Roku developer repositories moved from GitHub to GitLab
blog.roku.com284 points by cxr 16 hours ago
284 points by cxr 16 hours ago
Gitlab, for all it's flaws fits so much better in "regular" company/organization projects. It's more in line on what people involved in software dev and all the tasks around it have as a mental model and less of a "open source dev social network" like Github tried to be almost from the start and lately got Microsofted. An lets not even bring the CI / Github Actions topic..
> fits so much better in "regular" company/organization projects
How so? I used both at work and they're functionally the same.
Fundamentally, that's just git with a few common features like pull requests, account management and bug tracking.
Choosing one over the other is just a matter of details. How well it integrates with the corporate network, how pretty it looks, the options regarding CI/CD integration, overall popularity and community, etc... Last time I got to choose, I went with Gitea, because performance was good and it met my needs.
I found it much easier to organize repos hierarchically with GitLab. Permissions also seemed easier to setup.
Gitlab is terrible at cross-group permissions if you use dedicated or self-hosted. Because gitlab.com is made to keep top level groups separate (separate tenants). Things like cross-group MR approval, use of the built-in artifact repositories, terraform module registry, gitlab components, and so on...is very messy...so many granular cross-group allows you have to turn on.
Yeah I agree. There are only very minor differences.
Isn't being able to self host it on your company network a big important feature? Like for all the non-public branches and projects you keep internal. Gives you the same UX for everything.
This sounds pretty annoying though: https://docs.gitlab.com/administration/license_usage/
It is important for some companies. https://docs.github.com/en/enterprise-server@3.22/admin/inst...
Is it more expensive?
Than Gitlab?
I'm not sure, you'd have to check their pricing pages.
It doesn't say does it? For self-hosted commercial use? Wish either were open-source.
That is important or critical in some companies. But that's surely not what they meant by fitting their "mental model" better.
assigning reviewers is a major pain with gitlab. there have been multiple issues filed to support adding a group as a reviewer, only to have them closed by gitlab, saying thats not the ‘direction’ we’re going in. instead, you can do a /request_review @group in the description, but each person gets added individually so you can’t see which reviewers are in which group, you don’t know if you have the right groups to satisfy the codeowners files, etc. it’s such a mess.
Is Gitlab Open Source or one of those weird "code available" projects? Can we make a PR?
Good and bad moments, honestly. GitLab would benefit massively if they went back and deleted all of the crap they added during their "feature checkbox craze" years. Just looking at the left menu, "Secure" "Deploy" "Operate" "Monitor" "Analyze" "Auto Devops" and all this crap urgently needs to go and get out of peoples way.
And, dare I say it? There is a place for GitLab in a world where most development happens with coding agents. Its perfectly fine to be the version control & CI place. But they got stupid management (just like Atlassian or GitHub) that have convinced themselves they must be the orchestrator, the middleman, the gatekeeper to inference. They neither are nor will be that and if they go down the path of Copilot trying to ruin their product to make it happen, it will be the end.
> "Secure" "Deploy" "Operate" "Monitor" "Analyze" "Auto Devops"
Deploy contains the released versions and packages.
Operate is for Infrastructure as Code.
Analyze are project and CI statistics.
I doubt you want to remove any of them, they are quite needed functionality.
From my experience nobody uses them, they just want a pretty ui to view job status and logs.
Gitlab should be a private company
Their current CEO was brought in to sell the company to private equity like he did with New Relic in his last job. Unfortunately for him, private equity is being selective in which SaaS companies they acquire right now with interest rates spiking and uncertainty over the future of SaaS as AI becomes more capable. Acquisition by an AI lab was probably their next best hope, but the labs seem to all be rolling their own developer platform instead. Maybe Bending Spoons will make a move if the stock revisits its lows.
(Assuming the move was due to the recent outages)
I don't know that the grass will remain green for very long anywhere in this current scenario.
GitHub is not having most of its outages because GitHub's engineers are using AI (although there might be a case or two of this). The primary driver of the outages is the fact that developers can move so much faster in their workflows. Every single user of these products is placing a heavier demand on the system. I don't think this ramping of demand will cease any time soon. I fully expect to receive an email any second now about how my 5,000 req/hr GH API quota will be cut in half before 2027.
I don't understand how GitLab would be immune from these forces, unless we were willing to reach for self-hosted & enterprise plans. Both of which GitHub offers.
Apparently they have 14x more code than the same month last year in github.
I'm sure most of it is garbage.
