News — OpenCommit News

ForgePort: migrate your repositories from GitHub to OpenCommit

OpenCommit Foundation — Sat, 19 Sep 2026 00:00:00 +0000

We know that the biggest hurdle to moving away from GitHub isn’t necessarily ideology, it’s quite often logistics. Migrating one repository by hand is doable. Especially with Forgejo’s excellent UI based migration tool. Migrating dozens, or your entire account, is a weekend of clicking, waiting and double-checking that nothing got lost.

So today we’re launching ForgePort, a small CLI tool that migrates repositories from GitHub to the OpenCommit platform. Whether you want to bring over a single project or bulk-migrate every repo from a user or organization, ForgePort does the heavy lifting for you.

Get it here: https://opencommit.eu/opencommit/forgeport

Take the whole account, not just one repo

ForgePort reads all of its configuration from a single YAML file in the directory where you run it. Each repository is migrated one at a time through the Forgejo migration API, with a short random pause between migrations so we don’t overload the destination server.

Point it at one repository and it migrates one:

2026/01/01 12:00:00 migrating https://github.com/foo/bar -> opencommit/bar
2026/01/01 12:00:05 migrated: https://opencommit.eu/opencommit/bar

Or give it a single user/org name and it expands that into every source (non-fork) repository for that account, then works through the list. Forks are always excluded, and you can control whether private and archived repositories are included or not.

What gets migrated is entirely up to you: issues, pull requests, milestones, labels, wiki, releases and more can each be turned on or off per repository, or set once in a defaults section and inherited everywhere. Please note that if you choose to migrate an entire user or org’s set of repositories, you can only set options as defaults not per repo. If you wish to have more control, you will need to provide a list of repos and their options in the configuration file.

Take a test run with -dryrun

Not sure what you’re about to move? ForgePort has a -dryrun flag that resolves every repository (including user/org expansion) and prints exactly what would be migrated, without contacting OpenCommit at all. Run it, review the list, and only then migrate for real.

Reasoning with secrets in mind

Migration needs tokens: a GitHub personal access token for the source repositories and an OpenCommit (Forgejo) API token for the destination. Both can live in your environment (GITHUB_TOKEN, FORGEJO_TOKEN) or in the config file, with the environment winning. Because the config may contain secrets, it is git-ignored. Never commit migrate.yaml if it contains secrets.

Just getting started

ForgePort is written in Go and built on our own Forgejo SDK. You can grab a pre-built binary or build it from source (requires Go 1.26 or later). It’s distributed under the EUPL-1.2 license, and while we built it for OpenCommit, it should be usable to migrate to any Forgejo-based platform — just point it at your destination’s URL. We welcome pull requests for feature additions and improvements.

One honest limitation for now: ForgePort does not migrate packages. You’ll need to handle those yourself, for example with Skopeo and a small bash script.

We hope ForgePort removes one more excuse for staying put. Your code deserves a home that shares your values, and moving in just got a lot easier.

For the full configuration reference, check out the ForgePort repository.

Security patch to Forgejo v16.0.5

OpenCommit Foundation — Thu, 17 Sep 2026 00:00:00 +0000

We’ve updated the OpenCommit platform to Forgejo v16.0.5 tonight due to a security release made by the Forgejo project earlier today, in fixing a critical CVE.

From the Forgejo release notes

CRITICAL

Prevent ApplyDiffPatch from mutating bare repo config. When a patch is applied to a Forgejo repo through Forgejo’s Web UI, Web cherry-pick, or /diffpatch API, a git apply --index command-line is executed to apply the patch to a temporary bare git repository. An unusual behaviour of git apply can cause arbitrary files the working direction to be changed, which is within the bare repository, and that behaviour can be abused by a malicious user to perform unexpected operations on the Forgejo host.

This vulnerability allows execution of arbitrary processes on the Forgejo host as a remote code execution attack. The issue has been addressed by ensuring that the working directory is an unrelated temporary directory.

