Wen Ping

Posted on Oct 29 Originally published at anguskit.com

After you import GitHub Actions: check events, secrets, and the runner

#cicd #angusgit

This article explains the difference, after you paste a GitHub Actions workflow into Import GitHub Actions and click Convert, between the YAML still unsaved in the dialog and the workflow you pasted. After reading it, you can compare Unmapped (needs a manual edit) and Notes, fix the trigger, the secret, and the runner (the program on a build machine that runs the job), and then create the pipeline. A name such as REPO_TOKEN has to exist as a credential. You create that credential yourself. Below, the converted YAML that has not been saved yet is the draft, and the workflow you pasted is the original file.

Sign in to AngusGit first. Pipelines are available on Team and Enterprise. Community has no CI/CD menu. In the sidebar, open CI/CD → Pipelines, click New Pipeline, and choose Import GitHub Actions. Create the secret yourself: open CI/CD → Settings, switch to Credentials, and click New Credential. Name is the name in the workflow, for example REPO_TOKEN, and it cannot be changed after you create it. Type is Credential text. Visibility is Selected repositories. Under Bound repositories, select this repository. Paste the token into Value. After you save, the plaintext cannot be viewed again. The sample in this article converts to runner.mode: NATIVE and the label ubuntu-latest. NATIVE runs the commands directly on the runner’s machine. If you do not have that runner yet, open CI/CD → Runners, click Add Runner, and click Generate token (it lasts 1 hour and is shown only once). Open the Zip install tab, set the label to ubuntu-latest, and do not add docker. A docker label makes this a DOCKER runner, which starts a container and will not pick up this job. Copy the command onto the build machine and run it. Create the pipeline after the list shows Idle.

Files under .github/workflows/ do not run on AngusGit, so the import dialog is the path. The dialog says: “Maps a subset to AngusCICD YAML. Marketplace actions and hosted runs-on images are not fetched — check the unmapped list.” Pipelines are available on Team and Enterprise. Community has no CI/CD menu.

1. Import first, then read the draft

Open the import dialog

Open CI/CD → Pipelines, click New Pipeline, and choose Import GitHub Actions. Under that menu item the hint is “Some syntax is converted automatically — review after import”.

Paste the workflow and convert

The default tab is Paste YAML (the other tab is Scan repository). The field label is GitHub Actions workflow, and the placeholder is “Paste .github/workflows/.yml”. Paste the workflow below and click **Convert*.

Read the lists, then decide whether to create

The result appears under the input, in this order: the two lists, Pipeline name, then the YAML. Opened from the pipeline list, the button at the lower right is Create Pipeline. Opened from the blank create page, the same place is Apply to editor. If you have not finished the lists, click Cancel. The repository keeps no pipeline.

The sample workflow is:

name: CI
on:
  push:
    branches: [main]
  pull_request:
    types: [opened, synchronize]
jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: "21"
      - name: Build
        run: mvn -B verify
      - name: Publish
        if: github.ref == 'refs/heads/main'
        run: ./publish.sh
        env:
          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}

After convert, the middle of the dialog scrolls to the two lists. The title and the lower-right Cancel and Create Pipeline stay in place. The unmapped list shows:

on.pull_request.types
jobs.build.steps[2].uses=actions/setup-java@v4 (a Marketplace or remote Action is not downloaded)
jobs.build.timeout-minutes (job timeout is not modeled, so it was not copied onto the step)

Notes shows:

jobs.build.runs-on mapped to NATIVE; GitHub-hosted images such as ubuntu-latest are not pulled
Skipped actions/checkout@v4: AngusGit checks out the workspace
github.ref → ref (the value is the branch name, not refs/heads/...)
secrets.X → env.X, and added to the job secrets list; a repository credential with the same name must exist

Those notes mean: runs-on is mapped to NATIVE and no GitHub-hosted image such as ubuntu-latest is pulled; actions/checkout@v4 is skipped because AngusGit checks out the workspace; github.ref becomes ref and the value is the branch name, not refs/heads/...; secrets.X becomes env.X and the name is written into the job secrets list, and a credential with the same name must already exist for the repository.

