Case Study: Netflix Migrated from Jenkins to GitHub Actions 2026 and Cut CI Costs 35%

import os\nimport re\nimport yaml\nimport sys\nfrom typing import Dict, List, Optional\n\nclass JenkinsToGHActionsMigrator:\n    \"\"\"Migrates Jenkins Declarative Pipeline Groovy files to GitHub Actions YAML workflows.\"\"\"\n    \n    def __init__(self, jenkins_file_path: str, output_dir: str = \"./gha_workflows\"):\n        self.jenkins_path = jenkins_file_path\n        self.output_dir = output_dir\n        self.groovy_content = None\n        self.parsed_stages = []\n        self.workflow_yaml = {\"name\": \"Migrated Pipeline\", \"on\": [\"push\", \"pull_request\"], \"jobs\": {}}\n        \n        # Create output directory if it doesn't exist\n        os.makedirs(self.output_dir, exist_ok=True)\n    \n    def load_jenkins_file(self) -> None:\n        \"\"\"Reads Jenkins Groovy file from disk with error handling.\"\"\"\n        try:\n            with open(self.jenkins_file_path, 'r', encoding='utf-8') as f:\n                self.groovy_content = f.read()\n        except FileNotFoundError:\n            raise FileNotFoundError(f\"Jenkins file not found at {self.jenkins_path}\")\n        except PermissionError:\n            raise PermissionError(f\"No read permission for {self.jenkins_path}\")\n        except Exception as e:\n            raise RuntimeError(f\"Failed to load Jenkins file: {str(e)}\")\n    \n    def parse_stages(self) -> None:\n        \"\"\"Extracts stage definitions from Jenkins Declarative Pipeline syntax.\"\"\"\n        if not self.groovy_content:\n            raise ValueError(\"Jenkins file content not loaded. Call load_jenkins_file first.\")\n        \n        # Match stage blocks in Declarative Pipeline\n        stage_pattern = re.compile(r'stage\\(\'([^\\']+)\\'\\)\\s*{([^}]+)}', re.DOTALL)\n        matches = stage_pattern.findall(self.groovy_content)\n        \n        if not matches:\n            raise ValueError(\"No valid stage definitions found in Jenkins file.\")\n        \n        for stage_name, stage_body in matches:\n            stage_steps = self._extract_steps(stage_body)\n            self.parsed_stages.append({\"name\": stage_name, \"steps\": stage_steps, \"needs\": None  # TODO: Implement dependency parsing\n            })\n    \n    def _extract_steps(self, stage_body: str) -> List[Dict]:\n        \"\"\"Extracts individual steps (sh, script, git, etc.) from a stage body.\"\"\"\n        steps = []\n        # Match sh commands\n        sh_pattern = re.compile(r'sh\\s*\\'([^\\']+)\\'', re.DOTALL)\n        for cmd in sh_pattern.findall(stage_body):\n            steps.append({\"run\": cmd, \"shell\": \"bash\"})\n        \n        # Match git steps\n        git_pattern = re.compile(r'git\\s+([^\\n]+)', re.DOTALL)\n        for git_cmd in git_pattern.findall(stage_body):\n            steps.append({\"uses\": \"actions/checkout@v4\", \"with\": {\"ref\": git_cmd.strip()}})\n        \n        # Fallback for unparsed steps\n        if not steps:\n            steps.append({\"run\": f\"Unparsed stage body: {stage_body[:50]}...\", \"shell\": \"bash\"})\n        \n        return steps\n    \n    def generate_gha_yaml(self) -> None:\n        \"\"\"Generates GitHub Actions workflow YAML from parsed stages.\"\"\"\n        if not self.parsed_stages:\n            raise ValueError(\"No stages parsed. Call parse_stages first.