Migrasi Jenkins → GitHub Actions: Enterprise SMB

TL;DR

• Scope migrasi: 240 Jenkins job di BUMN Jakarta, 14 service domain, 18 minggu kalender.
• Cost impact: Jenkins Rp 42 juta/bulan → GitHub Actions Rp 6 juta/bulan. ROI break-even di bulan ke-7.
• Ops time impact: 60 jam/bulan → 12 jam/bulan. SRE bandwidth dibebaskan untuk platform engineering.
• Verdict: Recommended kecuali Anda BUMN dengan on-prem mandatory absolut — kasus itu pilih GitLab CI self-host.

Konteks

Saya pimpin migrasi ini di BUMN energy Jakarta, periode Januari - Juni 2025 (18 minggu kalender). Sebelumnya BUMN ini jalankan Jenkins 6 tahun, accumulated 240 job (active 165, legacy 75 yang masih di-trigger occasional).

Sebelum migrasi, baseline:

• 2 Jenkins master (active + DR) di VM on-prem 8 vCPU 32GB
• 12 build agent (mix VM + Kubernetes ephemeral)
• 4 plugin custom developed in-house 2020-2023
• SRE allocation: 60 jam/bulan total (Jenkins ops + agent maintenance + plugin update + insiden)
• 6 P1 incident dalam 12 bulan sebelum migrasi (mostly plugin compat issue setelah update)

Konteks bisnis: tim engineering 22 dev, 14 service Java + Node + Python, deploy ke GKE Jakarta + on-prem VM mixed. Compliance: audit internal + audit eksternal tahunan (KAP big-4).

Driver migrasi

5 alasan formal yang masuk ke proposal:

1. Ops cost berlebih: SRE 60 jam/bulan Jenkins-related = Rp 18 juta/bulan opportunity cost
2. Plugin maintenance burden: 23 plugin pihak ketiga, 4 custom — total 35-45 jam/bulan update + compat fixing
3. Incident frequency: 6 P1/tahun = MTBF 2 bulan, tidak meet SLA internal IT 99,5%
4. Developer experience drag: rata-rata 2,4 jam/dev/minggu waktu nunggu pipeline + debug job Jenkins
5. Modernisasi: tim engineering juniorisasi, Jenkins skill scarce di pasar tenaga kerja Indonesia

Pricing baseline vs target

Jenkins baseline

Item	Cost/bulan
2 VM Jenkins master 8 vCPU 32GB	Rp 8,5 juta
12 build agent mix (8 VM, 4 K8s)	Rp 11,2 juta
Storage artifact (Nexus + log) 2TB	Rp 3,8 juta
Backup + DR replication	Rp 2,5 juta
SRE ops allocation 60 jam	Rp 16 juta (Rp 267 ribu/jam blended)
Plugin licenses (CloudBees-equivalent open)	Rp 0
Total	Rp 42 juta/bulan

GitHub Actions target

Item	Cost/bulan
GitHub Enterprise 25 seat (Rp 336 ribu/seat)	Rp 8,4 juta
Actions minute Linux ~30k menit × Rp 0,008	Rp 240 ribu
ARC self-host runner di K8s (3 pod)	Rp 2,1 juta
GHCR registry storage 500GB	Rp 240 ribu
Audit export ke Splunk (custom action)	Rp 0 (one-time engineering)
SRE ops allocation 12 jam	Rp 3,2 juta
Total	Rp 14,2 juta/bulan (tahun 1) → Rp 6 juta/bulan (tahun 2+, GitHub Enterprise didiskon volume)

Saving Rp 28-36 juta/bulan = Rp 336-432 juta/tahun. Break-even one-time migration cost (Rp 1,8 miliar engineering + procurement) di bulan ke-7 setelah cutover.

Plan + timeline aktual

Minggu 1-2: Inventory + classification

Audit semua Jenkins job:

• 240 job total
• 165 active (trigger dalam 90 hari terakhir)
• 75 legacy (no trigger 90+ hari — kandidat archive)

Classify by domain:

Domain	Job count	Complexity
Java service build + deploy	78	medium
Node service build + deploy	52	low
Python data pipeline	34	medium
Infrastructure (Terraform, Ansible)	18	high (plugin custom)
Database migration (Flyway)	12	low
Reporting + ad-hoc	46	low

Classify by criticality:

• P0 (block production deploy): 38 job
• P1 (block staging deploy): 67 job
• P2 (best-effort): 135 job

Minggu 3-6: Pilot

Pilih 8 service pilot mix complexity:

• 3 service Node simple (cocok untuk validate basic pattern)
• 2 service Java medium (validate Maven cache pattern)
• 1 service Python data pipeline (validate matrix job)
• 1 service dengan plugin custom (validate redesign approach)
• 1 service deployment ke on-prem VM via SSH (validate self-host runner)

Pilot deliverable:

• Workflow file template per stack (Node/Java/Python)
• Reusable workflow untuk deploy ke GKE + on-prem
• Composite action untuk plugin custom yang berhasil di-port
• Documentation runbook untuk SRE
• Dual-run paralel Jenkins + GitHub Actions 14 hari untuk validate equivalence

Lesson dari pilot:

• Reusable workflow penting: tanpa ini, 240 workflow file akan drift dalam 6 bulan
• Self-host runner untuk akses VPC private wajib — security mandate dari BUMN
• Caching Maven dependency butuh tuning: actions/cache dengan key per pom.xml hash

Minggu 7-14: Rollout per service

Strategi rollout: per service, bukan per job. Setiap service di-cutover lengkap dalam 1 sprint.