The converted draft in the editor is:

version: '1'
name: CI
triggers:
- 'on': push
  branches:
  - main
- 'on': pull_request
pipeline:
  build:
    runner:
      mode: NATIVE
      labels:
      - ubuntu-latest
    steps:
    - name: Build
      run: mvn -B verify
    - name: Publish
      if: ref == 'refs/heads/main'
      env:
        REPO_TOKEN: ${{ env.REPO_TOKEN }}
      run: ./publish.sh
    secrets:
    - REPO_TOKEN

The name is filled in as CI. 'on' is quoted so YAML does not treat on as a boolean. This is the converted draft. Finish the four sections below before you create it.

2. Did the trigger change?

GitHub Actions	Converted draft	What you do
`push` with `branches: [main]`	`on: push`, and `branches: [main]` is kept	Leave this line as it is
`types` on `pull_request`	The trigger is only `on: pull_request`, with no `branches`	`types` is unmapped. This sample has no `branches` under `pull_request`, so the draft does not limit the target branch
`pull_request_target`	Becomes `on: pull_request`	The unmapped line is `on.pull_request_target → pull_request (the permission model is different)`, meaning the permission model is different. This sample does not use it
`tags` under `push`	An extra `on: tag`	The filter is unmapped. The line is `on.push.tags filter was not mapped (only the tag trigger is kept)`, meaning only the tag trigger is kept
`release`	Becomes `on: tag`	When `types` is present, the line is `on.release.types was not mapped`. This sample does not use it
`workflow_dispatch`	`on: workflow_dispatch`, and the inputs are kept	This sample does not use it
`schedule` with `cron`	Written as `on: schedule` with the original `cron`	The cron is recorded and refreshed about every 60 seconds. This sample has no schedule, so the draft has none

on: push responds only to git push. Clicking merge on the pull request page does not fire another push. When main can be updated only through a pull request, the check before merge depends on pull_request.

3. Did the secret become a credential?

${{ secrets.REPO_TOKEN }} is rewritten as ${{ env.REPO_TOKEN }}. The name sits under the job’s secrets, not under credentials. At run time the platform looks up a credential by that name. If it is missing, hidden from this repository, or expired, the job fails with Credential not visible or expired.

Import does not create the credential. To let the publish step read the token, follow the start of this article: under CI/CD → Settings → Credentials, create one named REPO_TOKEN, choose type Credential text, and set visibility to Selected repositories. Keep the token out of repository files.

GITHUB_TOKEN is supplied automatically by GitHub. AngusGit has no built-in credential with that name. Change a step that uses it to your own credential, or remove the step.

4. Where did runs-on and Marketplace Actions go?

ubuntu-latest did not become a hosted machine. The draft is runner.mode: NATIVE, with the label ubuntu-latest. That means “run directly on a runner that has this label.” With no such runner, the job stays queued. Follow the start of this article and connect one with Zip install, and set the label to ubuntu-latest. The note says a GitHub-hosted image is not pulled. A job that wrote container becomes DOCKER, and the image name comes from container. This sample has no container.

actions/setup-java@v4 was removed. The unmapped line is jobs.build.steps[2].uses=actions/setup-java@v4 (a Marketplace or remote Action is not downloaded), so JDK and Maven are not installed.

actions/checkout@v4 was skipped. The note is Skipped actions/checkout@v4: AngusGit checks out the workspace. You do not add that step back. The checkout is a shallow clone, depth 1: only the commit that started this run, with no history and no tags. The workflow cannot turn that off.

The job’s timeout-minutes: 20 did not become 1200 seconds. The unmapped line says the job-level timeout is not modeled and is not written onto a step. Put the timeout on the step. A step timeout-minutes is multiplied by 60, or you write timeout in seconds.

With those differences, you can change the draft to the YAML below before you save. The image is the platform image repo.anguskit.com/docker-public/angus-ci-maven:21, which includes JDK 21 and Maven. This is the hand-edited result, not the draft the importer produced:

version: "1"
name: CI
triggers:
  - "on": push
    branches: [main]
  - "on": pull_request
    branches: [main]
pipeline:
  build:
    runner:
      mode: DOCKER
      image: repo.anguskit.com/docker-public/angus-ci-maven:21
      labels: ["linux", "docker"]
    steps:
      - name: Build
        run: mvn -B verify
        timeout: 1200
  publish:
    needs: [build]
    if: event == 'push' && branch == 'main'
    secrets: ["REPO_TOKEN"]
    runner:
      mode: DOCKER
      image: repo.anguskit.com/docker-public/angus-ci-maven:21
      labels: ["linux", "docker"]
    steps:
      - name: Publish
        run: ./publish.sh

