# ADR 0007 — Forgejo over GitLab

**Status:** Accepted

## Context
The platform needs Git hosting, a container registry, and CI. GitLab CE bundles
all of this plus scanning but wants 4 GB+ RAM just for itself — heavy on a
single shared host. Forgejo (community fork of Gitea) is lightweight and ships a
built-in package/container registry and GitHub-Actions-compatible CI.

## Decision
Use **Forgejo** for Git + built-in **container registry**, with **Forgejo
Actions** (or Woodpecker CI) for pipelines. Security scanning via **Trivy** and
secret scanning via **gitleaks** run inside CI. No Harbor, no GitLab, no Jenkins.

## Consequences
- ✅ Low RAM footprint leaves resources for customer sites.
- ✅ One tool covers repos + registry; scanning is added as CI steps.
- ✅ Actions are GitHub-compatible, so pipelines are portable and familiar.
- ❌ Less batteries-included than GitLab (no built-in RBAC-heavy registry,
  vulnerability dashboards, etc.) — acceptable at this scale.
- ↔️ If serious registry RBAC/signing/scanning is later needed, adopt **Harbor**
  as a superseding ADR rather than migrating to GitLab.