Start free
Orbit Forge

Code and delivery, next to the work they ship

Git hosting, merge requests and CI/CD with .gitlab-ci.yml-compatible pipelines on runners you register, in the same projects as your work. Keys link code to work items automatically.

Start freeRead the Forge docs

Orbit Forge

Compatible, and honest about the subset. What is not supported is rejected, never ignored.

Forge keeps code next to the work it implements. Repositories belong to Orbit projects and inherit their members. Branches, commits and merge requests link to work items automatically. Pipelines run on runners you register, in ephemeral containers. Environments keep an immutable deployment history with approvals, and releases, packages and container images ship from the same place.

Why it is better

Why Forge fits the way you ship

Code lives with the work

Repositories belong to Orbit projects and inherit their members. Deployments land on the work items they shipped, and Orbit rules act on them.

Compatible, and honest about the subset

Pipeline syntax includes rules, include, components with inputs, matrices and child and multi-project pipelines. Unsupported keys fail lint with line and column.

Runners that cannot reach the host

Jobs run non-root in ephemeral containers without the Docker socket or service credentials. Timeouts remove the container before completion is reported.

Merge at scale

Approval rules with code owners, auto-merge, merged-results pipelines, merge trains of up to 20 cars and stacked requests with automatic retargeting.

Security and governance included

Secret, SAST, dependency, container and passive DAST scans with SBOMs, a hash-chained audit trail and policies as code.

Your delivery is observable

Pulse records every deployment, shows release health before and after it and names suspect commits for new errors.

Capabilities

What you get, group by group

Everything below is listed with its real status. Items with no badge are built and working today.

Built, no badgeIn development Built, in final testingPlanned Designed, not started

Repositories and Git

  • Native Git in your projects

    Smart-HTTP and SSH clone, fetch and push. Create, import from a URL or bundle, fork and export.

  • Browsing

    Tree, files, blame, filterable history, commit diffs, compare with ahead/behind, raw files and archives.

  • Web editor commits

    Branch creation and text edits produce real Git objects. Concurrent edits conflict instead of overwriting.

  • Git LFS, submodules and verified backups

    LFS on the artifact store and a restore-checked backup of every repository.

  • Forks and merge requests from forks

    Fork into any writable project. Fork code never runs in the upstream CI.

  • Delayed deletion

    A deleted repository can be restored within 7 days.

1 more
  • Rendered README previews, code search, signed tagsPlannedReading conveniences not yet included.

Protection and access

  • Protected branches and tags

    Wildcard rules with push and merge roles, force-push and code-owner flags. Enforced on every transport.

  • Push rules and secret push protection

    Rules for commit message, author, branch and file names, file size and secret files. Secrets are refused at push.

  • CODEOWNERS

    Sections with counts and required code-owner approval for the default branch.

  • Project access tokens and SSH keys

    Hashed tokens with read and write scopes, 1 to 365 days, rotation and revocation.

  • Orbit sessions and roles

    The Orbit project’s roles apply. Cookie writes check the origin.

Merge requests

Review at scale, with gates that match how your team works.

  • Review workflow

    Line-numbered diffs with resolvable threads, reviewer assignment and re-request. "Changes requested" blocks merging.

  • Approval rules

    Approvers from members, people or Orbit groups (0 to 25), author and committer restrictions, reset on new commits.

  • Merge methods

    Merge commit, semi-linear and fast-forward with squash policy, conflict listing and linear rebase.

  • Suggestions applied as commits

    Batch the reviewer’s suggestions into one commit.

  • Auto-merge, merged-results pipelines and merge trains

    Merge when the pipeline passes. Test the merged result. Trains of up to 20 cars tested on the cars ahead.

  • Stacked merge requests

    Dependencies with automatic retargeting.

1 more
  • Conflict editor, draft status, delete source branch on mergePlannedNot yet included.

CI/CD pipelines

A stated subset of GitLab CI syntax. What is not supported is rejected, never ignored.

  • .gitlab-ci.yml-compatible configuration

    Stages, needs, dependencies, when (manual, delayed), allow_failure, retry, timeouts and tags. Lint reports line and column.

  • Reuse and structure

    Anchors, extends, !reference, default, local includes, components with typed inputs, rules, workflow:rules, matrices, child and multi-project pipelines.

  • Durable coordinator

    A PostgreSQL job queue with fenced leases, heartbeats, retries, cancellation and 4 MiB masked traces.

  • Caches, artifacts and reports

    Caches with protected keys, artifacts with browsing and quotas, JUnit, dotenv and coverage reports.

  • Triggers and schedules

    Opt-in branch, tag and merge request pipelines, [skip ci], cron schedules in IANA zones, API and HMAC webhook triggers.

  • Resource groups and manual gates

    Serialise jobs per key. Manual and delayed jobs.

  • Local lint and dry runIn development

    Check your pipeline before you push with orbit-forge ci lint and a dry run of the rules.

1 more
  • after_script, service containers, remote includes, live log streamingPlannedNot yet included.

