Forge governance should be policy driven, and simple enough for anyone to setup.

It also helps if you can carry the same pattern across forges in case you migrate.

In a pipeline

gitlab-warden now ships chant migrate. Point it at .github/workflows/ and it emits GitLab CI.

The CI docs show it as a job that re-translates whenever a workflow changes:

migrate:translate:
  stage: governance
  image: node:22
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
      changes: [".github/workflows/*"]
  script:
    - npx @intentius/gitlab-warden migrate .github/workflows/
      -o migrated/
      --report migrate-findings.sarif
  artifacts:
    paths: [migrated/, migrate-findings.sarif]
    expire_in: 1 week

Migrate at your own pace. Keep the GitHub workflows as the source of truth for the transition window and let this job re-translate them on every change.

There’s a github-warden version too, if you want to run it from the other direction.

What maps in the migration

Not everything translates, and the warden never guesses. Anything lossy lands as a finding in the job log and in a SARIF report your reviewers can open.

Chant under the hood

chant migrate powers all the forge wardens.

Read more