Worth mentioning that Roku is being acquired by Fox so in the virtue battle with Microsoft neither are clean
What virtue battle?
Microsoft previously owned a left leaning news network MSNBC (now MSNOW) in contrast to Fox’s right wing news networks.
Microsoft hasn’t owned any part of MSNBC since 2014.
The reason MSNBC recently changed to MS NOW is because the relationship to NBC ended.
Hilarious that Americans describe MSNBC as left leaning. The Overton window has moved so far right that a network that reports news with a centre-right establishment tilt is classified as leftish.
I get your point, but that really isn’t accurate. Neither MSNBC/MSNOW nor Fox News “report with a tilt”, they are explicitly opinion journalism. The vast majority of their programming is political commentary.
From US point of view even right wing European parties are socialists, that is how extreme late stage capitalism is.
This is an important point. You have a giant conglomerate with a constant growth of new conflicts for their customers.
it seems like all the media companies are being bought up by a select few people
does not portend good things for the future
There's no way the future is good, near term or long term. Not unless you're a part of that specific class.
Especially judging by whats happening in the gaming industry right now. Mass layoffs everywhere from once leading lights in the industry, now acquired by big business and having to succumb to broad budget cuts.
I hope for more indie, in games and software - more lifestyle & small businesses - where creativity and uniqueness can flourish
Well there is certainly more "indie" AI slop nowadays. The latest example is Next Fest on Steam right now, almost 8k demos and, well, just have a look, or read any media outlet who is reporting on it - it's an absolute travesty.
Yup, I let streamers help me figure out what games are worth playing.
Lately, I'm just watching About Oliver, he does blind / no-wiki / no-backseat gaming. If you are a Minecraft fan, you'll experience something no one else in the community can do. He's currently doing a Create series, but watch the first season first, it's really special.
https://www.youtube.com/@AboutOliver
Also working on an NES harness instead of gaming myself after a too long stint with X4 foundations :x
I'm confused, it looks like he plays 90% Minecraft and KSP?
I agree in principle though - I usually search on YT for reviews and/or gameplay before I buy anything these days, since gameplay trailers are like Hollywood movie trailers: they either give too many spoilers and/or they trick you into buying something that isn't what I want.
Check out the playlists, he's done a number of games. I have the Outer Wilds on in the background. (very cool game play)
Oliver is not a streamer I get recommendations from, he gets recommendations from his followers. I watch him more for the blind playthroughs of my more favorite games.
I've used some genre top lists YT videos lately
I still can't believe EA just shut down Bioware.
Of course considering who just bought EA (PIF, a Saudi fund + Kushner and some other asshats) and it all makes sense. But I'm still shocked and really sad.
Bullfrog, Origin, Mythic, Westwood, Maxis and others.
As for Bioware - Mass Effect Andromeda, Anthem, Dragon Age: The Veilguard.
EA's prior behaviour combined with Bioware's recent performance would be enough for this to make sense.
This also isn't unusual with what's happening across the AAA gaming industry; take a look at the layoffs at Microsoft.
Bioware is a cadaver. All the original people are gone, they aren’t even a shadow of their former self.
At the same time, more people are getting news from independent sources on social media and self publishing platforms. I can’t remember the last time I watched cable news.
"independent" may be a misnomer these days, much of it is catering to the audience and political alignment, with people living in different realities
the new incentives do not seem to have served us well, and perhaps worth noting that the same oligarchy controls the algorithms of the new platforms
Independent in the sense that they're not part of the corporate media.
I'm not so sure, they are still beholden to click / subscription optimization, which has their content and headlines tuned for their base. Think outfits like Laura Loomer or Meidas Touch.
I generally look for those whose primary means of income is not their reporting or podcast.
for the future? this has already been happening for years and is a major reason we're in the predicament we're in
What predicament are we in?
Consolidated and Sanitized media controlled by a few brands, that coordinate propaganda messaging.
In my almost 4 decades of life, today is the least amount of control over information that leaders have had, whether political or business.
When I was younger, the only way information, and especially video/audio was spread is via a select few outlets.
Today, anyone can upload anything to a variety of servers and spread the information within seconds.
That was more true in the 2000s than it is today.
Today everything you’re exposed to has to be approved for release by Google, Meta, and all of the backbone providers along the way - or you’ll be shouting into the void.
TV is dying and streaming is stagnant so I don’t think it’s particularly worrisome that big companies are buying up the dinosaurs before they go extinct.
