Name		Name	Last commit message	Last commit date
.agents/skills		.agents/skills
.claude		.claude
.devcontainer		.devcontainer
.dredd		.dredd
.github		.github
.vscode		.vscode
AGENTS		AGENTS
api		api
cli		cli
db		db
db_lib		db_lib
deployment		deployment
examples		examples
hook_helpers		hook_helpers
maintenance		maintenance
pkg		pkg
pro		pro
pro_interfaces		pro_interfaces
services		services
test		test
tools		tools
util		util
web		web
.codacy.yml		.codacy.yml
.cursorignore		.cursorignore
.dockerignore		.dockerignore
.gitignore		.gitignore
.golangci.yml		.golangci.yml
.goreleaser.yml		.goreleaser.yml
AGENTS.md		AGENTS.md
CHANGELOG.md		CHANGELOG.md
CLAUDE.md		CLAUDE.md
CODE_OF_CONDUCT.md		CODE_OF_CONDUCT.md
CONTRIBUTING.md		CONTRIBUTING.md
LICENSE		LICENSE
README.md		README.md
SECURITY.md		SECURITY.md
THIRD-PARTY-LICENSES.md		THIRD-PARTY-LICENSES.md
Taskfile.ex.yml		Taskfile.ex.yml
Taskfile.yml		Taskfile.yml
api-docs-ex.yml		api-docs-ex.yml
api-docs.yml		api-docs.yml
config.schema.yaml		config.schema.yaml
go.mod		go.mod
go.sum		go.sum
go.work		go.work
package-lock.json		package-lock.json
qodana.yaml		qodana.yaml
renovate.json		renovate.json

Repository files navigation

Semaphore EX

Semaphore EX is a full-featured fork of Semaphore UI, the modern web interface for Ansible, Terraform, OpenTofu, Terragrunt, PowerShell and other DevOps tools. It ships one edition that contains everything implemented in this repository: no edition selection, no license activation, no subscription quotas. Features that are optional or need external infrastructure have ordinary configuration switches instead.

Quick Start

Run the server with SQLite and log in as admin / changeme at http://localhost:3000:

docker run -d --name semaphore-ex -p 3000:3000 \
  -e SEMAPHORE_DB_DIALECT=sqlite \
  -e SEMAPHORE_ADMIN=admin \
  -e SEMAPHORE_ADMIN_PASSWORD=changeme \
  -e SEMAPHORE_ADMIN_NAME=Admin \
  -e SEMAPHORE_ADMIN_EMAIL=admin@localhost \
  -v semaphore-ex:/var/lib/semaphore \
  ghcr.io/freefair/semaphore-ex:latest

Verify the instance reports the full edition:

curl -s -c cookie -H 'Content-Type: application/json' \
  -d '{"auth":"admin","password":"changeme","method":"password"}' \
  http://localhost:3000/api/auth/login
curl -s -b cookie http://localhost:3000/api/info | jq '{edition, core_revision, enhanced_revision}'

Other installation paths:

Docker Compose: snippets for server, runner and databases live in deployment/compose.
Remote runner image: ghcr.io/freefair/semaphore-ex-runner, configured as described in the runner guide.
Debian/RPM package or binary: download from GitHub Releases. The package is named semaphore-ex, installs /usr/bin/semaphore and conflicts with the upstream semaphore package. A sample systemd unit and environment file live in deployment/systemd. Verify the checksums before installing:
```
gpg --import deployment/packaging/semaphore-ex-release.asc
gpg --verify semaphore-ex_<version>_checksums.txt.sig semaphore-ex_<version>_checksums.txt
sha256sum --check --ignore-missing semaphore-ex_<version>_checksums.txt
```

Images are published for linux/amd64 and linux/arm64 with SBOM and provenance attestations. Every release tag is vX.Y.Z-ex.N, where X.Y.Z is the upstream line the release is based on.

What the fork adds

All of upstream Semaphore UI, plus the features below. Each feature group has a specification under implementation slices.

Area	Features
Runners and placement	Project runner registration, lifecycle, health and history, reconciliation, tag placement, executor images, secure mode
Task diagnostics and secrets	Task summaries, structured file logs, audit webhook export, debug log filtering, Vault and OpenBao runtime secrets, managed secret storage, TOTP and LDAP lifecycles
Workflows	Graphical editor with validation, linear and conditional parallel runs, artifacts, parameters and overrides, triggers, approvals, reconciliation, versions, cross-project references, workflow RBAC
High availability	Cluster dashboard, cross-node coordination, task recovery, workflow progression, resilience gate in CI
Roles and identity	Custom project roles, global and template roles, LDAP and OIDC group mapping
Container executors	Docker and Kubernetes executors with hardening policies
Governance and delivery	Notification governance, PagerDuty, Opsgenie and ServiceNow delivery, signed webhooks
Credentials	Global credential grants, dispatch-time resolution and audit, server-generated SSH keys, template search, per-schedule time zones
Policy controls	Execution preflight, deployment windows, policy guardrails, artifact retention and provenance

Backend authorization, role permissions, safety policy and configured enablement stay enforced; they are security controls, not edition gates.

Documentation

GitHub Wiki: the sole maintained English manual
Complete configuration reference and additional schemas
Changelog and release procedure
Upstream maintenance policy

Documentation is maintained directly in the GitHub Wiki. The product repository contains no documentation checkout, submodule or documentation build.

Relationship to upstream

develop is the long-lived fork branch. Upstream semaphoreui/semaphore is merged regularly; published history is never rewritten. Fork code lives in the Enhanced module (test/edition-contract/enhanced), in same-package *_ex.go files and in focused UI components, so upstream files change as little as possible. Bugs that reproduce on the upstream Community release belong in the upstream tracker; everything else goes to this repository's issues.

Development

git clone --recursive git@github.com:freefair/semaphore-ex.git && cd semaphore-ex
task deps          # Go workspace vendoring, frontend packages, goreleaser
task build         # embedded frontend + server binary in bin/semaphore
task test          # Go test suites
(cd web && npm run test:unit)

Toolchain versions are pinned in .github/workflows/product_build.yml and the Dockerfiles. tools/upstream-sync/verify.sh runs the complete release gate set locally.