This vulnerability is a variation on PR 13705, a vulnerability that was fixed in Forgejo v15.0.6. This variation was not detected at that time.
Prevent CSRF attacks on OpenID identity associations. When OpenID sign-in is enabled on a Forgejo host, a logged-in user can add an additional OpenID address to their user account in the /user/settings/security page. The HTTP endpoint responsible for registering an OpenID address is an HTTP GET request, as required by the OpenID specification. The endpoint was vulnerable to a CSRF attack where an unexpected GET request generated by a user’s browser can register an unexpected OpenID identity on their currently logged-in Forgejo account.

The vulnerability has been remediated by validating that a request to add an OpenID identity is initiated by the currently logged-in user.

Lastly

As always, the upgrade happened without any changes to your repositories, branches, or settings. Everything is exactly where you left it. If you spot anything that behaves differently, don’t hesitate to let us know.

For the full release notes, we’d like to refer you to Forgejo themselves: https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/16.0.5.md

PatchBot: automated dependency updates for your repositories

OpenCommit Foundation — Tue, 15 Sep 2026 00:00:00 +0000

Keeping your dependencies up to date is one of the most important — and most tedious — tasks in project maintenance. Today, we’re making it easier: PatchBot is now available on OpenCommit.

PatchBot is built on Renovate, the widely-used open-source dependency update tool, and runs on a fixed platform-wide schedule for version discovery. It watches your dependency files and opens pull requests when new versions are available. It supports package.json, go.mod, Dockerfile, Actions, and more.

Enable PatchBot in two steps

Add the topic patchbot to your repository
(Repo → About section → edit Topics → add patchbot).
Invite patchbot as a collaborator with Write access
(Repo → Settings → Collaboration → add patchbot).

That’s it. Within about an hour, you’ll see an onboarding pull request with a minimal renovate.json, and a Dependency Dashboard issue. The Dependency Dashboard lists all detected dependency managers and pending updates.

From that point on, update PRs appear whenever new versions are released. Merge them like any other pull request.

Customize PatchBot

PatchBot runs on a platform-wide schedule (roughly hourly), but you control what it does. Your repo’s own renovate.json controls everything: automerge rules, grouping, labels, dependency ranges, and more. See Renovate’s configuration docs for all available options.

Platform-wide limits apply (PR rate caps), so very large backlogs and rapid dashboard interactions appear gradually, not all at once.

Disable PatchBot

Remove the patchbot topic from your repository. At the next run (within about an hour) your repo is no longer managed. Close or merge any open update PRs yourself.

Learn more

For full details, visit the PatchBot documentation. Questions or problems? Check the Dependency Dashboard issue in your repo first, or ask in the issue tracker.

Maintenance: Forgejo, Valkey and more

OpenCommit Foundation — Mon, 07 Sep 2026 00:00:00 +0000

Good evening, fellow OpenCommitters!

The infrastructure maintenance train has arrived safely at the station. We’ve successfully updated several components to newer Helm chart versions:

Alloy
cert-manager
Forgejo
kube-prometheus-stack
MetalLB
Sealed Secrets
Valkey
CloudNativePG

We also updated the Forgejo image and the CloudNativePG manifest.

The biggest upgrade is Valkey: it’s now running in a high-availability setup with one master and two replicas spread across the cluster. Each instance has its own ceph-block persistent volume, while a PodDisruptionBudget helps ensure that at least two instances remain available during planned disruptions.

In short: fresher charts, sturdier infrastructure, and Valkey now has backup dancers.

A news timeline on your dashboard

OpenCommit Foundation — Tue, 04 Aug 2026 00:00:00 +0000

Your dashboard just got a little more informative!

The latest news from the OpenCommit platform and foundation is now shown at the top of the dashboard, so you can see what’s happening at a glance.

The timeline highlights the most recent updates, with each item linking straight to the full story. No more digging through the blog to find out what changed. It’s right there when you sign in.

This will also be our new, preferred way of keeping you up-to-date with any technical changes we make to the platform.

Lastly, we’re planning to consolidate all news articles for both the foundation as well as the platform on a dedicated site in the near future.

Publish your own packages on OpenCommit

OpenCommit Foundation — Tue, 04 Aug 2026 00:00:00 +0000

You can now publish your own container images on OpenCommit, powered by the built-in package registry.

