Forge capabilities

What each forge supports, emulates or lacks, from the factory’s capability table. The console, the connect dialog and the engine’s refusals read the same table: a step that needs something a forge lacks fails with forge_capability_unavailable and the reason below. Connecting each forge is in Forge connections.

Forge	API dialect	A pull request is called
GitHub	github	pull request
GitHub Enterprise Server	github	pull request
Gitea	gitea	pull request
Forgejo	gitea	pull request
GitLab	gitlab	merge request

Capabilities

Connect

How the factory signs in to the forge. (connect)

Forge	Support
GitHub	Yes
GitHub Enterprise Server	Emulated: A GitHub App you register on the instance; its App id and private key are kept in the tenant vault.
Gitea	Emulated: A bot account’s access token in the tenant vault stands in for an App installation.
Forgejo	Emulated: A bot account’s access token in the tenant vault stands in for an App installation.
GitLab	Emulated: A bot user’s, group’s or project’s access token in the tenant vault stands in for an App installation.

Webhooks

Events reach the factory as they happen; nothing is polled while webhooks arrive. (webhooks)

Forge	Support
GitHub	Yes
GitHub Enterprise Server	Yes
Gitea	Emulated: Repository or organisation webhooks the factory creates with the connection’s secret, signed with X-Gitea-Signature or X-Forgejo-Signature.
Forgejo	Emulated: Repository or organisation webhooks the factory creates with the connection’s secret, signed with X-Gitea-Signature or X-Forgejo-Signature.
GitLab	Emulated: Project or group webhooks the factory creates with the connection’s secret token (X-Gitlab-Token).

Repository discovery

The repositories the connection can reach are listed for Repositories and managed scope. (repos)

Forge	Support
GitHub	Yes
GitHub Enterprise Server	Yes
Gitea	Emulated: The organisation’s or the bot user’s repositories, refreshed every 6 hours and on Refresh.
Forgejo	Emulated: The organisation’s or the bot user’s repositories, refreshed every 6 hours and on Refresh.
GitLab	Emulated: The group’s projects including subgroups, or the bot’s memberships, refreshed every 6 hours and on Refresh.

Open pull requests

The draft_pr output and Belai crews open pull requests from factory branches. (pull_requests)

Forge	Support
GitHub	Yes
GitHub Enterprise Server	Yes
Gitea	Yes
Forgejo	Yes
GitLab	Emulated: A merge request; its number is the merge request’s iid.

Draft and ready

A pull request is opened as a draft and marked ready at a checkpoint. (draft)

Forge	Support
GitHub	Yes
GitHub Enterprise Server	Yes
Gitea	Emulated: The WIP: title prefix, which Gitea and Forgejo treat as work in progress and refuse to merge.
Forgejo	Emulated: The WIP: title prefix, which Gitea and Forgejo treat as work in progress and refuse to merge.
GitLab	Emulated: The Draft: title prefix, which GitLab treats as a draft merge request.

Checks for gates

A gate waits for the head commit’s checks to pass. (checks)

Forge	Support
GitHub	Yes
GitHub Enterprise Server	Yes
Gitea	Emulated: Commit statuses. Gitea and Forgejo Actions, Woodpecker and Drone all report through them.
Forgejo	Emulated: Commit statuses. Gitea and Forgejo Actions, Woodpecker and Drone all report through them.
GitLab	Emulated: Commit statuses, which every pipeline job reports.

Merge readiness

The approve gate reads whether a pull request is clean, behind, conflicted or blocked. (merge_state)

Forge	Support
GitHub	Yes
GitHub Enterprise Server	Yes
Gitea	Emulated: Worked out from mergeable, the reviews and the statuses. Branch protection is not read; the forge still enforces it on merge.
Forgejo	Emulated: Worked out from mergeable, the reviews and the statuses. Branch protection is not read; the forge still enforces it on merge.
GitLab	Yes

Review decision

Whether a pull request is approved, needs a review or has changes requested. (review_decision)

Forge	Support
GitHub	Yes
GitHub Enterprise Server	Yes
Gitea	Emulated: Worked out from each reviewer’s latest review; stale and dismissed reviews do not count.
Forgejo	Emulated: Worked out from each reviewer’s latest review; stale and dismissed reviews do not count.
GitLab	Emulated: Read from the merge request’s approvals; a requested change is a note, not a state.

Submit reviews

pr_review nodes approve, comment on or request changes to a pull request, with inline comments. (reviews)

Forge	Support
GitHub	Yes
GitHub Enterprise Server	Yes
Gitea	Yes
Forgejo	Yes
GitLab	Emulated: APPROVE is an approval, COMMENT a note, REQUEST_CHANGES a note with this account’s approval withdrawn; inline comments are diff discussions.

