Get early access

CVE monitoring for code on Gitea and Forgejo

Self-hosting your Git does not mean going without vulnerability management. Run the mopoke CLI in Gitea Actions or Forgejo Actions and MopokeHQ watches every SBOM you upload, with nothing connecting into your network. A native integration is coming.

Get early accessAll platforms

Coming Native Gitea and Forgejo integration. Uploads through the CLI work today.

What works today

The mopoke CLI runs as a job in Gitea or Forgejo Actions and pushes the SBOM out. From there everything that is not Gitea and Forgejo-specific already works: matching, priorities, alerts, the roadmap and evidence.

Pass the project, commit and branch with --project, --commit and --ref. A mopoke deploy --env production step after your deploy job tells MopokeHQ what is live.

Upload
mopoke scan in Gitea or Forgejo Actions
Matching
Every stored SBOM re-checked when an advisory lands
Priority
P1 to P3 from KEV, EPSS, severity and what is live
Deploys
mopoke deploy after each deploy job
Evidence
Hash-chained log, client notices and evidence packs

What the Gitea and Forgejo integration adds

The same depth GitLab has now, in Gitea and Forgejo’s own terms. Until it ships, these parts are GitLab only.

  • Findings on the pull requestNew findings commented where the code changes
  • A gate on new findings onlyFails on a new critical, a new secret or a new known-exploited dependency
  • Fix pull requestsOpened from your own runner for queued upgrades
  • Deployment eventsWhat is live, without an extra step in each deploy job

Your instance, your network

You run your own Git because you want control. MopokeHQ keeps it that way: the scan runs on your runners, results go out, and nothing comes in.

Security and data
Inbound access
None needed
Credentials
One CI token you create and can revoke
Other CI
Woodpecker, Jenkins or anything that runs a container
Your code
Stays on your instance

Questions

Does MopokeHQ work with Gitea or Forgejo today?

Yes, through the CLI. Run mopoke scan as a job in Gitea Actions or Forgejo Actions, or in any other CI you run beside them, such as Woodpecker or Jenkins. Pull request comments, fix pull requests and deployment events come with the native integration.

Does it work with an instance behind a firewall?

Yes. MopokeHQ never connects into your network. Your runners push SBOMs and results out, so an instance with no inbound access works the same as a public one.

Is Forgejo covered as well as Gitea?

Yes. Forgejo started as a fork of Gitea and the two stay close, so one integration is planned for both.

Where is the data stored?

Your code stays on your own instance. MopokeHQ stores only SBOMs, scan results and evidence, in Sydney, Australia.

When is the Gitea and Forgejo integration coming?

There is no date yet. Ask for early access, say which one you run, and we will let you know when it is ready.

Put a mopoke on night watch

Run the CLI in Gitea or Forgejo Actions today. Your first SBOM is matched against every advisory we hold within minutes.

Get early accessSee how it works