gha-to-semaphore

name: gha-to-semaphore description: Translate a repo's GitHub Actions workflows into an equivalent Semaphore pipeline. ONLY covers the GHA→Semaphore mapping and conversion procedure; for Semaphore-side depth (cache CLI, test-results, blocks structure, sharding, promotions) defer to the linked skills. Use when the user asks to convert/port/migrate GitHub Actions to Semaphore, says "translate this workflow" or "convert ci.yml", or the repo has .github/workflows/ and the user wants Semaphore instead. Can be invoked directly as /sem-ai:gha-to-semaphore (or via the broader /sem-ai:init orchestrator). user-invocable: true

Convert GitHub Actions to a Semaphore pipeline

Authoritative reference: docs.semaphore.io/getting-started/migration/github-actions. Mappings below extend it with constructs the migration guide doesn't cover (matrix, if:, reusable workflows, custom actions, on: triggers, sharding).

Scope of this skill: only the GHA→Semaphore translation friction. For Semaphore concepts referenced below, follow the cross-links — don't inline depth here.

Why this conversion usually shrinks YAML

Semaphore agents ship with the toolbox preinstalled. Most GHA uses: actions/...@v* setup boilerplate exists to install tools Semaphore already has on PATH. A 200-line GHA workflow usually becomes a 60–90 line Semaphore pipeline because each uses: setup collapses into a single prologue: line.

When drafting the translation, don't translate setup actions into equivalent apt-get install / curl | bash commands — assume the toolbox is on PATH and use its CLIs directly. See semaphore-toolbox for the full surface and probe-agent-environment to verify what's preinstalled if uncertain.

The three buckets

Every GHA construct lands in one of:

1. Direct mapping — there is a 1:1 Semaphore equivalent. Translate without asking.
2. Adapted mapping — Semaphore expresses the same idea with a different shape (e.g. matrix → parameterized jobs). Translate, but call out the shape change in the PR body.
3. Manual review — no clean equivalent (custom actions, reusable workflows, GHA-only payload contexts). Leave a # TODO(gha-to-semaphore): comment in the yaml and list the item in the PR body.

High-level shape mapping

Each row points at the skill that holds the Semaphore-side depth — read those for syntax, footguns, exact CLI arguments.

Runner mapping (runs-on → agent.machine)

Default when unclear: type: f1-standard-2, os_image: ubuntu2404.

Conditionals (if: → run.when)

Semaphore's run.when uses a different DSL. Conservative quick table:

When in doubt, leave # TODO(gha-to-semaphore): translate condition and surface in PR body.

Matrix (strategy.matrix → matrix or separate blocks)

• Single-axis matrices (e.g. go: ['1.21', '1.22']) → Semaphore matrix: on a job. Cleanest.
• Multi-axis where all axes map to the same agent → still a matrix: on the job (multiplies out).
• matrix.os with distinct OS images → split into separate blocks (one per OS) with different agent.machine.os_image.
• strategy.fail-fast and strategy.max-parallel have no direct equivalent — drop them; mention in PR body.

For job-level fan-out (run the same job N times on N agents to shard test work), use parallelism: N — see semaphore-blocks "Sharding one job across N parallel runs".

Secrets

GHA secrets.X implicitly assumes the secret exists. Semaphore secrets are explicit org-level resources, then bound to a task with secrets:.

Procedure:

1. Grep .github/workflows/* for every secrets.<NAME>. Dedupe.
2. For each, sem-ai secret create <NAME> --env <NAME>=<value> — the user supplies the value; never invent or copy from GHA.
3. In the translated yaml, attach at the lowest scope that needs it (block-level via task.secrets:).
4. List every required secret in the PR body so the user verifies they exist before merge.

See manage-infra for secret create flags and scoping.

Bucket-3 — manual review

Leave a # TODO(gha-to-semaphore): comment in the yaml and list each in the PR body:

• uses: <author>/<action>@v* (any non-actions/* custom action) — no equivalent. Rewrite as inline commands.
• uses: ./.github/actions/<name> (local composite actions) — same.
• Reusable workflows (uses: ./.github/workflows/<name>.yml) — Semaphore has promotions + pipeline files but no direct includes; case-by-case.
• services: with custom images (anything outside sem-service's supported list) — translate to docker run in a prologue.
• GitHub Pages / release actions (peaceiris/actions-gh-pages, softprops/action-gh-release, etc.) — use sem-ai deploy + gh release create equivalents.
• environment: (GitHub Environments) — approximate with Semaphore deploy targets + subject_rules (see manage-infra); GHA approval gates don't translate.
• workflow_dispatch.inputs.<X> beyond simple strings — promotion parameters cover string inputs; complex inputs: (choice with dynamic options, secrets-in-inputs) need rewrite. See semaphore-promotions.
• GHA expression contexts using github.event.* payload fields, vars.*, inputs.* beyond promotion params — Semaphore env vars differ; manual.
• permissions: (GITHUB_TOKEN scopes / OIDC id-token: write) — N/A on Semaphore; drop. Note any downstream features that depended on it (npm provenance, GitHub releases as the workflow user, OIDC for cloud deploys).
• concurrency: cancel-in-progress — partial via auto_cancel: at pipeline root; flag for review.

