GitLab Alternative: GitLab, Forgejo and Gitea Compared

Do you want to replace GitLab, or check whether Forgejo or Gitea is enough? We plan, migrate and operate Forgejo as a Git platform and offer the combination with CI, registry and SSO as a package for Git and CI. View Forgejo operations · Book an intro call (free and non-binding)

GitLab, Forgejo and Gitea cover the same core: Git repositories, code review, issue tracking and CI/CD on your own infrastructure. They differ in licence, governance, feature scope, server requirements and the effort of a move. This comparison summarises the differences with sources. Where the documentation does not support a statement, the text says so. As of: 5 November 2026.

Table of contents

• In brief
• How do GitLab, Forgejo and Gitea differ at a glance?
• Which licence applies, and what costs money?
• Who is behind each project?
• Which versions apply in November 2026?
• How do CI/CD and registries differ?
• What do Forgejo and Gitea lack compared with GitLab?
• How much server does each platform need?
• How secure is operation?
• How do you migrate from GitLab to Forgejo or Gitea?
• When should you stay with GitLab?
• Status and methodology
• Our approach at WZ-IT
• Further guides
• Sources

In brief

The mapping is our assessment based on the differences documented below, not a vendor statement.

How do GitLab, Forgejo and Gitea differ at a glance?

Which licence applies, and what costs money?

On the EE licence: the licence file allows copying and modifying for development and testing without a subscription. Production use requires agreeing to the GitLab Subscription Terms (or another usage agreement made with GitLab) and a valid subscription for the correct number of user seats. By the wording of the licence, copying, publishing, distributing, sublicensing and selling the software are prohibited, subject to the conditions stated there. Parts shipped with GitLab CE or served client-side to browsers as images, fonts and similar are under MIT Expat according to the licence. According to GitLab, the EE package can also be run with the Free features without a paid subscription. This is not legal advice.

On Forgejo: the v9.0 release post describes v9.0 as the first version under a copyleft licence and announces that more files will switch to GPL v3+ over time. The Swagger file stays MIT. We did not check how large the MIT share is today. The assumption "Forgejo is MIT like Gitea" holds only up to v8.0.

What does GitLab cost, and what does Gitea Enterprise add?

On its pricing page GitLab lists Premium at 29 US dollars per user and month with annual billing (as of November 2026) and Ultimate on request. According to the GitLab documentation, a self-managed subscription applies to the whole instance and all users get the same features. For Gitea Enterprise the vendor names on its product page: branch protection inheritance, dependency scanning, IP allowlist, mandatory 2FA, SAML 2.0 and audit log. The pricing page shows two amounts side by side, so we do not quote a price.

Which GitLab features sit in which tier?

The details come from the "Tier" header of each GitLab documentation page (as of November 2026). The tier headers of these pages name tiers (Free, Premium, Ultimate), not CE and EE; other parts of the documentation explicitly mark features as available in EE only. Whether every Free feature is part of the plain CE package is therefore not established.

Who is behind each project?

Forgejo. The project states that it exists under the umbrella of the non-profit Codeberg e.V., that the domains are held by the association and that Forgejo has not registered any trademarks. Codeberg e.V. is an association registered in Berlin whose statutory goal, according to the FAQ, is to guarantee the openness and continued availability of free software. Security reports go to [email protected]. No paid edition is listed on the project pages we checked.

Gitea. On 30 October 2022 the maintainer Lunny wrote that Gitea Ltd. had been founded and that the domains and the "Gitea" trademark were transferred from him personally to the company. The logo remains community property and the owners group continues to vote. According to the vendor, Gitea offers the open-source edition under MIT, Gitea Cloud and Gitea Enterprise. The current vendor page names leadership and commercial support by CommitGo. How CommitGo and the Gitea Ltd. named in 2022 relate today is not stated in the sources we checked.

GitLab. GitLab Inc. is publicly listed (ticker GTLB, see the quarterly report).

The Forgejo page comparing itself to Gitea is the account of one of the two projects. It dates the split to October 2022 (soft fork) and early 2024 (hard fork) and claims that Gitea is controlled by a for-profit company, requires copyright assignment even for MIT-licensed code and gives advance information on security releases only to customers. These are statements by Forgejo about Gitea. On copyright assignment: the current Gitea contribution guideline states that submitting a pull request counts as agreement to the DCO and the MIT licence; it contains no explicit assignment of rights. What is confirmed on the Gitea pricing page is that enterprise customers receive "Priority security bug fix notifications". Whether these notifications are reserved exclusively for customers does not follow from that.