One problem I see with this is discoverability. Most people viewing these "independent" sources are seeing them on some platform like TikTok/YouTube/FB/Twitter where algorithms have a lot to say who sees what when.
Another problem with these "independents" is they are fed their material via farms that have been proven to be run by Russian operatives which makes the quotes around independents necessary.
That is a problem of not having unlimited time. The internet (at least as it broadly exists now) solved the problem of a few people being able to prevent access to information, and in such a manner that distribution is almost instant.
Lack of unlimited time means people will need some way to choose which information to learn and which to not learn, which may well be to choose whatever is curated by Meta/Alphabet/etc, but that is a choice made by the user, not by leaders.
> that is a choice made by the user, not by leaders
Within the constraints of the algorithms and controls those leaders put into their platforms. Most of those algorithms were designed to maximize ad profits, which is tied to time on platform, with the algorithms converging on anxiety and similar negative emotions. Big data can be dangerous
Information has never been cheaper to spread, and facts never more expensive to verify.
News outlets used to be held to journalistic standards; these days they can self-regulate. Finding reputable news sources is getting harder and harder.
at the same time, the nature of "news" content has moved away from reporting what happened to speculating what might happen
> Today, anyone can upload anything
This is not necessarily better, I'm still unsure myself. I would like it to be true, but misinformation and foreign influence campaigns are much more effective these days.
The most significant change is that we no longer have a shared reality. Before our current situation, at least we got the same news. Today we get different hyperbole.
the greatest wealth concentration and inequity in american history, blatant corruption and nepotism
an out of control, bipartisan oligarchy
The majority of HN has been on the winning side of this equation, benefiting greatly from the rise of the computer, internet, and now Ai. This is not most people, we forget about them, we tell them it's their own fault when it is not. The game is not fair, it's rigged for most humans.
Michael Sandel explains it better than I can yet
Funny how within 4 comments we've went from mundane tech news to communist political philosophers
What about OP's comment rings communistic, or even political to you? Or is it the link between information control and wealth consolidation that you find controversial?
I have clearly never claimed that OP is a communist, you're misinterpreting
He did, however, recommend an author at the end of his comment, and that's whom I was referring to when I said "communist political philosopher"
Michael Sandel is not a communist, he thinks capitalism and markets are the better way to organize an economy. He's trying to reframe the conversation around meritocracy, the inequality this leads to, and distributive vs contributive justice.
Distributive is more the communist / far-left take from the rich and give to the poor. Contributive is about the dignity of work. People are happiest when they are part of a community, have work which can support a family and contribute to the greater good, and above all receive social recognition for their contributions. (like the essential workers during COVID we rarely speak of these days)
While we've always had technological advancement and automation, the computer changed things. We stopped producing new types of tasks for many humans. Almost all new tasks are cognitive. We told people "if you want to get ahead in the new economy, go to college." Well, most people do not have college degrees, and within that there is an implicit insult that if they are suffering, it is their fault for not doing what we told them. The people who rigged the game also obviate these people and make it harder for the average person to have a decent life.
I recommend his conversations with Daron Acemoglu. Both have perspectives worth hearing and considering.
Roku isn't a media company. They make hardware and license software.
They are also a media company. They run the Roku Channel streaming service which produces original content and also has a 5% share of all us tv viewing tv viewing.
Paramount+ has a 2.5% share and Disney has a 4.7% share for comparison.
https://advertising.roku.com/learn/resources/nielsen-gauge-4...
Ok. But I really wouldn't trust numbers coming from the same company that produces them. A better gauge would be Nielsen. Roku doesn't even show in the top 10.
https://www.nielsen.com/data-center/top-ten/
Personally I've had Roku from the beginning and never once saw or watched the Roku Channel. But I did look it up now. Looks like all "D" rated films and really old media. They produce nothing and licence and syndicate everything.
They are an ad and media distribution company.
The hardware looses them $80m+ while the add and media distribution brings them in $1b+.
The hardware is a side hustle run at a loss to acquire users for the main business.
I did not know this. Can you expand on it? When I was on Roku channel it looked like it was all free. I didn't watch long enough to notice if it had advertising embeded in it. If it is ad supported your telling me after distribution costs their advertising network brings in 1b+?
It is a strong signal that open solutions should be available to swap into when the enshittification comes.
I have been unable to find an open equivilent of Roku, Apple TV, and Nvidia's Shield, but would be interested in sponsoring an open version via https://bounties.fulu.org/ that could be manufactured through CrowdSupply. An open design and code to run on the hardware avoids future commercial capture. One can then own their media system end to end, from storage, streaming (Jellyfin ecosystem), and hardware on a display.