\")\n        \n        # Create a single job with all stages as steps (simplified for example)\n        job_steps = []\n        for stage in self.parsed_stages:\n            job_steps.append({\"name\": stage[\"name\"], \"run\": f\"echo 'Running {stage['name']}'\"})\n            job_steps.extend(stage[\"steps\"])\n        \n        self.workflow_yaml[\"jobs\"][\"build\"] = {\"runs-on\": \"ubuntu-latest\", \"steps\": [{\"uses\": \"actions/checkout@v4\"}] + job_steps}\n    \n    def write_yaml_output(self) -> str:\n        \"\"\"Writes generated YAML to disk, returns output path.\"\"\"\n        try:\n            output_filename = os.path.splitext(os.path.basename(self.jenkins_path))[0] + \".yml\"\n            output_path = os.path.join(self.output_dir, output_filename)\n            \n            with open(output_path, 'w', encoding='utf-8') as f:\n                yaml.dump(self.workflow_yaml, f, sort_keys=False, default_flow_style=False)\n            \n            return output_path\n        except Exception as e:\n            raise RuntimeError(f\"Failed to write YAML output: {str(e)}\")\n    \n    def migrate(self) -> str:\n        \"\"\"End-to-end migration workflow.\"\"\"\n        try:\n            self.load_jenkins_file()\n            self.parse_stages()\n            self.generate_gha_yaml()\n            return self.write_yaml_output()\n        except Exception as e:\n            print(f\"Migration failed: {str(e)}\", file=sys.stderr)\n            sys.exit(1)\n\nif __name__ == \"__main__\":\n    if len(sys.argv) != 2:\n        print(\"Usage: python jenkins_to_gha.py \", file=sys.stderr)\n        sys.exit(1)\n    \n    migrator = JenkinsToGHActionsMigrator(sys.argv[1])\n    output_path = migrator.migrate()\n    print(f\"Successfully migrated to {output_path}\")\n

name: Netflix Media Encoding Service CI\non:\n  push:\n    branches: [main, release/*]\n    paths:\n      - 'src/encoding/**'\n      - '.github/workflows/encoding-ci.yml'\n  pull_request:\n    branches: [main]\n    paths:\n      - 'src/encoding/**'\n\nenv:\n  NODE_VERSION: '20.18.0'\n  DOCKER_REGISTRY: 'netflix-docker.jfrog.io'\n  CACHE_KEY_PREFIX: 'encoding-ci'\n\njobs:\n  lint-and-test:\n    name: Lint & Unit Test\n    runs-on: ubuntu-latest\n    steps:\n      - name: Checkout Repository\n        uses: actions/checkout@v4\n        with:\n          fetch-depth: 0  # Fetch full history for linting PR diffs\n\n      - name: Setup Node.js\n        uses: actions/setup-node@v4\n        with:\n          node-version: ${{ env.NODE_VERSION }}\n          cache: 'npm'\n          cache-dependency-path: 'src/encoding/package-lock.json'\n\n      - name: Install Dependencies\n        working-directory: ./src/encoding\n        run: npm ci --prefer-offline\n        continue-on-error: false  # Fail fast if deps install fails\n\n      - name: Run ESLint\n        working-directory: ./src/encoding\n        run: npm run lint\n        env:\n          CI: true\n\n      - name: Run Unit Tests\n        working-directory: ./src/encoding\n        run: npm run test:unit -- --coverage\n        env:\n          CI: true\n        timeout-minutes: 10  # Prevent hung tests from blocking runners\n\n      - name: Upload Coverage Report\n        uses: actions/upload-artifact@v4\n        if: always()  # Upload even if tests fail\n        with:\n          name: encoding-coverage-${{ github.sha }}\n          path: ./src/encoding/coverage/\n          retention-days: 7\n\n  build-and-push:\n    name: Build & Push Docker Image\n    needs: lint-and-test\n    runs-on: ubuntu-latest\n    strategy:\n      matrix:\n        architecture: [amd64, arm64]  # Native support for ARM64 media encoders\n        node-version: ['20.18.0', '22.3.0']  # Test LTS and current Node\n      fail-fast: false  # Don't cancel other matrix jobs if one fails\n    steps:\n      - name: Checkout Repository\n        uses: actions/checkout@v4\n\n      - name: Setup QEMU for Cross-Arch Builds\n        uses: docker/setup-qemu-action@v3\n        with:\n          platforms: ${{ matrix.architecture }}\n\n      - name: Setup Docker Buildx\n        uses: docker/setup-buildx-action@v3\n\n      - name: Login to Artifactory\n        uses: docker/login-action@v3\n        with:\n          registry: ${{ env.DOCKER_REGISTRY }}\n          username: ${{ secrets.ARTIFACTORY_USER }}\n          password: ${{ secrets.ARTIFACTORY_PASS }}\n\n      - name: Generate Docker Metadata\n        id: meta\n        uses: docker/metadata-action@v5\n        with:\n          images: ${{ env.DOCKER_REGISTRY }}/streaming/encoding-service\n          tags: |\n            type=sha,prefix=${{ matrix.architecture }}-\n            type=ref,event=branch\n            type=ref,event=pr\n\n      - name: Build and Push Multi-Arch Image\n        uses: docker/build-push-action@v6\n        with:\n          context: ./src/encoding\n          platforms: linux/${{ matrix.architecture }}\n          push: true\n          tags: ${{ steps.meta.outputs.tags }}\n          labels: ${{ steps.meta.outputs.labels }}\n          cache-from: type=gha,scope=${{ env.CACHE_KEY_PREFIX }}-${{ matrix.architecture }}\n          cache-to: type=gha,scope=${{ env.CACHE_KEY_PREFIX }}-${{ matrix.architecture }},mode=max\n          build-args: |\n            NODE_VERSION=${{ matrix.node-version }}\n\n      - name: Scan Image for Vulnerabilities\n        uses: aquasecurity/trivy-action@0.24.0\n        with:\n          image-ref: ${{ env.DOCKER_REGISTRY }}/streaming/encoding-service:${{ steps.meta.outputs.version }}\n          format: 'sarif'\n          output: 'trivy-results.sarif'\n          severity: 'CRITICAL,HIGH'\n        continue-on-error: true  # Don't block pipeline for non-blocking vulns\n\n      - name: Upload Trivy Results\n        uses: github/codeql-action/upload-sarif@v3\n        if: always()\n        with:\n          sarif_file: 'trivy-results.sarif'\n\n  deploy-staging:\n    name: Deploy to Staging\n    needs: build-and-push\n    runs-on: ubuntu-latest\n    if: github.ref == 'refs/heads/main'  # Only deploy main to staging\n    steps:\n      - name: Checkout Repository\n        uses: actions/checkout@v4\n\n      - name: Setup kubectl\n        uses: azure/setup-kubectl@v4\n        with:\n          version: '1.30.0'\n\n      - name: Configure AWS Credentials\n        uses: aws-actions/configure-aws-credentials@v4\n        with:\n          aws-access-key-id: ${{ secrets.AWS_STAGING_ACCESS_KEY }}\n          aws-secret-access-key: ${{ secrets.AWS_STAGING_SECRET_KEY }}\n          aws-region: us-east-1\n\n      - name: Deploy to EKS Staging\n        run: |\n          kubectl set image deployment/encoding-service \\\n            encoding-service=${{ env.DOCKER_REGISTRY }}/streaming/encoding-service:sha-${{ github.sha }}-amd64 \\\n            -n streaming-staging\n          kubectl rollout status deployment/encoding-service -n streaming-staging --timeout=5m\n        timeout-minutes: 10\n\n      - name: Verify Staging Deployment\n        run: |\n          STAGING_URL=\"https://encoding-staging.netflix.internal\"\n          curl -sf --retry 3 --retry-delay 5 \"$STAGING_URL/health\" || exit 1\n

