We're considering moving away from Atlassian because our environment must remain fully on-premises and cannot move to cloud-only services. GitLab seems like the obvious replacement, but I'd like to understand what other platforms can provide a comparable developer experience.
Open source is preferred, although ease of deployment and maintenance matter too. I've looked at Gitea and Forgejo, but I'm unsure how well their Actions integrations handle test reports, SAST or SCA results, and publishing findings from tools such as OpenGrep directly into pull requests.
For teams running entirely on-premises or in an air-gapped environment, what does your toolchain look like for source hosting, CI/CD, dependency scanning, static analysis, test reporting, and compliance? Is GitLab the practical choice, or can a Forgejo/Gitea-based stack provide the same workflow without excessive integration work?
5 Answers
For a regulated or air-gapped company, GitLab is the boring but practical answer. It is heavier to operate, and you need to plan for backups, disaster recovery, upgrades, and high availability, but it reduces the number of separate systems you have to connect. A good evaluation would be to run GitLab first and have OpenGrep publish its results as CI artifacts or merge-request reports, then see whether the workflow meets your needs before committing.
If the goal is replacing the wider Atlassian setup rather than only Bitbucket, remember that source control and CI are usually easier to replace than project management. GitLab can cover a lot of the development workflow, while alternatives such as Plane may be worth evaluating separately for Jira-like planning. Keeping tools separate can also be reasonable if each one does its job well.
The source forge and CI provider don't necessarily need to be the same product. You could use Forgejo or Gitea for repositories and pair it with a separate on-prem CI system such as Buildkite or another workflow engine. That gives you more flexibility, although it also means owning more integrations, authentication, reporting, and maintenance.
Forgejo and Gitea are excellent for source hosting and smaller developer-focused setups. Their Actions are close enough to GitHub Actions for many workflows, but the experience becomes more manual when you need security findings and test results to appear as first-class pull-request checks. They can work, but expect to build more of the reporting and integration layer yourself.
GitLab is probably the safest choice if you want an all-in-one platform with mature CI, security scanning, reporting, and compliance features. You can evaluate the Community Edition with a GitLab Runner fairly quickly, even using a basic Docker Compose setup. It also has reusable CI templates for SAST, DAST, dependency scanning, and secret detection, so you don't have to assemble every integration yourself.
The Actions syntax is familiar, but that doesn't automatically provide the same pull-request UI and security-report integrations. That's where the extra effort tends to appear.