I've heard this is a recent clout chaser trend, more with smart TVs directly than a stand along accessory.
Not sure if that translates into real demand for it, most consumers are going to consumer.
For one that deal hasn't closed and secondly not sure what the connection is between Roku leaving Github and FOX. Please expand on relevance.
I wish they would spill some tea and articulate why they moved.
Would also like a write-up. People assume it's just because of GitHub outages, but GitHub is slightly worse in every aspect, so for big projects and organisations it compounds to being quite messy to manage and operate.
GitLab is thought-out to support larger groups with more complex pipelines, and while it's got it's own set of quirks, it doesn't begin to compare, GitHub in contrast seems like a toy forge for toy projects.
Having used GitLab pipelines, I would definitely not describe it as well thought out. Their method of forcing all jobs/pipelines for a repo through one file controlled with a load of ‘if’ rules is a complete mess. Makes running multiple pipelines for one repo a huge PITA. Compared to GitHub Actions or Jenkins its a pretty poor experience
This only happens on poorly thought pipelines and GitHub actions model or Jenkins high level directives won't make up for it. Eventually it'll break.
In Gitlab you can use the main file for describing high level stage pathways (tests, builds, deployments...) and offload individual control of jobs to granular files. Tests can be self contained child pipelines. Templates make them easy to replicate and components give them more flexibility.
You can do a lot more than GitHub actions with a lot less complexity than Jenkins.
why? like having a dozen outages in the last couple months isn't a good enough reason why?
GitLab is just as bad, just not as big so doesn't get the coverage. https://status.gitlab.com/pages/history/5b36dc6502d06804c083...
And of course many people self-host which changes a lot of the equation (which you can also do with GitHub, but not for free - and FWIW our self-hosted premium gitlab has about an hour a day downtime, which we've been told by the team responsible is an unavoidable side-effect of backing up gitlab).
I was responsible for administering a self hosted GitLab instance for a medium sized company and our backups never required downtime. The built in backup command doesn't require downtime but also isn't a consistent point in time snapshot (specifically because the instance keeps running while the backup is being taken). If they've decided they need one for some reason, stopping GitLab is certainly the easiest way, but not the only way of accomplishing that goal, but that'll be true of any self-hosted forge, including GitHub.
You could stop it, do a snapshot of the storage and backup that for <1 min of downtime probably.
But at the same time, if you're not a global company, doing it at 3am is probably fine.
Doing a snapshot of the storage while it's running wouldn't be bad either, it'd just be like having cut power at the point of the snapshot, right?
Yes. And the database used by GitLab is Postgres which handles that just fine.
It can be an issue if you are using gitlab as your container/package registry and production workloads need to pull from it, though.
They should be pulling from a pull through scanning repository cache anyway, so they can be scanned before going into production.
Weird. I’ve been on a self hosted enterprise gitlab and I think we’ve have only one or two performance degradations/outages in the past 6 years
We’re talking about the SaaS version, not self-hosted.
Are you sure?
> [...] and FWIW our *self-hosted* premium gitlab has about an hour a day downtime
Considering the sheer volume GitHub received lately I wouldn’t be surprised if GitLab would experience similar issues unless self hosted.
Or what do you think?
Or Microsoft/OpenAI (and others) just blatantly scraping all your codebases and violating thousands of OSS licneses?
If the repos are public, hosting location doesn't make a difference.
We're going to need something more expansive than OSI software licenses for the future.
Something like, "if you look at us, we must be able to look at you"
Roku uses Gitlab internally so could just be a standardization thing.
Moving changes back and forth between gitlab and github is a pain. Could indeed be as simple as standardization and reducing development pains.
What makes it more complicated than doing a Git push against two remotes? Assuming that one of those is used for collaboration and the other is just a mirror.
The CICD pipeline is not directly compatible, for one.
You don’t need to run the CI/CD pipeline in both. Choose one as your collaboration space, and the other as a mirror.
Probably the lack of transparency regarding AI and AI accounts. They don't require any declaration..
I saw a big write up on using Dagger for CI no matter your git host and I was curious if there were any real benefits?
I like Dagger but it doesn't scale very well for larger workloads. Excellent for small/medium projects, though.
I haven't used Dagger but it looks like a fundamentally different design from traditional CI engines, so some people might have issues moving to it.