Runners and secrets

  • Your own runners

    Registered per project with hashed tokens, tags, protected-refs-only, timeouts and online status.

  • Isolated Docker execution

    Ephemeral non-root containers without the Docker socket or service credentials, with CPU, memory and process limits. Remote Docker over mutual TLS.

  • Encrypted CI variables

    Protected, masked and hidden variables with environment scopes and file variables. Masking works across log chunk boundaries.

  • OIDC id_tokens for clouds

    RS256 JWTs with discovery, JWKS and key rotation, so jobs reach cloud providers without long-lived keys.

1 more
  • Shared runners, autoscaling, other executorsPlannedShared runners are planned. CI minutes and concurrent jobs apply to them, per plan on the pricing page; your own runners do not use minutes.

Environments and delivery

  • Environments and deployment history

    Immutable history per SHA, ref, execution and actor. Review apps, stop and auto-stop.

  • Protected environments with approvals

    Independent approval and a separate Start. Re-deploy and rollback go through the same checks.

  • Releases

    Releases with links, sources and evidence from protected tags or the release keyword.

  • Package and container registry

    Generic packages and an OCI registry for docker login, push and pull. Deploy freezes.

  • Deployment templatesPlanned

    Versioned components for blue/green, Kamal, Swarm, Helm, static CDN and db-migrate.

  • Progressive delivery checked by PulsePlanned

    Canary or blue/green steps that compare errors, latency and SLO budget in Pulse and roll back automatically.

1 more
  • Forge Pages, Kubernetes agent, feature flags, DORA metricsPlannedStatic sites on a CDN, a GitOps agent, Unleash-compatible flags and delivery metrics.

Security and governance

  • Built-in scanners

    Secret detection, pattern SAST, dependency scanning with CycloneDX SBOMs and OSV advisories, container scanning and passive DAST.

  • Security reports and vulnerability lifecycle

    GitLab JSON, SARIF and CycloneDX reports. Triage states, dismissal reasons and merge request comparison.

  • Hash-chained audit trail

    Filterable events with CSV export, verification, retention and signed HTTPS streaming.

  • Compliance frameworks and policies as code

    Live-evaluated controls, approval and scan policies in a policy repository, with violation reports.

1 more
  • Active DAST, data-flow SAST, IaC and licence scanningPlannedNot yet included.

Compatibility and migration

Bring your pipelines and your merge requests

Pipelines use a stated subset of the .gitlab-ci.yml syntax. Everything outside it is rejected by lint, so a green pipeline means what it says.

  • .gitlab-ci.yml pipelines

    Stages, needs, rules, include, components with typed inputs, matrices, child and multi-project pipelines. Lint reports line and column.

  • Import from GitLab

    Merge requests with threads and comments import from another GitLab. Its issues download as a CSV for Orbit’s import.

  • GitHub and GitLab webhooksIn development

    Provider webhooks bring branches, commits, requests and builds to Orbit work items, for teams whose code lives elsewhere.

.gitlab-ci.ymlyaml
stages: [build, test]

test:
  stage: test
  image: golang:1.23
  script:
    - go test ./...
  artifacts:
    reports:
      junit: report.xml

Not supported: after_script, services, remote and template includes, needs:project and secrets:. They fail lint instead of being ignored.

Works with the rest of Orbit

Forge keeps the work and the watch close

OrbitWork item keys link branches and merge requests. Closing patterns and smart commits run as their actor through the workflow.Orbit PulseEvery deployment marks Pulse charts, compares error rate before and after, and names suspect commits.Orbit FolioShow code at a pinned commit in a page, sync a docs folder from a repository and generate release notes from a deployment.

How the five products work together

What is next for Forge

What is coming to Forge

Next

  • Local CI lint and dry runIn development

    Check a pipeline from the command line before you push.

  • SSO, SCIM and organization groupsIn development

    Follows the Orbit sign-in work.

  • Forge screens in the redesigned interfaceIn development

    Forge moves to the redesigned interface after the Orbit screens.

Later

  • Shared runnersPlanned
  • Deployment templatesPlanned
  • Progressive delivery checked by PulsePlanned
  • Environment targets and "what runs where"Planned

See the full Forge roadmap

Docs for Forge

Pricing

Forge is part of every plan

Forge is on every plan. Repository size scales with the plan. CI minutes on shared runners are planned, and your own runners never use minutes.

LimitFreeTeamBusinessEnterprise
CI minutes per month on shared runners200 Planned2,000 Planned6,000 PlannedContract
Concurrent CI jobs on shared runners1 Planned2 Planned4 PlannedContract
Max Forge repository size1 GB5 GB10 GBContract
Storage per organization2 GB10 GB + 2 GB per paid user50 GB + 5 GB per paid userContract, from 500 GB

See full pricing and comparison

Ship from the same place you plan

Orbit is in private preview. Every new organization will start with a 14-day Business trial, no card required.

Start freeExplore the platform