Which versions apply in November 2026?

Since 28.0.0 Gitea no longer counts as 1.x. Sources that still call "Gitea 1.2x" the latest stable version are outdated. The enterprise support and release policy names rolling releases; we did not find a current LTS offering. Lunny's 2022 message mentions work on an LTS version at that time. According to the patch release page, GitLab publishes two regular patch releases per month (second and fourth Wednesday) plus critical patches as needed.

How do CI/CD and registries differ?

On the limits of GitHub Actions compatibility, the Forgejo reference states that GitHub Actions and Forgejo Actions are not the same. Actions without a host resolve to data.forgejo.org by default. For pull_request events from forks, no secrets are available, the automatic token has read permissions only and OIDC is disabled. With pull_request_target, by contrast, the workflow runs with the privileges of the base repository, including secrets and a write token, and should not execute untrusted code from the pull request. The tool cache does not persist without a volume. The Gitea comparison page lists as unsupported, among others, jobs.<id>.environment (ignored), problem matchers and error annotations. GITEA_TOKEN cannot push to Gitea's own package registry. Test your own pipelines on Gitea or Forgejo before moving. If you come from GitHub Actions, the article GitHub Actions pricing change 2026 puts it in context.

What do Forgejo and Gitea lack compared with GitLab?

The statements rest on each project's documentation. "Not found" means we did not find the feature there, not that it is certainly absent.

The Gitea table itself notes that it may be outdated. For SAML in Gitea there were pull requests (#25165, #29358); we could not conclusively verify their history.

How much server does each platform need?

Sources: GitLab requirements and installation methods, Forgejo installation and binary installation, Gitea documentation and database preparation. According to the installation page, GitLab recommends Docker and Helm for customers with 500 or more seats. The Gitea docs warn that SQLite scales poorly. Any figure for Forgejo would have come from field reports rather than vendor documentation, so it is not in the table. The guideline values have different reference sizes (single-node baseline for GitLab, small team for Gitea) and are not a capacity comparison under equal load. Our assessment: Forgejo and Gitea share a Go base, and we have no measured comparison of their resource needs. A guideline value is documented only for Gitea.

How secure is operation?

The numbers are not comparable and do not amount to a security ranking. Gitea publishes vulnerabilities as public GitHub advisories, while GitLab and Forgejo use other processes. A higher count therefore does not mean a product is less secure.

The entries belong to different classes of flaw (Ruby regexp, SSH authentication, reverse proxy authentication, NuGet token scopes, CI permissions). One class concerns CI runs from forks or reviews that obtain permissions or secrets: for Gitea CVE-2026-118386 (1 Nov 2026, severity High, affecting 1.19.0 to 28.2.0, fixed in 28.3.0) with a manipulated review commit_id, for Forgejo the pull_request_review entry above. Whether both were affected in the same way is not shown by the sources. Anyone running Forgejo or Gitea Actions with self-hosted runners should isolate runners, run fork pull requests without secrets and apply updates promptly. For GitLab, the Ruby dependency belongs in planning alongside the patch cadence.

How do you migrate from GitLab to Forgejo or Gitea?

Forgejo offers GitLab as a source under "New Migration". According to the Codeberg documentation, not only repository data but also metadata such as issues, labels, wiki, releases and milestones are imported. An access token for the source is required, and the "Git" option imports code only. The GitLab importer in the Gitea source code reads repository info, topics, milestones, labels, releases, issues, comments, merge requests and reviews (from MR approvals). The GitLab importer in the Forgejo source code likewise reads merge requests and reviews (from approvals, without review comments). For comment reactions, the Gitea code notes an open task. The Gitea migration page does not describe the GitLab scope. The importer is present in the Gitea repository, but we did not check its availability in the 28.x interface.

The table describes what the Gitea importer code covers. That something is missing from the importer is derived from absent functions, not from an explicit sentence in the documentation, and the Forgejo code was not cross-checked. One field report describes, as a single case, issues arriving without comments because the tool used did not import comments. After a test run, spot-check what arrived.

Our assessment of a staged approach:

1. Inventory: record repositories, groups, access models, webhooks, registry contents and CI dependencies.
2. Test run: import a few repositories with the importer and compare metadata by sampling.
3. Rebuild pipelines: translate .gitlab-ci.yml into workflows, recreate variables and secrets, set up runners.
4. Switch over: change access, webhooks and deploy keys, and keep a mirror or fallback for critical repositories.
5. Retire the old system: only after checking backups and restore.