I recommend Drone.io or WoodpeckerCI for hosting your own CI. It's a very good design; very simple, easy to run, easy to use, integrates with most systems you'd want to, abstracts away components rather than tightly integrating them, and you don't need to be a programmer to use it. So basically the opposite of Dagger.
Yes, I use Dagger, it's much more than building containers
- Container based workflows are the same in CI and locally (you can run containers too), they become one-liners
- Remote caching out of the box without extra steps
- Multiple language SDKs, unlocks the DAG in BuildKit and containers, real reuse
- Obfuscates secrets from your logs and agents. I've built an agent environment on Dagger, which also includes forking and time travel)
tl;dr - Dagger gives you SDK access to BuildKit and container based DAGs for building or anything else.
v1-beta just released yesterday: https://dagger.io/blog/dagger-10-beta/
---
edit: they are replacing BuildKit (for good reasons) and that is already out https://dagger.io/changelog/theseus/
Have you written or posted publicly about your agent environment? It sounds really interesting.
The breadcrumbs start here: https://github.com/hofstadter-io/hof/tree/_next/lib/agent (my personal developer swiss army knife)
I'm gearing up for a major rewrite, there is a lot of cruft in there from nearly 10 years of my experiments and explorations :]
Did this back in ~2021 for my own repos :D https://prologic.blog/posts/2021-07-11-why-i-no-longer-trust...
If Roku has moved then I guess it is game over.
The thread here is interesting, because I am in a rather different situation.
I made a game that I thought people might like. I'm trying to offer it to F-Droid and I am encountering pressure to create a GitLab account.
I have been finding it intensely ironic that a project like F-Droid is doing this. It seems like they have, themselves, built processes that have resulted in a form of lock-in that requires others to sign up to GitLab for interoperability.
(Forgive the stupid AI answer, but does this help?):
2. Submitting an App Without a GitLab Account
To get an app listed on F-Droid, a metadata file must be added to the official fdroiddata repository. While the standard workflow involves opening a Merge Request on GitLab, you still do not strictly need a GitLab account: • Alternative Logins: The F-Droid GitLab instance allows you to sign in using your existing GitHub, Google, Bitbucket, or Salesforce accounts. • Community Submission: If you do not want to interact with GitLab at all, you can post a request on the F-Droid Forum, and community contributors can create and submit the metadata file on your behalf.
----- Apparently you don't need to actually create a gitlab account? Login with your github or whatever (I assume via oauth?)
The docs definitely don't look clear (on quick perusal), and maybe this info is outdated, but perhaps you can still push to gitlab without actually creating an account just need to make sure the metadata is correct?
Well that is another issue, It has been very difficult to follow their documentation. I read a bunch of pages that bounced me around links each containing a little information, but not in a manner I could turn into anything that I understood to be a clear path forward.
I asked on the #fdroid IRC channel without success. I only got as far as I did by asking an AI to decipher their documentation. I have posted on the forum, but it seems clear that this is a second class approach. It feels a little Kafkaesque to choose the non-GitLab path and have them recommend you use GitLab.
Sign in with an auth from another account is still creating an account, You may be able to use the other accounts to log in, but it still puts you through the sign up process asking a bunch of details.
Is it just me who is baffled, as to why is this surface level article getting soo much attention? a software company moved from one tool to another so what? There is no technical or non technical reasons mentioned in the article atleast. Why is this piquing interest in HN community. What am I missing here?
HN is weird. My submission yesterday "Roku SceneGraph 2.0 SDK: Migrating to TypeScript" <https://news.ycombinator.com/item?id=50212170> (which also involves the not-inconsequential news that the new SDK is open source) is at least 10x more interesting but got almost no attention.
Every thread relating to Github seems overwhelmingly negative towards Github.
Even as an appreciator of multiple Git forges... Github seems good?
My work GitHub account got suspended because Claude ran a bunch of gh commands in parallel. (Btw why not rate limit if it’s a problem?) For days now they won’t respond to my support ticket. Guess I just don’t get to have a job anymore because GitHub doesn’t like me? Burned a lifetime worth of goodwill from me this week.
It is so mid compared to the source control ecosystem I was exposed to at Meta. It really opened my eyes to how little innovation there has been in the public space and around git pretty much since its inception.
Forges catering to public should follow standards. This limits your ability to get creative. Git client has become the defacto standard.
They have a lot of downtime. I use github actions and it’s down multiple times each week.
I like github, but it’s getting kind of nuts.
