed straight to the target migration. No local download / reupload happens by default; the target GEI importer downloads directly from the source's storage.
• Optional GHOS upload: passing --use-github-storage opts into the multipart upload path — the archive is downloaded locally and reuploaded to GitHub-owned storage before the target migration starts. Same behavior as --use-github-storage on modern GHES today.
• Version check: unlike GHES, data residency tenants aren't gated behind an older-version blob-credentials-required check. The CLI recognizes the api.<subdomain>.ghe.com URL shape and defaults to modern behavior (GHOS supported).
• Generated scripts: gh gei generate-script emits --github-source-api-url (rather than --ghes-api-url) for data residency sources so the generated migrate.ps1 runs cleanly.

What doesn't change

• --ghes-api-url behavior is untouched. Existing GHES source migrations continue to work exactly as before.
• Existing paths remain untouched: github.com → github.com, github.com → data residency, GHES → github.com, GHES → data residency.
• Target-side --target-api-url behavior is unchanged.
• download-logs, wait-for-migration, abort-migration don't need the new flag — the log URL is served by the target, not the source.

Testing

• Unit tests added for URL parsing/routing, mutual-exclusivity validation, version-check short-circuit, and generated-script output.
• Full existing unit test suite (1133 tests) continues to pass.
• New end-to-end integration test cell runs against a live data residency test tenant on every PR (added to the matrix in .github/workflows/CI.yml).
• Verified locally against a live data residency tenant: source archive export → download → GHOS upload → target import → SUCCEEDED.

Docs / release notes

• Updated README.md with a "Migrating from GitHub Enterprise Cloud with data residency" subsection.

• Added a RELEASENOTES.md entry.

• Did you write/update appropriate tests

• Release notes updated (if appropriate)

• Appropriate logging output

• Issue linked

• Docs updated (or issue created)

• New package licenses are added to ThirdPartyNotices.txt (if applicable)

[github-actions]

Unit Test Results

    1 files      1 suites   24s ⏱️
1 152 tests 1 152 ✅ 0 💤 0 ❌
1 153 runs  1 153 ✅ 0 💤 0 ❌

Results for commit 3a4ecf3.

♻️ This comment has been updated with latest results.

[Copilot]

Pull request overview

Adds GitHub Enterprise Cloud data-residency tenants as migration sources.

Changes:

• Adds --github-source-api-url and GH_SOURCE_API_URL support.
• Routes repository and alert migrations through the source tenant.
• Adds documentation, release notes, unit tests, and Proxima integration coverage.

Show a summary per file

File	Description
src/OctoshiftCLI.Tests/StringExtensionsTests.cs	Tests data-residency URL detection.
src/OctoshiftCLI.Tests/gei/Services/GhesVersionCheckerTests.cs	Tests version-check bypass.
src/OctoshiftCLI.Tests/gei/Commands/MigrateSecretAlerts/MigrateSecretAlertsCommandTests.cs	Verifies the new option.
src/OctoshiftCLI.Tests/gei/Commands/MigrateRepo/MigrateRepoCommandTests.cs	Verifies the new option.
src/OctoshiftCLI.Tests/gei/Commands/MigrateRepo/MigrateRepoCommandArgsTests.cs	Tests argument validation and routing.
src/OctoshiftCLI.Tests/gei/Commands/MigrateCodeScanningAlerts/MigrateCodeScanningAlertsCommandTests.cs	Verifies the new option.
src/OctoshiftCLI.Tests/gei/Commands/GenerateScript/GenerateScriptCommandTests.cs	Verifies the new option.
src/OctoshiftCLI.Tests/gei/Commands/GenerateScript/GenerateScriptCommandHandlerTests.cs	Tests generated source flags.
src/OctoshiftCLI.IntegrationTests/ProximaToGithub.cs	Adds end-to-end migration coverage.
src/Octoshift/Services/EnvironmentVariableProvider.cs	Exposes the source API environment variable.
src/Octoshift/Extensions/StringExtensions.cs	Detects data-residency API URLs.
src/gei/Services/GhesVersionChecker.cs	Bypasses GHES checks for cloud tenants.
src/gei/Commands/MigrateSecretAlerts/MigrateSecretAlertsCommandArgs.cs	Resolves and validates source URLs.
src/gei/Commands/MigrateSecretAlerts/MigrateSecretAlertsCommand.cs	Adds and forwards the option.
src/gei/Commands/MigrateRepo/MigrateRepoCommandHandler.cs	Routes archive migration through the source tenant.
src/gei/Commands/MigrateRepo/MigrateRepoCommandArgs.cs	Adds source URL configuration and validation.
src/gei/Commands/MigrateRepo/MigrateRepoCommand.cs	Adds and wires the option.
src/gei/Commands/MigrateCodeScanningAlerts/MigrateCodeScanningAlertsCommandArgs.cs	Resolves and validates source URLs.
src/gei/Commands/MigrateCodeScanningAlerts/MigrateCodeScanningAlertsCommand.cs	Adds and forwards the option.
src/gei/Commands/GenerateScript/GenerateScriptCommandHandler.cs	Emits the appropriate source flag.
src/gei/Commands/GenerateScript/GenerateScriptCommandArgs.cs	Adds source URL validation and defaults.
src/gei/Commands/GenerateScript/GenerateScriptCommand.cs	Adds and wires the option.
RELEASENOTES.md	Announces data-residency source support.
README.md	Documents data-residency migrations.
.github/workflows/integration-tests.yml	Adds Proxima integration jobs.
.github/workflows/CI.yml	Adds Proxima CI coverage.

Review details

Tip

Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 26/26 changed files
• Comments generated: 2
• Review effort level: Balanced

[Copilot]

Review details

Suppressed comments (1)

src/gei/Commands/MigrateRepo/MigrateRepoCommandHandler.cs:75

• For a data-residency source, the version check returns false, so this call reaches GHES-specific warnings in ValidateUploadOptions (for example, it says GHES 3.8 or Management Console credentials are being used). Those messages are incorrect for ghe.com; make the warnings source-aware or use storage-flow wording that applies to both source types.

        if (sourceApiUrl.HasValue() || args.GitArchivePath.HasValue())
        {
            ValidateUploadOptions(args, blobCredentialsRequired);

• Files reviewed: 26/26 changed files
• Comments generated: 4
• Review effort level: Balanced

[github-actions]

Package	Line Rate	Branch Rate	Complexity	Health
gei	81%	74%	682	✔
Octoshift	80%	70%	1993	✔
gl2gh	77%	70%	417	✔
bbs2gh	83%	78%	668	✔
ado2gh	71%	70%	749	➖
Summary	79% (8901 / 11275)	72% (2275 / 3165)	4509	✔

[mulana]

👍🏼