Procedure (8-step run sheet)

When invoked, do the following in order:

1. Inventory. ls .github/workflows/ — list every workflow. Confirm with the user which to convert (default: all).
2. Read each workflow and classify every construct using the buckets above.
3. Draft .semaphore/semaphore.yml (and .semaphore/<name>.yml for additional workflows). Apply the mapping table; use the linked skills for syntax details.
4. Speed-scan — for any test job that looks long-running (Cypress, Playwright, big Jest/RSpec/pytest), call out parallelism: N + the runner's native shard flag in the PR body and (optionally) apply it. See semaphore-blocks "Sharding". Don't auto-apply on first draft; surface as a suggestion.
5. Validate with sem-ai yaml validate --file .semaphore/semaphore.yml. Iterate until clean.
6. Bootstrap project if missing: sem-ai project create --skip-yaml (yaml already exists from step 3).
7. Secrets: list every required secret to the user; for each, run sem-ai secret create only after the user supplies the value.
8. Open PR on the user's fork with:
   • The new .semaphore/*.yml files
   • A PR body that includes:
     • "What was converted" — direct + adapted mappings, by block
     • "What needs your review" — bucket-3 items with line refs
     • "Secrets required" — list created via sem-ai secret create
     • "Differences in behavior" — fail-fast dropped, runner image picked, PR-trigger config moved server-side, etc.
     • "Speed suggestions" — sharding candidates flagged in step 4
9. First run: after merge, hand off to watch-after-push — find the run by commit_sha and sem-ai watch it to completion (project auto-detects from origin; pass --project only to override or when the repo maps to multiple). On any failure, drill in with sem-ai workflow list and sem-ai job log. Iterate.

PR body template

## Summary
Converts `<n>` GitHub Actions workflow(s) to Semaphore pipeline(s).
Original workflows untouched — both CI systems can run side-by-side.

## What was converted
- `<gha-workflow-1>.yml` → `.semaphore/semaphore.yml`
  - <block name>: <jobs and what they do>
  - …

## What needs your review
- <bucket-3 item, file:line, reason>
- …

## Secrets required (already created)
- `<SECRET_NAME>` — used by <block>

## Differences in behavior
- Runner: GHA `ubuntu-latest` → Semaphore `f1-standard-2 / ubuntu2404`
- `strategy.fail-fast` dropped (no equivalent)
- PR-trigger config moved to Semaphore project settings
- …

## Speed suggestions
- Cypress job has 58 specs — consider `parallelism: 4` + cypress-split plugin
- …

Output discipline

• Do not modify .github/workflows/* unless the user explicitly asks to deprecate GHA in the same PR.
• Do not invent secret values. Always ask.
• Do not push to upstream of an OSS repo. Fork to the user's namespace first; demo on the fork.
• Do not merge the conversion PR yourself — leave it open as the visible artifact for review.
• Bucket-3 = clear comment, not silent drop. # TODO(gha-to-semaphore): is the marker.

Out of scope (v1)

• Migrating GitHub Actions Marketplace plugins beyond the actions/* core set
• Multi-platform matrices that span Linux + macOS + Windows (Semaphore doesn't run Windows agents in most orgs)
• GitOps-flavored deploy workflows that depend on GHA OIDC (id-token: write)
• Auto-removing .github/workflows/* after migration — leave that to the user

Related skills

• semaphore-toolbox — checkout, cache, artifact, sem-version, sem-service, retry CLIs + footguns
• semaphore-test-results — test-results publish (epilogue rule, per-framework JUnit configs, pipeline aggregation)
• semaphore-blocks — blocks / tasks / jobs structure, dependencies, parallelism + sharding, status aggregation
• semaphore-promotions — deploy gates, promotion parameters, workflow_dispatch translation
• manage-infra — sem-ai secret create, deploy targets, agent types
• probe-agent-environment — verify what's preinstalled on the agent before adding install steps
• sem-ai project create — bootstrap before first push