Why is this important news?
A major software project is changing from one major software tool to another major software tool. How is it not important? Or at least notable for HN?
GitHub is such a mess. They seem to be doing everything and nothing. GitLab is 100x better, in terms of DX. While I still have a soft spot for GH, its frustrating to use it when GL exists.
Downtime aside, what do prefer about GitLab?
In general, the foundations upon which it was built.
In specific, off the top of my head:
- you can't group repos
- CI/CD is far behind what GitLab offers
- Review apps (though I think now you can do this on GH with other tools)
- Can't mark PRs as drafts by default in GH
- better metric tracking, easier to see a "snapshot" of where something is at on GitLab
Tbf, GH may have closed some gaps over the years but when I was bouncing between the two GH always felt a lot more rigid and further behind than GL. It did have fantastic support for open source though, and has a few unique and fun things like the `io` site stuff. Overall though if I could choose which to work in for serious projects I'll always choose GL.
GitLab has a top of the class CICD system that is leaps and bounds over GitHub Actions. That alone makes it worth using GitLab.
I don't understand why GitLab CI is praised so much when it is the most limited and unintuitive ones of all the CI systems I've worked with.
I have hit so many issues and limitations on GitLab which is just simply possible on GitHub. Here's a few of my rants with GitLab
1. The smallest unit of action on GitLab is a whole job, on GitHub, that's a task. So all of the actions or templated files can perform a single task instead of a whole job. This granularity is incredibly useful and lets my team create a catalog of actions that our downstream teams can simply include and compose it over a variety of tools and frameworks.
2. You cannot share secrets between jobs. This was just outright ridiculous when it meant that in each new job you have to fetch an STS token even though the token from a previous job would suffice. So much repetition. When you have a template like fetching AWS credentials using OIDC, that's the only thing you can do. Hence proving point 1.
3. Multiple workflow files instead of a single `.gitlab.yml` with a scrambled mess of rules
4. Dynamic services, in GitHub it is effortless to build a matrix AND have services spun up from it. The amount of duplication this reduces is insane.
name: Test Actions
on:
push:
branches:
- main
jobs:
preTest:
runs-on: ubuntu-latest
outputs:
services: ${{ steps.services.outputs.serviceJson }}
steps:
- uses: actions/checkout@v3
- run: echo "serviceJson=$(cat .github/workflows/demo.json | jq -c)" >> "$GITHUB_OUTPUT"
id: services
shell: bash
test:
runs-on: ubuntu-latest
needs: [preTest]
services: ${{ fromJson(needs.preTest.outputs.services ) }}
steps:
- run: echo "Hello"
shell: bash> don't understand why GitLab CI is praised so much when it is the most limited and unintuitive ones of all the CI systems I've worked with.
I'm baffled by remarks of GitLab's ICD being "unintuitive". I mean, GitLab's pipelines are made up of a set of stages, and stages are made up of a set of jobs. To put it differently, GitLab's pipelines are made up of jobs, which are grouped into stages. Does this go against your personal notion of a pipeline?
> The smallest unit of action on GitLab is a whole job
No. A job is the smallest unit of execution you can assign a runner to execute. It is used to set things like dependencies and runtime environments. Once your job sets the environment, your job can start to execute your scripts. This means a set of individual shell commands or shell scripts you provide.
> You cannot share secrets between jobs.
Yes, and only a very silly and clueless person would ever think it would be a good idea to share secrets through random runners due to exfiltration risks.
This is not a GitLab thing, mind you. You should really read this
https://secure-pipelines.com/ci-cd-security/gitlab-ci-cd-sec...
> Multiple workflow files instead of a single `.gitlab.yml`
Now I wonder if you're just trolling.
> Dynamic services,
Now this is just silly. Did you even bothered to learn how GitLab handles this?
What’s so much better about it? I use both and I don’t see significant differences, but I’m happy to be enlightened.
It has a wider feature set and is just generally easier to use. When I had to set up GHA I was constantly surprised with how hard some very basic things were that were trivial with GitLab CI.
GHA was based on Azure Actions, which was never intended as a CI system nor meant to be used in a context where actions could be malicious. So it's the wrong tool for the job that had to be adapted to fit another use case, straying from its original design principles to make it work.
Thanks for responding, but unfortunately it’s still too vague to agree or disagree with.
Parent child pipelines
Shared pipelines across multiple projects
rules: have far more flexibility than githubs if:
GitLab is very easy to fan out CI/CD runners on your own k8s infra.