Compared with the converted draft, these are the edits:

pull_request gains branches: [main]. The original file only wrote types, so the draft does not limit the target branch.
The run mode becomes a container, and the labels become linux and docker. The job no longer needs a host labeled ubuntu-latest. If the private network cannot pull this image, use your own internal image name.
The 20 minutes are written as timeout: 1200 on the Build step. That conversion is manual. Import does not turn a job-level timeout into this number.
Publish is a separate job, and the condition is on the job. A job if can read branch, ref, commitSha, and event. Both ref and branch are the branch name, such as main, not refs/heads/main. The draft left the condition on the step as ref == 'refs/heads/main'. A step if can read environment variables and success or failure status. It cannot read ref.
secrets is still REPO_TOKEN. The two jobs do not share a working directory. publish.sh cannot assume build left a target/ directory behind.

5. Details still to change in the script

The checkout has one commit. The log contains clone=shallow depth=1, so git describe --tags and a changelog built from history are missing data. Read the version from a project file, or pass it in through a workflow_dispatch input.

github.ref became ref, and the value is the branch name. The note is github.ref → ref (the value is the branch name, not refs/heads/...). github.sha becomes commitSha, github.event_name becomes event, and github.ref_name becomes branch. If any other github. remains, the note is github.* context remains; the runtime does not inject a GitHub object, meaning a GitHub context object is not injected at run time. Scripts can use the environment variables GIT_REPO_URL, GIT_BRANCH, and GIT_COMMIT_SHA.

What you see	Why	What to do
The job stays queued	No runner has the label `ubuntu-latest`, and the mode is `NATIVE`	Switch to a container run, and use labels the runner actually has, such as `linux` and `docker`
`java: command not found`	`setup-java` is unmapped, so Java was not installed	Use an image that already includes a JDK
`Credential not visible or expired`	`secrets` lists `REPO_TOKEN`, and the credential store has no such item	Create a credential with that name, as in section 3
The publish step is skipped, or it runs when it should not publish	The step `if` cannot read `ref`, and the right-hand side is still `refs/heads/main`	Split it into its own job, and write the condition as `branch == 'main'`
`git describe` cannot find a tag	The shallow clone depth is 1	Use a version that does not depend on history
A pull request whose target is not `main` also triggers	The draft `pull_request` has no `branches`	Add `branches: [main]`

Common questions

A repository has several workflow files. What do I do?

Import each file once. Each file becomes its own pipeline. After you confirm it runs, put the YAML under .anguscicd/, for example .anguscicd/ci.yaml. If you only convert and do not click create, the repository does not get that pipeline.

Should I delete .github/workflows/?

AngusGit does not run that directory. Leaving it in place has no effect. Clean it up after the new pipeline is stable.

Can a composite Action I wrote be converted?

uses: ./your-own-directory is kept as a local composite Action. A remote address such as actions/setup-java is not fetched. It shows up in the unmapped list. Expand the commands inside it into ordinary run steps.

Will a schedule run?

Yes. The cron inside schedule is written as on: schedule. This sample has no schedule, so the draft has none. That absence means this sample had no schedule. It does not mean a converted schedule stays idle.

Summary

After you paste the sample into Import GitHub Actions, the converted draft is named CI. push keeps branches: [main]. pull_request drops types and has no branch limit. ubuntu-latest becomes NATIVE plus the same label. setup-java and the job-level 20-minute timeout are in the unmapped list, and checkout is skipped. secrets.REPO_TOKEN is written into the job secrets, and you create the credential yourself. The step condition if: ref == 'refs/heads/main' does not mean “publish only on main.” Create the pipeline after the check. Save the edited YAML, not the untouched draft.

Conclusion: Import GitHub Actions gives you a draft that still needs hand edits. Before you save, add a branch to pull_request, replace NATIVE / ubuntu-latest with a container runner whose image already has a JDK, move the job timeout onto the step, and change the publish condition to the job-level branch == 'main'. Create a credential named REPO_TOKEN. Import leaves that credential for you to create.

DEV Community