How to Push a Windsurf Project to GitHub

Windsurf is now called Devin Desktop. Cognition, the company behind it, shipped the rename on June 2, 2026 as a regular update and calls it the same IDE, with the same editor, extensions and keybindings. If your app lives in a folder on your computer, this guide gets it onto GitHub. Nothing uploads by itself: you publish once, then push whenever you want GitHub to catch up.

First, get to the editor

Devin Desktop puts the Agent Command Center front and center: a Kanban-style board of your local and cloud agent sessions. The classic editor is still there and fully accessible. Switch to the editor view first, because everything below happens in its Source Control view (which Devin Desktop's docs also call the Git panel).

What you need

Git on your computer (run git --version in Terminal > New Terminal, and install it from git-scm.com if that fails), your commit name and email set with git config --global user.name and git config --global user.email, and a free GitHub account.

Bring the agent's work home first

Agent sessions run in Worktree mode keep their edits in separate Git worktrees under ~/.windsurf/worktrees/, not in your project folder, and by default Devin Desktop doesn't show Cascade's worktrees in the Source Control view. Use the agent's Merge button to bring those changes into your main workspace before you commit, or they won't be in what you push.

With the Devin Local agent, you can select Quick Review before committing: a second agent reads the diff and flags correctness and style problems. Its SWE-check model is free on every plan.

Decide what Git should never see

Devin Desktop has its own ignore files, and they're easy to mix up with Git's:

Devin Desktop's indexing already skips .gitignore paths, node_modules and hidden files, but that never keeps a file out of a commit. Only .gitignore does. Before your first commit, make sure your project's .gitignore lists node_modules/, .env and .env*.local, plus any other env file holding secrets. GitHub's docs are blunt: never commit passwords or API keys.

Push your Windsurf project to GitHub

Rather type it?

Make an empty repository on GitHub (no README, license or .gitignore, which GitHub's docs say avoids errors) and copy its URL. Then, from your project folder:

git init -b main
git add .
git commit -m "First commit"
git remote add origin https://github.com/your-name/your-repo.git
git push -u origin main

Already initialized and committed in Steps 2 and 3? Start at git remote add. If your branch has a different name than main, put that name in the last line.

After the first push

Pushing is manual. Commits wait on your machine until you push them: More Actions (...) > Push in the Source Control view. Sync Changes pulls from GitHub first, then pushes.

Worktrees don't get your .env. Devin Desktop's docs note that each agent worktree gets a copy of your repository files, but not .env files or anything else Git doesn't track. That's why an agent in a worktree may not find your keys; a post_setup_worktree hook can copy them in.

A committed file stays committed. Adding .env to .gitignore after it went into a commit doesn't remove it. Git's docs point to git rm --cached <file> to stop tracking it. If it held a real key, rotate that key: GitHub's docs say revoking or rotating comes first.

Before you ship: what to check in the repo

Quick Review reads a diff. Before launch, read the repository as a whole for these:

1. Env files aren't on GitHub. Look for .env files on the repository page. If one is there, follow the steps above and rotate every key in it. Background: secret exposure.
2. Browser-visible variables hold nothing secret. Anything prefixed NEXT_PUBLIC_ or VITE_ ships to the browser, so secret keys (Stripe, AI providers, Supabase service role) stay on the server. See Secret API key exposed in client bundle.
3. Supabase tables have RLS and real policies. See Missing row level security and the Supabase RLS guide.
4. Server routes check the user and the input. See Auth check only in client code and Missing input validation.
5. Sign-in and AI routes have rate limits. See No rate limiting on sensitive endpoints.
6. A failure shows a message, not a blank screen. See Error handling in AI-built apps.

More for Windsurf apps: Windsurf to production: what to check first.

Where FinishKit fits

Quick Review checks the changes an agent just made; before launch, look at the whole codebase too. Install the FinishKit GitHub App, choose the repository it can access (private or public), and FinishKit reviews it across eight production readiness dimensions, then gives you a Finish Plan with the blockers first and the evidence for each. For a public repo, the free quick readiness check is a lighter first pass from just the URL.

Sources: Devin: Windsurf is now Devin Desktop, Devin Desktop FAQ, Devin Desktop: Agent Command Center, Devin Desktop: Worktrees, Devin Desktop: Quick Review, Devin Desktop: AI commit messages, Devin Desktop: .devinignore, VS Code: Source control quickstart, VS Code: Staging and committing changes, VS Code: Repositories and remotes, GitHub Docs: Adding locally hosted code to GitHub, GitHub Docs: Removing sensitive data from a repository, Git: gitignore, Vite: Env variables and modes, Next.js: Environment variables.