Gitea Actions explained in plain terms

The move to self-hosted automation

GitHub users faced significant disruptions on August 17, 2026, when a 6.5 hour outage caused error rates to hit 20% and repository download failures to reach 50%. This incident followed a period where GitHub Actions experienced 57 separate incidents between May 2025 and April 2026. The May 2026 availability report from GitHub documented an incident where 42% of GitHub Actions runs failed at peak impact. Teams seeking control over their data and infrastructure often turn to Gitea to eliminate per-user subscription fees. Gitea provides a lightweight alternative to GitLab, which costs $3,588 annually for a 20-person team using the Premium tier. Gitea requires only the cost of server hardware. For 50 users, GitHub Enterprise costs can reach $1,050 per month, whereas Gitea remains free under the MIT license.

How the runner functions

Gitea Actions functions as a built-in CI/CD system that uses the act_runner to execute jobs. This runner polls the Gitea instance for queued tasks, runs the steps in a container or on the local machine, and then streams logs back to the interface. Installation is possible via binary, Docker, or Kubernetes. Because Gitea Actions uses the same YAML structure and workflow syntax as GitHub Actions, teams can often copy existing workflows to their new environment. The runner communicates with the Gitea instance via a registration token and an instance address, which ensures that the agent can pull jobs from the queue without the need for open inbound ports on the host machine. To register a runner, administrators run the ./runnerregister command with the --no-interactive flag, providing both the instance and token arguments. After registration, a file named .runner appears in the current directory. You should consider using the Docker executor for better security and management, assuming you already know how to manage containerized environments. Small teams must handle access separation between staging and production manually through different secret names or different runners with distinct labels. Will Gitea eventually introduce native environment management for production deployments?

Security and deployment trade-offs

Security researchers at Wiz found that JINX-0132 systematically compromises exposed instances of Nomad, Consul, Docker, and Gitea to deploy cryptocurrency mining software. These attackers exploit infrastructure misconfiguration to install open-source tools. Approximately 25% of cloud environments run at least one of these targeted technologies. The act_runner relies heavily on Docker for job execution, and the tool requires a Docker daemon to function. While the runner token allows for repository access, it lacks the permission to push images to the Gitea container registry. Administrators must create a separate token for their account and add it as a secret to bypass this limitation. The JINX-0132 campaign highlights how even well-funded organizations remain vulnerable to basic security misconfigurations. For example, attackers exploit default behaviors in HashiCorp Nomad to execute remote code. Gitea instances also become vulnerable through unlocked installation wizards and misconfigured git hook permissions. The runner token used by Gitea lacks the permission to push images to the Gitea container registry and forces users to create manual account tokens to manage image deployment.