Sharing images with your collaborators, or with the world, is now as simple as building and pushing:

docker build -t opencommit.eu//:latest .
docker push opencommit.eu//:latest

Because every project on OpenCommit has its own package space, images stay organized next to your source code, and access follows the same permissions you already use for your repositories.

We’re starting with container images. Other package formats will follow in the future. You’re always welcome to submit a support ticket with your prefered order at https://opencommit.eu/opencommit/support/issues.

One thing to keep in mind: we’re still a small platform, run by a non-profit with limited resources. Disk space isn’t cheap, especially nowadays. Unlike the big commercial hosts we don’t have unlimited storage at our disposal. To keep the service sustainable for everyone, we’ve set a hard limit of 2TB for container images for now.

Please treat the new service with care: only push what you actually need, clean up images you no longer use, and avoid storing large or redundant layers. If the demand is there, we’ll happily revisit the limit as the platform grows.

What's new in Forgejo v16

OpenCommit Foundation — Sat, 01 Aug 2026 00:00:00 +0000

We’ve upgraded the platform to Forgejo v16, the newest release of the forge software that powers OpenCommit.

Alongside the regular round of bug fixes and performance improvements, this update brings a number of refinements to the everyday workflow. Here are the highlights you’ll notice as a user:

Notifications you can tune

Repository watch settings are now granular: you can choose which parts of a repository you want to receive notifications for Issues, Pull requests, and Releases.

Better pull request reviews

The commits view on pull requests has been redesigned: cleaner, easier to read, and responsive.
Review comments can now span multiple lines. Hold Shift, click the plus button on the first line of the range, and drag down to the last line.
Fixes for misplaced review comments: they now show up on the right diff, even when lines have moved or been removed in later commits.

Smoother everyday operations

Repository migrations now show their progress, so you can verify that a long-running migration isn’t stuck.
Adding team members to your organization is easier: a dialog right on the member list lets you add someone to multiple teams in one go.
Downscaled avatar variants are now served where full size isn’t needed, reducing bandwidth usage and speeding up page loads.
A consistency check on incoming Git objects rejects corrupt pushes before they can break a repository.

Forgejo Actions

Workflow runs can now be manually marked as prioritized, so they execute before all others.
Skipped checks are now marked as skipped instead of succeeded.
Workflow if conditions are evaluated on the platform itself, speeding up workflow execution.
Completed workflow runs, including their logs and artifacts, can be removed via the UI or the API.
Authorized Integrations let workflows authenticate API and Git access with short-lived JWTs, an alternative to static tokens.

As always, the upgrade happened without any changes to your repositories, branches, or settings. Everything is exactly where you left it.

If you spot anything that behaves differently, don’t hesitate to let us know.

For the full release notes, we’d like to refer you to Forgejo themselves: https://forgejo.org/2026-07-release-v16-0/

A homepage we're proud of

OpenCommit Foundation — Wed, 29 Jul 2026 00:00:00 +0000

The public face of OpenCommit just got a refresh.

Our homepage has been redesigned to look more professional and to better reflect who we are: a European, non-profit foundation providing a free and independent home for open source projects.

We feel the new page is cleaner and more welcoming, with a clear introduction to the platform, a summary of what’s happening across the forge, and an easier path to signing up or exploring repositories.

We sincerely hope the new look makes it easier for newcomers to understand what OpenCommit is all about and for you to point people at when you invite them to join your projects.

A shared actions runner for everyone

OpenCommit Foundation — Fri, 24 Jul 2026 00:00:00 +0000

We’re happy to announce that OpenCommit now offers a shared actions runner, available to every project on the platform.

Until now, running Forgejo Actions meant setting up your own runner. Not anymore: your workflows can now run directly on our shared runner, without the need to host or maintain anything yourself.

Just add a workflow to your project and your CI/CD pipelines will start executing.

A few things to keep in mind: we’re starting with a single shared runner, so builds are scheduled on a first-come, first-served basis. We’re still a small platform, run by a non-profit with limited resources, so please be considerate. Keep your builds lean, avoid long-running jobs, and don’t use the runner for anything other than what you need.

As the platform grows and the demand is there, we’ll look into adding more runners and capacity.

