{"id":51450784,"url":"https://github.com/olafkfreund/bifrost","last_synced_at":"2026-07-05T20:30:25.659Z","repository":{"id":363820139,"uuid":"1264931742","full_name":"olafkfreund/bifrost","owner":"olafkfreund","description":"Orchestration + intelligence layer for Azure DevOps → GitHub Actions migration at portfolio scale — review-first, air-gap capable, attestation-native. Wraps gh actions-importer / GEI.","archived":false,"fork":false,"pushed_at":"2026-06-10T12:56:56.000Z","size":111,"stargazers_count":0,"open_issues_count":63,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-10T14:23:04.793Z","etag":null,"topics":["azure-devops","ci-cd-migration","devops","github-actions","llm","migration-tool","rust"],"latest_commit_sha":null,"homepage":"https://olafkfreund.github.io/bifrost/","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/olafkfreund.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":"docs/roadmap.md","authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-06-10T10:01:15.000Z","updated_at":"2026-06-10T12:57:00.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/olafkfreund/bifrost","commit_stats":null,"previous_names":["olafkfreund/bifrost"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/olafkfreund/bifrost","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/olafkfreund%2Fbifrost","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/olafkfreund%2Fbifrost/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/olafkfreund%2Fbifrost/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/olafkfreund%2Fbifrost/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/olafkfreund","download_url":"https://codeload.github.com/olafkfreund/bifrost/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/olafkfreund%2Fbifrost/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35168795,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-05T02:00:06.290Z","response_time":100,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["azure-devops","ci-cd-migration","devops","github-actions","llm","migration-tool","rust"],"created_at":"2026-07-05T20:30:22.922Z","updated_at":"2026-07-05T20:30:25.644Z","avatar_url":"https://github.com/olafkfreund.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003cdiv align=\"center\"\u003e\n\n# Bifrost\n\n**The bridge between worlds — Azure DevOps · Jenkins · GitLab → GitHub Actions, at portfolio scale.**\n\nBifrost is an orchestration + intelligence layer on top of GitHub's official migration CLIs\n(`gh actions-importer`, GEI/`ado2gh`). It turns one-at-a-time, syntactic, CLI-only pipeline\nconversion into a **portfolio-scale, semantically-reviewed, human-approved, fully-documented**\nmigration — with a pluggable, **air-gap-capable** multi-model LLM layer.\n\n[**Documentation \u0026 Showcase**](https://bitfrost.freundcloud.com/)\n\n[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)\n![Status: Active development](https://img.shields.io/badge/status-M2--M6%20complete-brightgreen)\n![Built on](https://img.shields.io/badge/wraps-gh%20actions--importer%20%C2%B7%20GEI-2088FF)\n![Editor](https://img.shields.io/badge/MCP-VS%20Code%20·%20Cursor%20·%20Claude-5A4FCF)\n\n\u003c/div\u003e\n\n---\n\n## The thesis\n\n\u003e We do **not** rebuild repo migration or YAML translation. GitHub already does ~90% of the\n\u003e syntactic conversion. Bifrost owns the **other 10%, the review/approval workflow, the portfolio\n\u003e orchestration, semantic-equivalence validation, and the audit trail** — the parts Microsoft is\n\u003e structurally disincentivised to build well.\n\nWe **wrap** the official tools; we never reimplement their conversion logic.\n\n## What makes it different\n\n- **Review-first, not autonomous.** Bifrost recommends and explains; it never silently rewrites\n  production CI. Auto-commit is opt-in, gated behind human approval + validation.\n- **Air-gap capable.** Run with a local model only (Ollama / llama.cpp) so no pipeline definition\n  ever leaves your network. Pipeline YAML leaks infra topology and secret *names* — keep it home.\n- **The LLM explains; it does not score.** Risk scoring is deterministic and explainable. The\n  model fills gaps, explains, and flags — it never produces the numeric risk score.\n- **Grounded generation only.** Every LLM request carries the source snippet + the Importer's\n  converted output + the specific failure. The model fills the gap from that diff — it never\n  converts a pipeline from scratch.\n- **Attestation-native.** Every decision — who approved what, what changed, why, the validation\n  result — is recorded as a signed, exportable attestation.\n- **Works in your editor.** A built-in [MCP server](https://bitfrost.freundcloud.com/mcp) lets an\n  agent in VS Code (or Cursor / Claude Desktop / the Copilot coding agent) query the portfolio and\n  convert a pipeline to a proposed workflow — review-first, with commit triple-gated. Open a legacy\n  `azure-pipelines.yml`, ask once, get a reviewable GitHub workflow with its risks and manual\n  follow-ups spelled out.\n- **Program on GitHub itself.** A dry-run plan for a dedicated repo + org Project (board / roadmap /\n  KPIs), so the migration is tracked and reported on GitHub's own golden-path features.