Transitioning to Gitea Actions for self-hosted CI/CD

GitHub announced a $0.002-per-minute fee on self-hosted runners for private repositories in December 2025. This move drives teams toward Gitea, where you pay a flat infrastructure cost rather than per-minute usage. A 20-person team using GitHub Team pays $960 per year before CI costs, but that same team pays approximately $192 per year when using a $16 per month Elestio instance. Gitea Actions maintains near-total compatibility with GitHub Actions YAML syntax. You can copy your .github/workflows directory to .gitea/workflows and most workflows run without changes. The system uses the same on:, jobs:, and steps: blocks. It also accepts the same uses: action references and secrets.* syntax. While GitHub’s pricing scales linearly with usage, Gitea on Elestio provides a fixed infrastructure cost. For 100,000 CI minutes, GitHub costs $200 per month, whereas Gitea on Elestio costs $29 per month.

Running the act_runner

The act_runner coordinates the execution of Gitea Actions jobs. It polls the Gitea instance for queued jobs and runs steps in a container or directly on the machine. You install the runner as a binary, in Docker, or on Kubernetes. To connect it, you register the runner against your instance with a registration token. You can then run the daemon to begin processing jobs. Because Gitea allows any user with API access to create and execute jobs in certain configurations, attackers can use misconfigured git hook permissions to deploy malicious code or achieve remote code execution.

Gitea is the pragmatic choice for teams that want to avoid the 16GB RAM requirement of a GitLab deployment. If you use Docker-in-Docker, you must grant the container privileged status to run the DinD daemon. Gitea Actions lacks environment protection rules and concurrency groups. A single runner can offer both container and host labels. The Docker mode runs jobs in a container created from the label’s image and provides isolation between jobs, while the Host mode runs jobs directly on the machine with the tools installed there but provides no isolation.

Migration and security

You can migrate repositories from GitHub using Gitea’s built-in migration form. You enter the repository URL and authenticate with a personal access token to pull in repositories, issues, and pull requests. For GitLab users, the MigrateGitlabToGogs tool facilitates repository transfers. You should check if your current workflows rely on complex runs-on expressions before you commit to the move. You already know how to manage a Git server, so focus on the runner permissions.

The act_runner version 0.3.0 from February 2026 supports ephemeral mode for security-hardened setups. You can also run jobs on a host machine where tools exist directly on the hardware. The runner is released independently of Gitea, and Gitea 1.21 or later is required to accept the runner’s label declaration. Will Gitea eventually implement the missing concurrency management features? Security researchers at Wiz found that JINX-0132 systematically compromised exposed Gitea instances to deploy cryptocurrency mining software. The attackers exploit misconfigured git hook permissions or unlocked installation wizards. Gitea instances require regular updates and careful configuration of git hook permissions to prevent such attacks. For AWS CodeCommit migrations, you must create a new user with the minimum necessary permissions. This user requires the codecommit:GetRepository and codecommit:ListPullRequests permissions.