What's new in Forgejo v15

OpenCommit Foundation — Tue, 21 Apr 2026 00:00:00 +0000

We’ve upgraded the platform to Forgejo v15, a new major release of the forge software that powers OpenCommit — and, fun fact, the 100th release of Forgejo.

Forgejo v15 refines day-to-day usability and security, and brings new capabilities to Forgejo Actions. Here are the highlights you’ll notice as a user:

Access tokens scoped to specific repositories

When creating an access token, you can now restrict it to a specific list of repositories. The token won’t be able to operate on anything outside that list, keeping API access more secure.

Containers auto-link to repositories

Containers you push to the package registry are now automatically linked to their repository. Either when the name starts with {owner}/{repo} or when the container has the org.opencontainers.image.source label set. No more manual linking.

Better error messages

Pushing to a repository without write permission now returns a much more helpful message: it tells you who was pushing (handy when you used the wrong key or token), to which repository and branch, and how to create a PR via the AGit workflow.

UI improvements

Issue labels can now be excluded with a simple button, no Alt key needed.
The releases list is fully responsive and works on screens of all shapes and sizes.
Git notes can be edited, added, and removed from the single-commit view in pull requests, and editing can be cancelled.
Archiving a repository now suggests you document the reason.
Numerous accessibility improvements for screen reader users.

Forgejo Actions

Reusable workflows are now expanded into their individual jobs, with separate logs and the ability to run on different runners.
OpenID Connect support lets workflows authenticate with third-party systems using short-lived tokens instead of long-lived secrets.
Ephemeral runners and a simplified, web-based runner registration are now available.

For the original Forgejo release post, please see: https://forgejo.org/2026-04-release-v15-0/

OpenCommit is now sponsored by UptimeRobot

OpenCommit Foundation — Wed, 25 Mar 2026 00:00:00 +0000

We’re pleased to share that OpenCommit is now officially sponsored by UptimeRobot.

UptimeRobot is a well-known monitoring service that helps developers and organizations keep their websites and services online by providing reliable uptime checks and alerting. Their support aligns closely with our mission to offer a stable, accessible, and independent Git hosting platform for open source developers.

This sponsorship will contribute to improving the reliability and performance of OpenCommit, particularly in the area of service monitoring and incident awareness. Having robust monitoring in place is essential for maintaining trust and ensuring that developers can depend on the platform for their work.

We appreciate UptimeRobot’s support and their recognition of the importance of open infrastructure. Their contribution helps us continue building and maintaining a sustainable platform for the open source community.

For more information about UptimeRobot and their services, visit their website.

A New Home for Open Source: OpenCommit is Live! 🚀

Martijn van der Kleijn — Sat, 31 Jan 2026 00:00:00 +0000

As Chair of the Board for the OpenCommit Foundation, I am absolutely thrilled to announce that our git hosting service for open source developers is officially live!

We are a new, growing foundation driven by a simple but vital mission: providing a reliable, independent home for open source projects. Our goal is to be more than just a hosting provider; we want to be a cornerstone in a future, federated network of forges, standing alongside fantastic community efforts like Codeberg.

Why OpenCommit?

I started this project with the philosophy One Is None.

Currently, our global open source community is heavily reliant on a single, commercial entity. While we have immense respect for the work others are doing, we realized that true resilience requires diversity. Even an excellent platform like Codeberg has limited resources. And if we only have one community alternative, we haven’t truly solved the “one is none” problem.

We’ve chosen Forgejo as our upstream project. While federation is still being perfected by the Forgejo team, it remains our North Star. We aren’t waiting for the perfect future to start helping, though. We are launching today so we can grow together and be ready when federation arrives.

A Solid Foundation

To ensure this project’s future and its openness and transparency, we’ve established the OpenCommit Foundation as a tax-exempt non-profit (ANBI) under Dutch law. The legal groundwork is complete, and we have a dedicated site for our documents, reporting and contribution options. We are also proud to have Soverin as our email partner, helping us keep our communications secure and aligned with our values.

In the coming weeks, we’ll continue to refine our platform and eliminate any bugs we find. We’ll be growing our documentation and some of the features in the platform, keep an eye out for updates!

Join Us!

The wait is over. Head over to https://opencommit.eu and create your account!