Request a team’s review

A checkpoint can ask a team to review. (team_reviewers)

Forge	Support
GitHub	Yes
GitHub Enterprise Server	Yes
Gitea	Yes
Forgejo	Yes
GitLab	Not available: GitLab reviewers are users; name the people instead.

Update branch

A checkpoint brings a pull request’s branch up to date with its base. (update_branch)

Forge	Support
GitHub	Yes
GitHub Enterprise Server	Yes
Gitea	Emulated: A merge of the base into the head (pulls/{n}/update?style=merge).
Forgejo	Emulated: A merge of the base into the head (pulls/{n}/update?style=merge).
GitLab	Emulated: A rebase of the merge request (merge_requests/{iid}/rebase).

Server-signed commits

Commits the factory writes (conflict resolution, curator ships) are signed with the tenant’s KMS key. (signed_commits)

Forge	Support
GitHub	Yes
GitHub Enterprise Server	Yes
Gitea	Emulated: The signed commit is built by the factory and pushed over git; the forge shows it verified when the key is on the signer’s account.
Forgejo	Emulated: The signed commit is built by the factory and pushed over git; the forge shows it verified when the key is on the signer’s account.
GitLab	Emulated: The signed commit is built by the factory and pushed over git; GitLab shows it verified when the key is on the signer’s account.

Issue and label sync

Board cards mirror to issues both ways, with sf: and belai: labels. (issues)

Forge	Support
GitHub	Yes
GitHub Enterprise Server	Yes
Gitea	Emulated: Labels are written by id; a missing label is created first.
Forgejo	Emulated: Labels are written by id; a missing label is created first.
GitLab	Yes

Close reason

An issue closed as not planned is told apart from one closed as completed. (close_reason)

Forge	Support
GitHub	Yes
GitHub Enterprise Server	Yes
Gitea	Not available: Gitea and Forgejo issues have no close reason; the card records it on the board only.
Forgejo	Not available: Gitea and Forgejo issues have no close reason; the card records it on the board only.
GitLab	Not available: GitLab issues have no close reason; the card records it on the board only.

Rate-limit budget

The quota guard shares the forge’s call budget between the factory and everything else. (rate_limit)

Forge	Support
GitHub	Yes
GitHub Enterprise Server	Yes
Gitea	Emulated: Gitea and Forgejo send no rate-limit headers; the guard counts calls against forge.calls_per_hour.
Forgejo	Emulated: Gitea and Forgejo send no rate-limit headers; the guard counts calls against forge.calls_per_hour.
GitLab	Yes

Bot attribution

What the factory does is attributed to a bot identity, not a person. (bot_identity)

Forge	Support
GitHub	Yes
GitHub Enterprise Server	Yes
Gitea	Emulated: The connection’s bot account.
Forgejo	Emulated: The connection’s bot account.
GitLab	Emulated: The connection’s bot user or access-token user.

Forge security alerts

Dependabot, code scanning and secret scanning alerts become findings. (security_alerts)

Forge	Support
GitHub	Yes
GitHub Enterprise Server	Yes
Gitea	Not available: Gitea and Forgejo publish no security alerts; Vulnetix’s own scanners fill the gap.
Forgejo	Not available: Gitea and Forgejo publish no security alerts; Vulnetix’s own scanners fill the gap.
GitLab	Not available: GitLab’s security reports are pipeline artifacts, not alerts; Vulnetix’s own scanners fill the gap.

Merge queue

merge_group events and readiness in a merge queue. (merge_queue)

Forge	Support
GitHub	Yes
GitHub Enterprise Server	Yes
Gitea	Not available: Gitea and Forgejo have no merge queue.
Forgejo	Not available: Gitea and Forgejo have no merge queue.
GitLab	Not available: GitLab merge trains are not read.

App capability catalogue

The GitHub App capabilities (posture, identity, audit log and the rest). (app_capabilities)

Forge	Support
GitHub	Yes
GitHub Enterprise Server	Yes
Gitea	Not available: These read GitHub-only APIs.
Forgejo	Not available: These read GitHub-only APIs.
GitLab	Not available: These read GitHub-only APIs.