Sprint	Service migrated	Job migrated cumulative
Sprint 1 (W7-8)	2 service Node	22
Sprint 2 (W9-10)	3 service Java	56
Sprint 3 (W11-12)	3 service Python	82
Sprint 4 (W13-14)	4 service mixed + infra	132

Per service migrate pattern:

1. Port job Jenkins ke GitHub workflow (1-3 hari per service)
2. Dual-run 7 hari paralel, compare hasil
3. Cutover trigger: GitHub Actions menjadi primary, Jenkins backup
4. Monitor 7 hari, fix issue muncul
5. Disable trigger Jenkins (job tinggal di Jenkins untuk read-only audit)

Minggu 15-16: Legacy + cleanup

• 75 legacy job: archive metadata + log ke R2, delete dari Jenkins active
• 33 P2 job ad-hoc: convert ke workflow manual trigger di GitHub Actions
• Decommission 1 Jenkins master (keep 1 read-only)

Minggu 17-18: Validation + handover

• KAP audit pertama dengan GitHub Actions sebagai system of record CI/CD
• Documentation handover ke tim platform
• Retro + lesson learned

Tooling migrasi

1. Inventory tool

Saya tulis script Python untuk scrape Jenkins API:

• List all jobs + trigger frequency 12 bulan
• Extract Jenkinsfile content jika ada
• Classify by job type (freestyle, pipeline, multibranch)
• Output CSV untuk planning

Time invested: 3 hari, terpakai sepanjang migrasi.

2. Converter (manual + LLM-assisted)

Tidak ada converter Jenkins → GitHub Actions yang reliable di 2025 (saya test 3 tool open source, hasil 30-50% accuracy). Pendekatan akhir:

• Manual port untuk job kompleks (60% effort)
• LLM-assisted (Claude / GPT-4) untuk job standar — generate workflow draft, manual review (40% effort)
• Reusable workflow library yang saya curate sendiri

LLM-assisted save ~30% time dibanding full manual. Trade-off: hasil LLM perlu review ketat — sering miss edge case (timeout, retry policy, secret masking).

3. Dual-run validator

Custom script bandingkan output Jenkins vs GitHub Actions untuk job equivalent:

• Compare artifact hash
• Compare exit code
• Compare test report (JUnit XML diff)
• Alert kalau diverge

Run paralel 7 hari per service sebelum cutover. Tools ini menemukan 18 divergence — semua fix-able (mostly env variable behavior, timezone, locale).

Pattern arsitektural

Reusable workflow library

Saya bikin infra-workflows repository terpisah:

infra-workflows/
├── .github/
│   └── workflows/
│       ├── build-java.yml       # reusable
│       ├── build-node.yml       # reusable
│       ├── deploy-gke.yml       # reusable
│       ├── deploy-onprem.yml    # reusable
│       └── security-scan.yml    # reusable

Per-service workflow tinggal call:

jobs:
  build:
    uses: company/infra-workflows/.github/workflows/build-java.yml@v1
    with:
      service-name: payment-svc
      java-version: '21'
      deploy-target: gke-jakarta
    secrets: inherit

Centralized maintenance: bug fix di reusable workflow propagate ke semua service.

Self-host runner di ARC (Actions Runner Controller)

K8s deployment di GKE Jakarta untuk runner yang butuh akses VPC private:

• 3 base runner pod e2-medium
• Auto-scale up to 12 pod saat queue panjang
• Pod ephemeral (per-job lifecycle) — clean state, no cross-job leak

Cost: Rp 2,1 juta/bulan. Saves Rp 8 juta/bulan dibanding GitHub Larger Runner (yang tidak boleh akses VPC private kami anyway).

Audit log export

GitHub Actions audit event → webhook → Lambda parse → Splunk SIEM. Format CEF compliant standar SIEM. Engineering 4 hari, set-and-forget.

Sample event yang ter-export:

• workflow_run.completed (success/failure)
• deployment.created (per-environment deploy)
• check_run.completed
• workflow.requested (siapa trigger, dari mana)

KAP audit pertama post-migration: 0 finding terkait CI/CD. Auditor express satisfaction dengan format log GitHub yang ter-standarisasi.

