# What Codebahn adds to Forgejo

Codebahn runs Forgejo with a managed layer on top. This page lists what that layer abstracts, what it adds, and what it changes. For stock Forgejo features (repositories, the API, user admin, Actions syntax), see the [upstream docs](https://forgejo.org/docs/latest/).

## Runner provisioning

You pick a runner size in `runs-on`, we provision an isolated, ephemeral VM on Scaleway in Paris. No runner binary to install, no Docker host to manage, no registration tokens for the common case. Jobs start in about 40 seconds cold, 2 seconds warm. Bring your own runner alongside ours if you want different hardware.

See [CI runners](/docs/ci-runners/) for sizes, the pre-cached toolchain, and bring-your-own setup.

## GitHub Actions workflow syntax

Workflow files in `.codebahn/workflows/`, `.forgejo/workflows/`, `.gitea/workflows/`, and `.github/workflows/` are all read and merged, so GitHub workflows run without renaming the directory. The runner image follows the GitHub Actions layout with pre-cached Go and Node toolchains in the GitHub-style toolcache, so `actions/setup-go` and `actions/setup-node` resolve offline. New commits to the same branch auto-cancel in-progress runs on that branch.

See [Workflow directories](/docs/workflow-directories/) for precedence and de-duplication, and [CI runners](/docs/ci-runners/#what-the-image-ships) for the image contents.

## Deployment environments

A callback-driven environment system turns PaaS webhooks into commit statuses and PR comments. Create an environment, paste the callback URL into your provider's webhook settings, and deploy results appear on the commit and pull request. Supports Vercel, Netlify, Render, Railway, Cloudflare Pages, and a generic format.

See [Environments](/docs/environments/) for the callback format and provider notes.

## Container registry integration

The built-in OCI container registry lives at `codebahn.net`. In CI, `${{ github.token }}` authenticates automatically, so you push images without creating or storing a PAT. Every image is private; there is no public or anonymous pull.

See [Container registry](/docs/container-registry/) for image naming, storage quota, and cleanup rules.

## Bot identity for CI

Each CI job receives a `CODEBAHN_BOT_TOKEN` environment variable: a short-lived, repo-scoped personal access token issued to a dedicated bot user. Tools like Renovate can use it to open pull requests under a recognizable identity that triggers CI (the built-in Actions token cannot trigger workflows). The token is scoped to the repository that owns the job, expires after the job timeout, and is not injected for fork pull requests.

## GitHub App import and mirrors

Token-based mirrors are stock Forgejo. Codebahn adds a GitHub App flow: install the Codebahn app on GitHub, pick repos, and import up to 100 at once with full history, issues, PRs, labels, milestones, and releases. Syncs mint short-lived, repo-scoped credentials automatically. No token to rotate or store. Imported repos can convert to ongoing mirrors if you want both remotes.

See [Migrate from GitHub](/docs/migrate-from-github/) for the import flow and [Mirror a GitHub repository](/docs/mirror-github-repos/) for ongoing sync and the token-to-app conversion.

## Action mirrors

Common GitHub Actions (`actions/checkout`, `actions/setup-go`, `actions/setup-node`, and others) are pre-mirrored on the platform as system-level organisations. Workflows that reference `actions/checkout@v4` resolve without manual mirror setup. Self-hosted Forgejo needs manual mirrors or a redirect for each action org.

See [Action mirrors](/docs/action-mirrors/) for the full list.

## CLI

A dedicated command-line tool for working with Codebahn repositories, CI, pull requests, and issues. Also ships the built-in MCP server for AI coding assistants. Published on GitHub, installable via `go install` or binary download.

See [CLI](/docs/cli/) for installation and commands.

## Built-in MCP server

MCP is built into the platform at `codebahn.net/mcp` and also available via the CLI. AI assistants connect with OAuth (platform) or a personal access token (CLI). The server covers every core flow: repos, branches, issues, pull requests (including reviews), and CI. Works with Claude Code, Cursor, and VS Code.

See [Connect an AI assistant](/docs/mcp/) for setup.

## Opinionated defaults

Codebahn changes a few Forgejo defaults to match the product's stance:

- **Private-only repositories.** No public repos, no anonymous pull. Every image in the container registry is private. Tenant data is never browsable without auth.
- **Workflow directory merging.** Enabled by default. Upstream Forgejo reads only the first directory found; Codebahn reads all four and merges.
- **Auto-cancel on same-branch push.** A new commit to a branch cancels in-progress runs on that branch. Override with a `concurrency` block.
- **Federation disabled.** ActivityPub federation is off. Tenant isolation requires it; a federated instance would expose tenant activity to external servers.

## What we leave to upstream Forgejo

Everything not listed above is stock Forgejo: repository management, the REST API, OAuth providers, package formats beyond OCI, and admin. We link to the [upstream docs](https://forgejo.org/docs/latest/) and do not re-document it. Note that wiki, projects, stars, and time tracking are [disabled](/vs-self-hosting#what-codebahn-disables).