Belai clone and publish

Belai hosts clone, push and open pull requests with the connection’s token. (remote_clone)

Forge	Support
GitHub	Yes
GitHub Enterprise Server	Yes
Gitea	Yes
Forgejo	Yes
GitLab	Yes

Manifest curator

The manifest curator reads a repository’s manifests and opens its fix pull requests. (manifest_curator)

Forge	Support
GitHub	Yes
GitHub Enterprise Server	Not available: The manifest curator works through the Vulnetix GitHub App on github.com. The factory’s own workflows fix dependencies on every forge.
Gitea	Not available: The manifest curator works through the Vulnetix GitHub App on github.com. The factory’s own workflows fix dependencies on every forge.
Forgejo	Not available: The manifest curator works through the Vulnetix GitHub App on github.com. The factory’s own workflows fix dependencies on every forge.
GitLab	Not available: The manifest curator works through the Vulnetix GitHub App on github.com. The factory’s own workflows fix dependencies on every forge.

Pix Sandbox repositories

A Pix Sandbox attaches a repository, clones it and opens pull requests from it. (pix_sandbox)

Forge	Support
GitHub	Yes
GitHub Enterprise Server	Not available: A Pix Sandbox reaches repositories through the Vulnetix GitHub App on github.com. Belai on your own machines works on every forge.
Gitea	Not available: A Pix Sandbox reaches repositories through the Vulnetix GitHub App on github.com. Belai on your own machines works on every forge.
Forgejo	Not available: A Pix Sandbox reaches repositories through the Vulnetix GitHub App on github.com. Belai on your own machines works on every forge.
GitLab	Not available: A Pix Sandbox reaches repositories through the Vulnetix GitHub App on github.com. Belai on your own machines works on every forge.

Trigger events

The event names a trigger uses are GitHub’s. Each forge’s deliveries are translated into them; an event a forge cannot send never starts a run for its repositories.

Event	GitHub Enterprise Server	Gitea	Forgejo	GitLab
check_run	Yes	Emulated: From a commit status (the status event): completed when the status is final. Gitea 1.22 has no status event and keeps a webhook without it, so check_run triggers do not fire there; gates still read the statuses.	Emulated: From a commit status (the status event): completed when the status is final. Gitea 1.22 has no status event and keeps a webhook without it, so check_run triggers do not fire there; gates still read the statuses.	Emulated: Job Hook.
check_suite	Yes	Not available: No check suites; trigger on check_run.	Not available: No check suites; trigger on check_run.	Not available: No check suites; trigger on check_run or workflow_run.
code_scanning_alert	Yes	Not available: No security alerts.	Not available: No security alerts.	Not available: No security alerts.
dependabot_alert	Yes	Not available: No security alerts.	Not available: No security alerts.	Not available: No security alerts.
deployment_status	Yes	Not available: No deployment events.	Not available: No deployment events.	Emulated: Deployment Hook.
installation_repositories	Yes	Emulated: The connection’s repository refresh.	Emulated: The connection’s repository refresh.	Emulated: The connection’s repository refresh.
issue_comment	Yes	Yes	Yes	Emulated: Note Hook on an issue or merge request.
issues	Yes	Yes	Yes	Emulated: Issue Hook.
merge_group	Yes	Not available: No merge queue.	Not available: No merge queue.	Not available: Merge trains are not read.
pull_request	Yes	Emulated: pull_request and its label, assign, sync and review-request variants; a WIP: title change is converted_to_draft or ready_for_review.	Emulated: pull_request and its label, assign, sync and review-request variants; a WIP: title change is converted_to_draft or ready_for_review.	Emulated: Merge Request Hook.
pull_request_review	Yes	Emulated: pull_request_review_approved, _rejected and _comment.	Emulated: pull_request_review_approved, _rejected and _comment.	Emulated: Merge Request Hook approved and unapproved actions.
pull_request_review_comment	Yes	Not available: Gitea sends review comments as pull_request_comment, an issue_comment.	Not available: Gitea sends review comments as pull_request_comment, an issue_comment.	Emulated: A diff note (Note Hook with a position).
push	Yes	Yes	Yes	Yes
registry_package	Yes	Not available: Package events are not mapped.	Not available: Package events are not mapped.	Not available: No package events.
release	Yes	Yes	Yes	Emulated: Release Hook.
repository	Yes	Emulated: Organisation webhooks only.	Emulated: Organisation webhooks only.	Not available: GitLab sends no project-created event to a project hook.
secret_scanning_alert	Yes	Not available: No security alerts.	Not available: No security alerts.	Not available: No security alerts.
secret_scanning_alert_location	Yes	Not available: No security alerts.	Not available: No security alerts.	Not available: No security alerts.
workflow_run	Yes	Emulated: workflow_run from Gitea 1.24 and Forgejo 11; older versions send statuses only (check_run).	Emulated: workflow_run from Gitea 1.24 and Forgejo 11; older versions send statuses only (check_run).	Emulated: Pipeline Hook.