Our team is planning the migration off Travis CI. The primary business requirement is avoiding vendor lock-in. We need a platform where our pipeline definitions are portable and our secrets management doesn't create a hard dependency.
I've reviewed the common migration targets: GitHub Actions, GitLab CI, and Jenkins. From a compliance and security standpoint, the decision criteria must be:
* **Pipeline Portability:** Can the pipeline configuration live in the repository as code, and can it be executed elsewhere with minimal rewrite? YAML tied to a proprietary runtime is a red flag.
* **Secrets Management:** How are environment variables and credentials handled? A platform's native secrets store is a lock-in vector. We need a method to migrate secrets securely and manage them externally, potentially using a vault.
* **Audit Trail:** The platform must provide immutable, detailed logs for every pipeline execution, including who triggered it and what secrets were accessed. This is non-negotiable for SOC 2 controls.
I am skeptical of "easy migration" tools. The pain points I anticipate are translating matrix builds, handling custom build environments, and replicating notification workflows.
For those who have completed this migration, what was your actual experience?
* Which platform gave you the least proprietary syntax?
* How did you handle the secrets migration without leaving credentials exposed in logs or hardcoded in the new platform's UI?
* What was the most time-consuming part of the pipeline translation?
Where is your SOC 2?