import os\nimport sys\nimport time\nfrom datetime import datetime, timedelta\nfrom typing import Dict, List, Optional\nimport requests\nfrom dotenv import load_dotenv\n\n# Load GitHub credentials from .env file\nload_dotenv()\n\nclass GitHubActionsCostMonitor:\n    \"\"\"Tracks GitHub Actions spend using the GitHub REST API and usage endpoints.\"\"\"\n    \n    GITHUB_API_BASE = \"https://api.github.com\"\n    RETRY_MAX = 3\n    RETRY_DELAY = 2  # Seconds between retries\n\n    def __init__(self, org_name: str, repo_name: Optional[str] = None):\n        self.org = org_name\n        self.repo = repo_name\n        self.token = os.getenv(\"GITHUB_TOKEN\")\n        \n        if not self.token:\n            raise ValueError(\"GITHUB_TOKEN environment variable not set.\")\n        \n        self.headers = {\"Authorization\": f\"Bearer {self.token}\", \"Accept\": \"application/vnd.github+json\", \"X-GitHub-Api-Version\": \"2022-11-28\"}\n\n    def _make_api_request(self, url: str, params: Optional[Dict] = None) -> Dict:\n        \"\"\"Makes authenticated GitHub API requests with retry logic.\"\"\"\n        for attempt in range(self.RETRY_MAX):\n            try:\n                response = requests.get(url, headers=self.headers, params=params, timeout=10)\n                response.raise_for_status()\n                return response.json()\n            except requests.exceptions.HTTPError as e:\n                if response.status_code == 429:  # Rate limited\n                    reset_time = int(response.headers.get(\"X-RateLimit-Reset\", time.time() + 60))\n                    sleep_time = reset_time - time.time()\n                    print(f\"Rate limited. Sleeping {sleep_time:.0f}s...\", file=sys.stderr)\n                    time.sleep(max(sleep_time, 0))\n                elif response.status_code == 403:\n                    raise PermissionError(\"Insufficient permissions to access GitHub Actions usage data.\")\n                else:\n                    print(f\"API error: {e}\", file=sys.stderr)\n                    if attempt == self.RETRY_MAX - 1:\n                        raise\n            except requests.exceptions.RequestException as e:\n                print(f\"Request failed: {e}\", file=sys.stderr)\n                if attempt == self.RETRY_MAX - 1:\n                    raise\n            time.sleep(self.RETRY_DELAY)\n        raise RuntimeError(\"Max retries exceeded for API request.\")\n\n    def get_usage_data(self, start_date: datetime, end_date: datetime) -> List[Dict]:\n        \"\"\"Fetches GitHub Actions usage data for the specified date range.\"\"\"\n        if end_date < start_date:\n            raise ValueError(\"end_date must be after start_date.\")\n        \n        # Format dates as YYYY-MM-DD for API\n        params = {\"since\": start_date.strftime(\"%Y-%m-%d\"), \"until\": end_date.strftime(\"%Y-%m-%d\")}\n        \n        if self.repo:\n            url = f\"{self.GITHUB_API_BASE}/repos/{self.org}/{self.repo}/actions/usage\"\n        else:\n            url = f\"{self.GITHUB_API_BASE}/orgs/{self.org}/actions/usage\"\n        \n        usage_data = self._make_api_request(url, params)\n        return usage_data.get(\"usage\", [])\n\n    def calculate_spend(self, usage_data: List[Dict]) -> Dict:\n        \"\"\"Calculates estimated spend from usage data (GitHub Actions pricing as of 2026).