From Gitea to Forgejo, a direct upgrade is possible according to the upgrade guide only up to Gitea version 1.22. A direct upgrade from Gitea 28.x is not documented as supported, and a repository migration remains as the alternative.

When should you stay with GitLab?

GitLab is the natural choice if you need built-in security scans (basic scans for SAST, secret detection and container scanning in Free, DAST and dependency scanning in Ultimate), epics, code owners, push rules or group SAML, and a subscription is planned. If many pipelines, registry contents and permission structures would have to be migrated, staying can also be more economical, because the importer does not cover these parts. The server requirements are higher, but the features are documented in one place. This is an assessment, not a vendor statement.

Forgejo or Gitea are the natural choice if a lean platform with repositories, review, issue tracking, actions and package registries is enough. This depends on requirements and is an assessment, not a suitability guarantee. In our assessment, the decision between the two mostly depends on licence (GPL v3+ versus MIT), governance (association versus company with an enterprise edition) and whether SAML or commercial support is needed.

Status and methodology

As of: 5 November 2026. The basis is the licence files, documentation, release pages and security notices of the three projects, retrieved on 5 November 2026, each linked in the text. Statements about a project come from its own sources. Statements on "Forgejo vs. Gitea" pages are one party's account and are marked as such in the text. "Not found" means we did not find the feature in the documentation cited, not evidence that it is absent. We mark our own assessments as such. The security count covers 5 May to 5 November 2026 and is not a quality ranking. Open points: minimum resources for Forgejo, SAML and Pages in Forgejo, the publication days of the GitLab patch releases 19.5.3 and 19.4.5, and the Forgejo code for the GitLab import. Later changes to licences, versions or features are not included.

Our approach at WZ-IT

For Forgejo we plan, migrate and operate the platform including database, storage, Actions runners, identity integration, backups and service levels. When migrating from GitHub, GitLab or Gitea, we inventory repositories, organisations, access models, issues, pull requests, releases, packages, webhooks and CI dependencies and plan the test run and cutover from that. Which metadata can be transferred automatically depends on the source system and its API.

The package for Git, CI and registry combines Forgejo with Woodpecker CI, Harbor and Vaultwarden, plus an identity service (Keycloak or Authentik) and an isolated runner. Dynamic secrets for pipelines and build counts per hour are not part of the package. For existing GitLab instances, our offer is described under GitLab managed hosting and operations, and for Gitea there is a page in the app catalogue. Monitoring runs 24/7, and the response to P1 incidents follows the service level. More on ongoing operations: Managed operations and CVE monitoring.

Weighing GitLab, Forgejo and Gitea for your team? We discuss requirements, pipelines and the scope of a migration with you. View Forgejo operations · View the Git and CI package · Book an intro call (free and non-binding)

Further guides

• GitHub Actions pricing change 2026: self-hosted runner fees and open-source alternatives
• Keycloak Alternatives: Authentik, ZITADEL and More
• Why companies need CVE monitoring
• Forgejo managed hosting
• GitLab managed hosting
• Package Git, CI and registry

Sources

• GitLab CE LICENSE (gitlab-foss)
• GitLab EE LICENSE
• GitLab pricing
• GitLab Docs: system requirements
• GitLab Docs: choosing a subscription
• GitLab Docs: release 19
• GitLab Patch release 19.5.1 (CVE-2026-110264)
• GitLab: installation
• GitLab: Community and Enterprise Edition
• Forgejo FAQ
• Forgejo: Release v9.0
• Forgejo: comparison with Gitea (one party's account)
• Forgejo: release schedule
• Forgejo: Actions reference
• Forgejo: upgrade guide
• Forgejo: release notes 17.0.1
• Gitea: GitLab importer (source code)
• Codeberg Docs: migrating repositories
• Codeberg Docs: Codeberg Pages
• Gitea LICENSE
• Gitea: pricing
• Gitea Enterprise
• Gitea: support and release policy
• Gitea: contribution guideline (CONTRIBUTING)
• Gitea-Blog: message from Lunny on Gitea Ltd.
• Gitea Docs: Actions comparison
• Gitea Docs: installation comparison
• Gitea Docs: database
• Gitea Docs: migration
• Gitea security advisories
• Gitea releases
• GitLab Inc. quarterly report (SEC)