We’ve built this for you. Please treat your fellow developers with respect, and help us look after our shared resources. If you believe in what we’re building and want to support our efforts, you can do so easily via our contributions page.

We are so excited for the future we’re going to build together! Thank you for being part of this journey from day one! 🚀

— Martijn

OpenCommit chooses Soverin as email partner

OpenCommit Foundation — Tue, 27 Jan 2026 00:00:00 +0000

At Stichting OpenCommit, we are building an open, reliable and transparent platform for hosting the source code of open-source projects. We do this as a non-profit foundation with a clear mission: to give developers a free, European place to collaborate on open-source software.

In everything we do, we pay attention not only to technology, but also to values. That’s why we choose our partners very deliberately. For email handling - both for the foundation itself and for our platform - we are now working with Soverin.

Why Soverin?

OpenCommit chooses Soverin because of their clear focus on privacy, digital sovereignty and transparency!

You pay with money instead of with data, there is no business model around tracking or advertising, and they work with open standards and European hosting. That aligns very well with how we ourselves view the internet and infrastructure.

Concretely, Soverin provides the email infrastructure for:

The operational communication of Stichting OpenCommit
The email handling from our platform at https://opencommit.eu

Email is a small part of our infrastructure, but crucial in our communication. It hasn’t been just about “does it work?” for a long time already, but rather about questions like:

Who has access to the data?
Where is that data stored?
How transparent is the company behind the service?
And very practically: does our mail actually arrive properly?

Soverin’s ISO certifications (ISO 27001 / 9001 / 14001) and NIS2-readiness make our choice even easier.

Thanks to this partnership, we can be confident that our email communication is set up securely, privacy-friendly and future-proof. In line with the principles that we as a foundation stand for.

Building together towards a sovereign digital ecosystem

With this step, we come a little closer to our goal: a fully-fledged, open and transparent git-hosting platform, hosted on European servers, with an infrastructure that matches the values of the open-source community.

We are therefore pleased that we have found in Soverin a partner who wants to go in the same direction.

Would you like to know more about our choices regarding digital sovereignty and openness, or are you curious about how we set up our infrastructure? Feel free to contact us - we are happy to share our experiences.

Do you also want your organization to have more sovereignty and privacy? Consider Soverin.

🎶 Everything is awesome...

OpenCommit Foundation — Thu, 30 Oct 2025 00:00:00 +0000

🎶 “Everything is awesome… everything is cool when you’re part of a team.” 🎶

Wrenching on our new platform and getting closer every day.

Kubernetes in place, Ceph is clustered, CloudNativePG is up . . .

We’re turning wrenches — one subsystem at a time — and the ship’s really starting to purr. More to come. 💗

If you’d like to support the project, details on opencommit.nl.

Milestone: ANBI status

OpenCommit Foundation — Wed, 15 Oct 2025 00:00:00 +0000

Great news! 🎉 Checking off a milestone: Stichting OpenCommit has officially been granted ANBI (Algemeen Nut Beogende Instelling) status in the Netherlands.

This means we’re officially recognized as a public benefit organization — a big step in our journey to support and grow Free/Libre and Open Source Software.

We’re already looking ahead to the next milestone: the beta release of our Forgejo-based service. 🚀 Can’t wait to share more soon!

And remember: ANBI status means your donations are tax deductible. 🙌

👉 Check out opencommit.nl if you want to help out!

#ANBI #OpenSource #FLOSS #StichtingOpenCommit

A quick recharge

OpenCommit Foundation — Mon, 15 Sep 2025 00:00:00 +0000

A quick recharge, then back to full throttle on our new service.

Foundation created by notary

OpenCommit Foundation — Mon, 16 Dec 2024 00:00:00 +0000

The OpenGit Foundation has officially been created today through our notary.

The founding board members immediately started work to arrange all manner of organizational matters like for instance a bank account and website.

Yubico's Secure It Forward programma

OpenCommit Foundation — Tue, 15 Oct 2024 00:00:00 +0000

Yubico sponsored the foundation by accepting Stichting OpenCommit (then still OpenGit) into their “Secure It Forward” program.

They support us by providing a number of YubiKeys that the foundation can use to secure its activities and systems.