Doesn’t “needs:” handle the parent-child case?
Shared pipelines also exist: https://docs.github.com/en/organizations/managing-organizati... and https://docs.github.com/en/enterprise-cloud@latest/repositor...
Hosting runners on K8S is similarly easy; GitHub even built a controller to help: https://docs.github.com/en/actions/concepts/runners/actions-...
Move to Game of Trees and the integrated gotwebd, move on, have a happy life.
We did the same, quit happy
It’s frustrating that now we’re back to repo fragmentation and figuring out where and how to contribute has regressed 20 years
> figuring out where and how to contribute has regressed 20 years
What?
Step 1: go to project's manpage/readme or website.
Step 2: find the URL of their software forge (git/svn/hg site).
Step 3: clone and contribute using that website.
That process has been largely the same for a lot more than 20 years. Most people were not using GitHub as a discovery/random-repo-browsing system.
gitlab > github
PR > MR
Roku has developer repositories?
GitLab will eventually just get overran with 24/7 agents spewing from their AI Slop Cannons
I moved my projects over to GitLab about a year ago.
GitLab's model is different - at least it was when I moved over to it. They charged for public repositories and gave you a free private ones as a sampler for trying out the platform. That approach is far less prone to getting overrun by millions of slopositories.
GitLab never tried to be the social media of software development. Theirs is a much simpler, classical model - one of the reasons I switched to them: you pay them money, they provide you services for that money.
They recently added more limits which should prevent a lot of AI abuse (which GitHub should have added a year ago). They also require a credit card now, and require payment immediately for exceeding storage limit or more than 5 people on a free/personal team.
> GitLab will eventually just get overran with 24/7 agents spewing from their AI Slop Cannons
That's fine. GitLab offers self-hosted solutions where companies run the service in their own infrastructure and limit who has access to it. The same cannot be said by GitHub, though.
Wouldn't that be Github enterprise? It's been around since 2012 IIRC.
Yes, though enterprise is expensive and GitLab still had a free option last time I checked.
> The same cannot be said by GitHub, though.
That isn't true. Self hosted Github exists, and has for years now. From what I hear (from a friend who had to administer his company's instance) it's not a good product by any means, but it does exist.
The readme.md still says welcome to their GitHub repository :D
I always found it wierd that people flocked to github. The app sucks, if I have to use it for work it infuriates me at nearly every turn with its sad excuse for UI. People like free sh*.
As for gitlab...yuck. But whatever. Most of the dev tool space is really just "sh* we have to put up with now", none of it is any good, all of it is dated from the early aughts, and taken as a whole is even worse because none of it works together.
While software development itself got better in the last ten years these tools stayed the same or got worse (enshittification). And this is part of why folks are self hosting.
The other part is that AI is destroying the Internet and its time to pack your bags anyway. The smart people already have.
> I always found it weird that people flocked to github.
Same reason we ended up with git. Their predecessors were significantly worse, and then they had enough momentum to keep going.
Well you're a developer. Why don't you make something better instead of complaining?
> I always found (...)
You broadcasted your negative feedback but it seems you had no positive remarks to give. If you feel everything is so bad, would you mind sharing what tolerable alternatives are there to GitHub and GitLab?
> mind sharing what tolerable alternatives are there to GitHub and GitLab?
Not the op, and while your criticism of their negativity may be somewhat justified, the ask is kind of silly. There are a bunch of well known alternatives:
Self-hosted free software:
Gerrit <https://www.gerritcodereview.com> Phorge <https://we.phorge.it>
SaaSsy:
Codeberg <https://codeberg.org> SourceHut <https://sr.ht/>
There are a lot more, of course, these are just the ones I have experience with.
[flagged]
[dead]
So they replaced a tool from an evil corporation by another one disguised as an open source project.
> disguised as an open source project
Gitlab CE is open-source. There exist versions of Gitlab with features that require payment. This does not mean that Gitlab (the product) is not open-source; it means that Gitlab (the company) has a core product which is open-source, and then sustains its development through the sale of licenses to product tiers beyond that.
This logic baffles me. This would mean no one gets any work done and we go in a perennial cycle of victimhood
Good. I want everyone to do this. I want to see the downfall of Microsoft. Time and again they've proved that anything they touch can't be trusted nor reliable. I am tired of this. They even bully their users - on Mac OS, GitHub desktop doesn't respect the word "no". It installs all kinds of helpers and acts like borderline spyware. Someone created an issue about it on Github and the MS employees told them to fuck off in corporate[1]
I am even considering hosting my own GIT server myself. Some of our deployments got affected multiple times in the last 6 months alone we were really caught off-guard. Thankfully our clients were understanding of the GitHub outages. But, this should not be the baseline. Reliability should not be the cost of doing business.