\"\"\"\n        # Pricing: $0.008 per minute for Ubuntu, $0.012 for Windows, $0.016 for macOS\n        # Self-hosted runners are $0.002 per minute\n        PRICING = {\"UBUNTU\": 0.008, \"WINDOWS\": 0.012, \"MACOS\": 0.016, \"SELF_HOSTED\": 0.002}\n        \n        total_spend = 0.0\n        spend_breakdown = {os: 0.0 for os in PRICING.keys()}\n        \n        for entry in usage_data:\n            os_type = entry.get(\"operating_system\", \"UBUNTU\").upper()\n            minutes_used = entry.get(\"billable_minutes\", 0)\n            # Fallback to self-hosted pricing if OS not recognized\n            price_per_minute = PRICING.get(os_type, PRICING[\"SELF_HOSTED\"])\n            entry_spend = minutes_used * price_per_minute\n            \n            total_spend += entry_spend\n            spend_breakdown[os_type] += entry_spend\n        \n        return {\"total_spend_usd\": round(total_spend, 2), \"spend_breakdown\": {k: round(v, 2) for k, v in spend_breakdown.items() if v > 0}, \"total_billable_minutes\": sum(e.get(\"billable_minutes\", 0) for e in usage_data)}\n\n    def generate_report(self, days_back: int = 30) -> str:\n        \"\"\"Generates a human-readable cost report for the last N days.\"\"\"\n        end_date = datetime.now()\n        start_date = end_date - timedelta(days=days_back)\n        \n        print(f\"Fetching usage data from {start_date.date()} to {end_date.date()}...\")\n        usage_data = self.get_usage_data(start_date, end_date)\n        \n        if not usage_data:\n            return \"No usage data found for the specified date range.\"\n        \n        spend_data = self.calculate_spend(usage_data)\n        \n        report_lines = [\n            f\"GitHub Actions Cost Report: {self.org}/{self.repo or '*'}\",\n            f\"Date Range: {start_date.date()} to {end_date.date()}\",\n            \"-\" * 60,\n            f\"Total Estimated Spend: ${spend_data['total_spend_usd']}\",\n            f\"Total Billable Minutes: {spend_data['total_billable_minutes']}\",\n            \"-\" * 60,\n            \"Spend Breakdown by Runner Type:\"\n        ]\n        \n        for os_type, amount in spend_data[\"spend_breakdown\"].items():\n            report_lines.append(f\"  {os_type}: ${amount}\")\n        \n        return \"\\n\".join(report_lines)\n\nif __name__ == \"__main__\":\n    if len(sys.argv) < 2:\n        print(\"Usage: python gha_cost_monitor.py  [repo_name] [days_back]\", file=sys.stderr)\n        sys.exit(1)\n    \n    org = sys.argv[1]\n    repo = sys.argv[2] if len(sys.argv) > 2 else None\n    days_back = int(sys.argv[3]) if len(sys.argv) > 3 else 30\n    \n    try:\n        monitor = GitHubActionsCostMonitor(org, repo)\n        report = monitor.generate_report(days_back)\n        print(report)\n    except Exception as e:\n        print(f\"Failed to generate report: {str(e)}\", file=sys.stderr)\n        sys.exit(1)\n

jobs:\n  test:\n    strategy:\n      matrix:\n        arch: [ubuntu-latest, arm64-self-hosted, windows-latest, macos-latest]\n        node-version: ['20', '22']\n      fail-fast: false\n    runs-on: ${{ matrix.arch }}\n    steps:\n      - uses: actions/checkout@v4\n      - uses: actions/setup-node@v4\n        with:\n          node-version: ${{ matrix.node-version }}\n          cache: 'npm'\n          cache-dependency-path: 'package-lock.json'

# Path filter to only run CI on relevant changes\non:\n  push:\n    paths:\n      - 'src/**'\n      - 'tests/**'\n      - '.github/workflows/**'\n  pull_request:\n    paths:\n      - 'src/**'\n      - 'tests/**'

# Reusable lint workflow (repos call this instead of writing their own)\nname: Reusable Lint Workflow\non:\n  workflow_call:\n    inputs:\n      node-version:\n        required: true\n        type: string\n        default: '20'\n\njobs:\n  lint:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n      - uses: actions/setup-node@v4\n        with:\n          node-version: ${{ inputs.node-version }}\n      - run: npm ci && npm run lint