🩺 Vitals
- 🟢 Last active: 2026-07-24
- 📦 Latest release: v1.27.0 (2026-07-13)
- 🐞 Open issues: 2664
- 🌟 Stars: 57k
What do these metrics mean?
- Last active: when code was last pushed, as of our last check. The dot is green when that was recent, grey otherwise. A long gap can mean a tool is finished and stable, not only unmaintained.
- Latest release: the most recent tagged, packaged version the maintainers published. Not every healthy project tags releases.
- Open issues: unresolved reports and requests. A high number is normal for a popular project and is not a warning on its own.
- Stars: how many people bookmarked the project on its forge. A rough popularity signal, not a measure of quality.
🏗️ Profile
- Official: about.gitea.com
- Source: github.com/go-gitea/gitea
- License: MIT (open core)
- Deployment: Docker | Native (Single Binary) | Kubernetes (Helm)
- Data Model: SQLite / PostgreSQL / MySQL
- Jurisdiction: USA 🇺🇸 (CommitGo, Inc., US corporation)
- Compliance (SaaS): SOC 2 Type II (Gitea Cloud)
- Compliance (Self-Hosted): Self-Hosted (User Managed)
- Complexity: Low (2/5) - Single Go binary or one container
- Maintenance: Low (2/5) - Drop-in binary upgrades; DB migrations on major versions
- Enterprise Ready: High (4/5) - OAuth2/OIDC/LDAP SSO, 2FA and RBAC in the free build; SAML, audit logs and IP allowlist require the paid Enterprise tier
1. The Executive Summary
What is it? Gitea is a self-hosted software forge: Git repository hosting plus issues, pull requests and code review, a built-in CI/CD engine (Gitea Actions, compatible with GitHub Actions workflow files), a package registry and a wiki, all in one lightweight Go binary. It is a drop-in replacement for GitHub that runs on modest hardware. The core is MIT-licensed, but the project operates an open-core model: a separate proprietary "Gitea Enterprise" build, sold by the commercial steward CommitGo, Inc. (a US corporation founded by the Gitea maintainers), gates a set of enterprise governance features. Gitea is also the project that Forgejo was hard-forked from in 2022.
The Strategic Verdict:
- 🔴 For teams that treat governance independence as part of the threat model: Caution. In 2022 Gitea's domain and trademark were transferred to a for-profit company without community consensus, which is precisely what triggered the Forgejo hard fork. The code remains MIT and forkable, but the roadmap, trademark and proprietary Enterprise build now sit with a US commercial entity. If steward independence matters, the upstream's history is a mark against it.
- 🟢 For teams that want the lightest possible self-hosted forge: Strong Buy. A single Go binary on a modest VPS delivers Git hosting, issues, a built-in Actions CI/CD runner and a package registry with near-zero operational overhead. The MIT core carries no copyleft obligations, and OAuth2/OIDC/LDAP SSO, 2FA and RBAC all ship in the free build.
2. The "Hidden" Costs (TCO Analysis)
| Cost Component | GitHub (SaaS) | Gitea (Self-Hosted) |
|---|---|---|
| Per-seat Licensing | Monthly per-user fee across tiers | MIT core, unlimited users |
| Hosting Footprint | Managed for you | A single Go binary on a modest VPS |
| CI/CD Compute | Hosted runner minutes metered, overage billed | Your own Actions runners, no per-minute fee |
| Enterprise Tax | Advanced Security priced per committer | SAML, audit logs, IP allowlist and dependency scanning need the paid Enterprise tier |
3. The "Day 2" Reality Check
🚀 Deployment & Operations
- Installation: Gitea ships as a single self-contained Go binary, an official Docker image or a Helm chart. There is no application server or orchestration layer to assemble; you point it at SQLite for a small team or PostgreSQL/MySQL for a larger one and it is running in minutes. Gitea Actions, the built-in CI/CD runner, reads GitHub-Actions-compatible workflow files, so existing pipelines port with minimal change.
- Scalability: A single instance on a modest VPS comfortably serves a small-to-mid-sized team because the binary is lightweight. Growth means moving the database to PostgreSQL and putting object storage behind attachments. As with other single-binary forges, horizontal scaling is less mature than GitLab's documented reference architectures, so very large deployments need hands-on capacity planning.
🛡️ Security & Governance (Risk Assessment)
- Jurisdiction & Geopolitics: Gitea's commercial steward, CommitGo, Inc., is a US corporation, so anything hosted on Gitea Cloud or its managed services falls under the US CLOUD Act. For self-hosters the SaaS jurisdiction is moot, your code stays on your own infrastructure, but the trademark, roadmap and the proprietary Enterprise build are controlled by a US for-profit. The MIT core itself remains forkable, and the existence of Forgejo is the proof: when stewardship moved against the community's wishes, the community took the code and left.
- The Compliance Shift: Gitea Cloud carries a SOC 2 Type II (and SOC 3) attestation. Self-hosting nullifies that attestation entirely: you assume the full ISMS burden across infrastructure, network access and retention. Gitea supplies the building blocks (RBAC, OAuth2/OIDC/LDAP, 2FA) in the free build, but audit logging, a baseline compliance control, sits in the paid Enterprise tier. A compliant self-hosted posture may therefore require the commercial license on top of your own operational work.
- License Risk (The Open-Core Trap): The code is MIT, genuinely permissive and forkable, so there is no copyleft or relicensing risk in the software you run. The risk is governance plus open core. In 2022 the project's domain and trademark were moved to a for-profit company without community consensus, fracturing the community and spawning the Forgejo fork. The same maintainers now operate CommitGo, Inc., which paywalls SAML SSO, audit logs, IP allowlisting and dependency scanning behind a proprietary Enterprise tier. OAuth2/OIDC/LDAP SSO does ship free, so the line is SAML and compliance tooling, not all access control, but teams whose compliance needs mature can find themselves buying the Enterprise license they expected to avoid.
4. Market Landscape
🏢 Proprietary Incumbents
- GitHub: The dominant forge, owned by Microsoft and hosted in the US. Convenient and feature-rich, but closed-source SaaS: your code, issues and CI logs live on infrastructure under US jurisdiction, and Advanced Security and Enterprise capabilities are priced per seat and per committer.
- Azure DevOps: Microsoft's enterprise ALM suite (Repos, Pipelines, Boards, Artifacts). A proprietary SaaS most attractive to organizations already standardized on the Azure ecosystem, with the lock-in that implies.
🤝 Open Source Ecosystem
- Forgejo: The hard fork of Gitea created in 2022, stewarded by the EU non-profit Codeberg e.V. under a copyleft license. It runs the same lightweight engine but answers directly to the governance concerns Gitea's for-profit turn raised, with no open-core paywall.
- GitLab: The heavier open-core DevSecOps platform for teams a single-binary forge cannot serve, with full CI/CD, a registry and security scanning in one application, at substantially higher operational cost.