[1] https://github.com/creativefoundrysg/desktop#an-open-letter-...
Thanks for a good laugh, FOSS in 2026 is nothing without the money of big corporations, including Microsoft.
Everyone spent years talking against GPL, business friendly licenses like MIT and Apache were the way of the future, not viral and co.
Now we are here, most projects have their key contributors working at corporations like Microsoft, or gladly getting their acquisition money to pay the VCs, embrace your business friendly licenses.
So, the solution is just "suck it up and deal with it"? We pay good money to Microsoft for some of our client orgs and defending this level of piss poor reliability is just cope in the name of support for FOSS. I don't see why this should be accepted. This is mainly because their shitstorm that's Azure.
Hardly any different from dealing with Amazon or Google clouds problems and support, other FOSS darlings.
I'm hosting Forgejo for my homelab and couldn't be happier. I have everything running in containers with dind for CI/CD. Most of my workflows just worked with minimal changes. YMMV and this is far from an enterprises' needs but it's working great so far for my needs.
My friend group also moved to self hosted forgejo. Couldn’t be happier and then I don’t have LLMs training on my code.
>Good. I want everyone to do this
Every other free service would die nearly instantly, so maybe only want useful things to move to other services.
>I am even considering hosting my own GIT server myself.
It's mostly a good idea.... but, with the current security apocalypse we seem to be under making sure your own shit doesn't get pwned is a full time job. The level of security hostility on the internet recently has reached numbers I've never seen before. RCE's dropping about every day, more targeted scans than I've ever seen in my life, swarms of AI bots breaking into services.
> making sure your own shit doesn't get pwned is a full time job.
Not if you didn't vide code your architecture. I have a 7 year box running without a single incident (touchwood) because 7 years ago we didn't have vibe coding and I used a compiled language. To use PHP for anything serious in 2026 is just insane, let's be honest.
Running an up to date self hosted Gitea server takes like 5 minutes a week.
I mean, last year, but if you're updating once a week now, that means you've had 6 days to get exploited.
Nope. Take a look at gitea update frequency.
Missing the point completely. It doesn't matter how often they update, it matters how fast attackers find exploits.
As an idea, do you think an enterprise only Git host would work.
Say annual contracts start at 100k minimum and everyone gets a dedicated support engineer.
You get your own rack. None of this degraded shared capability nonsense.
Does that seem like a solid business ?
No. You'd be competing with multiple mature cloud services plus Github Enterprise Cloud/self-hosted plus multiple open source options.
I don't need or want a dedicated support engineer for my VCS, I need it to integrate with all the bullshit products I already have, tick off the compliance and governance checkboxes for the suits, give me controls so SWEs do less dumb shit and above all, not be something I have to think about except at contract renewal time.
I'm just not going to trust a rando to run all that for me and get it right, especially not at that price point.
I think so, but, only if you differentiate in the privacy angle (think Proton vs GMail) and this is similar to how most enterprise GIT offerings work, too. The risk is GitHub offering to existing orgs who are already on Office 365 a self-hosted version (I think they already do). So, this business model will fail in the SWOT analysis itself. Still, there might be some looking to exit MS office ecosystem, it might make more sense for them.
It’s a dream, I don’t have the money to do it.
But it could work as a franchise model too, maybe I just refer your company to an affiliate located in your country of choice.
For example, most European clients would pick German locations.
If I was in the EU I’d be applying for a grant to build on the idea. Their’s no rational reason for European companies to fully trust Microsoft to act in good faith.
Is that Bitbucket?
Both GitLab and Bitbucket still offer free repos for hobbyists.
What I'm thinking of is a company that exclusively caters to the enterprise.
You get a support engineer and they help on everything, migration, CI/CD, hosting, etc.
Nothing goes down without a solid 3 page write up.
Github desktop is such a hot mess that I instead choose to continue to suffer with SourceTree. Sourcetree annoys me for reasons I still cannot articulate after a decade, but it at least tends to actually work without being too intrusive as far as updating, doesn't randomly derp out on credentials, and is super handy when trying to visualize janky branch patterns of dev teams.
A devops friend of mine said GitHub turned into a hot mess.