Trade-off vs alternative

vs GitLab CI self-host

Saya consider GitLab CI sebagai alternative. Kenapa akhirnya pilih GitHub Actions:

Aspek	GitHub Actions	GitLab CI self-host
Setup time	2 minggu	4 minggu
Ops time/bulan	12 jam	25 jam
Vendor lock-in	sedang	rendah
Cost	Rp 6-14 juta/bulan	Rp 12-18 juta/bulan
Action ecosystem	18k+	~2k
Self-host runner	OK (ARC)	native superior
Audit / compliance	export via webhook	built-in
Compatibility on-prem-only	tidak	iya

Untuk BUMN energy ini, hybrid cloud OK (sudah jalankan GKE). GitHub Actions menang di ekosistem action + cost. Kalau on-prem-only mandate, pasti GitLab.

vs CircleCI / Buildkite

Tidak dipertimbangkan serius karena adopsi Indonesia rendah + pricing per-credit kurang predictable.

Risk + mitigation

Risk 1: Plugin custom tidak ada equivalent

Mitigation: redesign sebagai composite action atau reusable workflow. Untuk 2 plugin custom tightly coupled, redesign pattern (1 plugin = 1 workflow + 2-3 action). Lebih banyak file, tapi lebih portable.

Risk 2: Compliance audit terganggu saat transisi

Mitigation: keep Jenkins read-only 90 hari post-cutover. Audit auditor kasih dual-system access. Setelah Splunk export validated, decommission Jenkins.

Risk 3: Engineer resistance

Realita: 22 dev di BUMN, 12 sudah familiar GitHub Actions dari project sebelumnya, 10 perlu training. Training 4 jam workshop + buddy system 2 minggu. Resistance minimal karena DX improvement obvious (PR view inline log, no Jenkins UI navigation).

Risk 4: Secret migration

Mitigation: Vault Hashicorp tetap sebagai source of truth secret. GitHub Actions akses via OIDC, bukan secret langsung di GitHub. Pattern OIDC + Vault sigil pattern jadi standar pasca-migrasi.

Risk 5: Runner self-host insiden

Mitigation: ARC self-heal, multi-pod replica, monitor di Grafana. 1 insiden runner pool exhausted (Maret 2025) — quota dinaikkan, root cause sysctl tuning.

Outcome 6 bulan post-cutover

Metrik	Pre (Jenkins)	Post (GitHub Actions)
Cost/bulan	Rp 42 juta	Rp 6 juta
Ops time SRE/bulan	60 jam	12 jam
P1 incident dalam 6 bulan	3	0
Lead time commit-to-prod p99	28 menit	14 menit
Pipeline availability	99,2%	99,76%
Developer satisfaction (survey 1-10)	5,4	8,1

Saving Rp 36 juta/bulan × 12 = Rp 432 juta/tahun. Migration cost one-time ~Rp 1,8 miliar (engineering 4 orang 18 minggu + tooling + GitHub Enterprise procurement). Break-even bulan ke-7. Net positive tahun ke-2 onwards.

Common pitfall

1. Big-bang cutover. Saya tidak pakai. Per-service rollout dengan dual-run validation membatasi blast radius insiden. Big-bang = high risk untuk migrasi sebesar ini.
2. Tidak ada reusable workflow. Tanpa centralized library, 240 workflow file drift dalam 6 bulan. Mandatkan reusable pattern sejak pilot.
3. Skip dual-run. Jenkins → GitHub Actions ada divergence behavior (env, timezone, locale). Dual-run 7 hari minimum per service catches divergence.
4. Self-host runner di VM tanpa auto-scale. Pakai ARC di K8s untuk auto-scale + ephemeral pod. VM static = waste + maintenance burden.
5. Tidak invest di audit export. Compliance regulated wajib audit trail. Setup Splunk export di pilot phase, jangan tunggu pasca-cutover.

Yang surprising

Saya kira plugin custom akan jadi blocker terbesar. Realita: redesign jadi action pattern actually lebih clean dari plugin Jenkins. Plugin Jenkins terikat ke Item API yang kaku, action pattern lebih composable.

Surprise lain: developer satisfaction naik dari 5,4 ke 8,1 — lebih besar dari ekspektasi saya. Bottleneck DX Jenkins ternyata bukan feature tapi UI latency (Jenkins UI lambat di tim yang sering review pipeline log). GitHub Actions inline log di PR page jauh lebih cepat akses, ini saja sudah game-changer.

Verdict

Recommended untuk migrasi Jenkins → GitHub Actions di enterprise SMB Indonesia.

• Eligible: tim engineering 10-50 dev, sudah di GitHub.com (atau migrate ke GitHub bersamaan), hybrid cloud OK, budget migration Rp 1-3 miliar one-time.
• Tidak eligible: BUMN dengan on-prem absolute mandate (regulasi sektoral) → pilih GitLab CI self-host. Atau tim < 5 dev (Jenkins masih cukup, migrasi overkill).
• Wajib siapkan: reusable workflow library, self-host runner untuk akses VPC private, audit log export ke SIEM, 14 minggu kalender minimum.

Saving cost Rp 36 juta/bulan + ops time 48 jam/bulan adalah angka real, terbukti di BUMN energy saya. ROI clear, eksekusi disiplin = success rate tinggi.