\n\n## Architecture at a glance\n\n```\nPORTAL (React/TS)           portfolio heatmap · 3-pane diff · approve/edit · runbook · board\n      │ REST/SSE                                      ▲ REST\n      │                            bifrost-mcp (MCP/stdio) ── VS Code · Cursor · Claude · Copilot\nCONTROL PLANE (Rust/axum)   job state machine · conversion orchestrator ·\n      │                     deterministic risk model · attestation + audit log\n      │ LlmProvider trait → Anthropic · Gemini · Copilot/Models · Azure OpenAI ·\n      │                     Vertex AI · Bedrock (gateway) · OpenAI-compat · Ollama (air-gap)\n      ▼ shell-out (Docker)            ▼ HTTP\nINGESTION ADAPTERS          EXTERNAL: ADO REST API · GitHub API · GEI\n  gh actions-importer (Docker) · SourceAdapter trait (ADO → …)\n```\n\nFull design: [`bifrost-implementation-plan.md`](bifrost-implementation-plan.md) ·\nthe [architecture doc](https://bitfrost.freundcloud.com/architecture) (diagrams, flowchart,\ndesign rationale) · rendered on the [docs site](https://bitfrost.freundcloud.com/).\n\n## Roadmap\n\n| Milestone | Focus | Status |\n|---|---|---|\n| **M0** Foundations | Workspace, CI, devcontainer, licence, docs, fixtures | In progress |\n| **M1** Audit MVP | ADO adapter + Importer audit wrapper + portfolio heatmap | Mostly done |\n| **M2** Conversion + LLM | dry-run wrapping, gap detection, LLM layer, risk model | Done |\n| **M3** Review Portal | Three-pane diff, approve/edit, proposal lifecycle | Done |\n| **M4** Commit + PR | Push/migrate, manual-task checklists, PR automation | Done |\n| **M5** Validation | Sandbox trigger + run capture + parity diff | Done |\n| **M6** Compliance + Deploy | Attestation, audit pack, App auth, packaging, Entra SSO, multi-tenancy + RBAC | Done |\n\nThe end-to-end loop works against live Azure DevOps projects: audit a portfolio, convert a\npipeline (real Importer dry-run + grounded LLM gap-fill, air-gap capable), review and approve in\nthe portal, open a PR, trigger the converted workflow in a sandbox, capture its run, and diff it\nagainst the ADO baseline for smoke parity — then export a **signed, in-toto-inspired attestation**\nand a per-org **audit pack**. Deployable via [Docker Compose or Helm](deploy/), with **Entra ID\nSSO**, **per-tenant isolation + RBAC**, and a least-privilege **GitHub App** — all opt-in, so the\nair-gapped single-box path stays simple. The core platform (M2–M6) is complete; the M0/M1\nfoundations tail remains.\n\nMost recent: a built-in **MCP server** brings the whole flow into the editor — `bifrost_convert`\n(convert a pipeline to a proposed workflow), `bifrost_runbook` (read the manual-task checklist),\nand a triple-gated `bifrost_commit` (open the PR for an approved proposal) — plus a **program board**\nthat plans a dedicated repo + org Project (board / roadmap / KPIs) on GitHub itself. See the\n[editor guide](https://bitfrost.freundcloud.com/mcp) and the\n[architecture doc](https://bitfrost.freundcloud.com/architecture).\n\n## Run it (self-host)\n\nThe fastest way to a running Bifrost is Docker Compose — SQLite-backed and **air-gap by\ndefault**, so nothing leaves the box:\n\n```bash\ncd deploy\ndocker compose up --build      # portal + API on http://localhost:8080\n```\n\nThat's the whole product: open the portal, add a source connection, audit a portfolio, and\nreview conversions. Set `BIFROST_SIGNING_KEY` in production (attestation signing), and switch\nto Postgres with `--profile postgres` for the multi-tenant server. Full options — including\n**Entra ID SSO**, RBAC, and the **Helm** chart for Kubernetes — are in [`deploy/`](deploy/).\n\nTo drive it from your editor instead, point VS Code (or Cursor / Claude Desktop) at the MCP\nserver — see the [editor guide](https://bitfrost.freundcloud.com/mcp).\n\n\u003e A [release workflow](.github/workflows/release.yml) publishes **cosign-signed** images with\n\u003e **SPDX SBOM attestations** to GHCR (`ghcr.io/olafkfreund/bifrost-{api,portal}`) on each\n\u003e tagged release — pull and `cosign verify` instead of building. See\n\u003e [`deploy/`](deploy/#images) for the pull + verify recipe. Until the first tag is cut, build\n\u003e from source with the command above.\n\n## Getting started (contributors)\n\nOn NixOS (or any machine with Nix + flakes), the dev shell provides the whole\ntoolchain — the pinned Rust toolchain, Node 22, `gh`, `azure-cli`, and the Docker\nclient:\n\n```bash\nnix develop                   # enter the Bifrost dev shell (honours rust-toolchain.toml)\ncargo test --workspace        # full suite green (100+ tests)\ncd portal \u0026\u0026 npm ci \u0026\u0026 npm run dev   # portal (mock data) at http://localhost:5173\n```\n\nThe GitHub Actions Importer isn't in nixpkgs (it's a `gh` extension + Docker\nimage); install it once into your writable home:\n\n```bash\ngh extension install github/gh-actions-importer\ngh actions-importer configure   # uses GITHUB_TOKEN + AZDO_PAT\n```\n\nTokens (ADO PAT, GitHub token) live in a gitignored `.envrc` — `source .envrc`.\nWork is issue-driven and milestone-ordered; see [`CONTRIBUTING.md`](CONTRIBUTING.md)\nfor the workflow (Conventional Commits, one PR per issue) and [`CLAUDE.md`](CLAUDE.md)\nfor the architecture and hard rules.\n\n## Stack (target)\n\nRust (axum · tokio · sqlx) · Postgres / SQLite · official Importer Docker image ·\nReact + TS + Vite + Tailwind + Monaco · GitHub App + Entra ID OIDC · Docker Compose → Helm.\n\n## License\n\n[MIT](LICENSE) © 2026 Olaf K. Freund\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Folafkfreund%2Fbifrost","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Folafkfreund%2Fbifrost","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Folafkfreund%2Fbifrost/lists"}