Who Owns Your Code's Home? GitHub, GitLab and the Forge Landscape

September 19, 2026 · 20 min read

Software Engineer

A stone blacksmith's forge at dusk: inside, a smith hammers a glowing graph of branching commit nodes on the anvil, blank ownership signs hang above the door, and a lone figure walks away down the road carrying only a small lantern

Nearly every software company keeps its most valuable asset on a platform somebody else owns: GitHub, GitLab, Bitbucket, or one of a handful of smaller hosts. Your git history can leave any of them in an afternoon — almost nothing else you built there can, so who owns the platform matters more than its feature list.

note

This is a snapshot of a fast-moving market as of September 2026. Ownership, prices, free-tier limits and product roadmaps change often — check each vendor's current pages before you decide anything on the numbers below.

The mental model: git is a protocol, a forge is a product

Git is a distributed version control system: every clone is a complete copy of the history, and any server that speaks git can receive it. Nobody owns git, and that is why people assume their code is portable.

A forge is the product wrapped around a git server: the web interface, issues, pull requests (GitLab calls them merge requests), code review, permissions, continuous integration and continuous delivery (CI/CD) pipelines, package registries, security scanning, and lately artificial intelligence (AI) assistants. GitHub, GitLab and Bitbucket are forges. None of that is part of git, and none of it travels with git push.

# The portable part of a repository, in two commands
git clone --mirror git@old-forge.example:acme/app.git
git -C app.git push --mirror git@new-forge.example:acme/app.git

Everything above that layer belongs to the vendor's data model.

The repository is portable; the company's working process built around it is not. That asymmetry is the whole reason a forge is worth choosing carefully, and it frames the rest of this post: who owns each forge, how big each really is, where they differ, what leaving costs, and which one fits which company.

How we got here

The forge market took its current shape in four moves: GitHub won open source, incumbents bought their way in, GitLab went public as the independent alternative, and the open-source forges split over the same ownership question this post is about.

Atlassian bought Bitbucket in September 2010, when it was still a host for Mercurial, a rival version control system.^[1] Microsoft closed its $7.5 billion purchase of GitHub in October 2018 and promised it would keep operating independently.^[2] GitLab priced its initial public offering (IPO) at $77 a share in October 2021.^[3]

The last three years are the ones that changed the risk picture. In August 2025 GitHub's chief executive officer (CEO), Thomas Dohmke, announced his departure; he was not replaced, and GitHub's leadership now sits inside Microsoft's CoreAI organization.^[4] Two months later GitHub told staff that migrating its infrastructure to Azure would take priority over feature work.^[5] The "independent subsidiary" era is over: GitHub is now a Microsoft product line, run by Microsoft's AI division.

Who owns what

Each forge is controlled by a different kind of owner — a platform giant, a public company, a tools vendor, a startup, a non-profit — and the kind of owner predicts the kind of surprise you can expect.

Forge	Controlled by	How it makes money	Source code
GitHub	Microsoft (inside CoreAI)	Seats, Actions minutes, Copilot, security add-ons	Proprietary
Azure DevOps	Microsoft	Seats and pipeline capacity, sold with Azure	Proprietary
GitLab	GitLab Inc., public on Nasdaq (GTLB)	Seats on paid tiers, hosted or self-managed	Open core — MIT-licensed Community Edition, proprietary Enterprise Edition^[6]
Bitbucket	Atlassian, public on Nasdaq (TEAM)	Seats, bundled with Jira and Confluence	Proprietary
Gitea	Gitea Ltd, a for-profit company	Hosted cloud and enterprise edition	Open core on an MIT-licensed base^[7]
Forgejo / Codeberg	Codeberg e.V., a German non-profit association	Donations and membership fees	Free software, GPLv3+ since version 9^[8]
SourceHut	A small independent company	Paid accounts	Free software

MIT and GPL here are licence names: the permissive Massachusetts Institute of Technology licence, and the copyleft GNU General Public License, which requires derivatives to stay open. "e.V." is eingetragener Verein, a registered association under German law, owned by its members rather than by shareholders.

Three ownership stories are worth knowing in detail, because each shows a different failure mode.

GitLab is independent, which also means it is for sale. In July 2024 Reuters reported that GitLab was exploring a sale, with Datadog among the interested parties; Alphabet held a 22.2% voting stake at the time.^[9] No deal followed, and the company has since passed $955 million in annual revenue,^[10] but a public company with a single product line is always one offer away from a new owner.

Gitea shows that open source doesn't settle the ownership question. In October 2022 the project's domains and trademark were transferred to a for-profit company; contributors who asked for community control were refused, and they forked the code as Forgejo under Codeberg e.V.^[7] Forgejo became a hard fork in early 2024^[11] and moved to a copyleft licence that year, explicitly to prevent a later proprietary turn.^[8] The licence kept the code free; it took a fork to keep the governance free.

Amazon Web Services (AWS) shows what a side product is worth. AWS closed CodeCommit to new customers on 25 July 2024 with no announcement beyond a documentation change, then reopened it on 25 November 2025.^[12]^[13] A forge that is a rounding error in its owner's revenue can be switched off, or back on, without anyone asking you.

GitHub is far ahead on every available measure, but no audited market-share figure exists — only vendor self-reports and surveys, each counting something different.

GitHub reported more than 180 million developers in its 2025 Octoverse report, 36 million of them added in a single year.^[14]
GitLab reports more than 50 million registered users and $955.2 million in revenue for its fiscal year 2026, up 26%.^[10]
Stack Overflow's 2022 developer survey found 55.93% of professional developers using GitHub and 28.9% using GitLab, with AWS CodeCommit at 2.7%.^[15]
Codeberg, the largest non-profit host, had passed 200,000 accounts and 300,000 repositories by late 2025.^[16]

Read these with care. "Developers" and "registered users" count accounts, including students, bots and abandoned sign-ups; survey respondents could tick several forges, so the percentages overlap rather than add up; and self-managed GitLab, Bitbucket Data Center and Forgejo installations inside companies are invisible to everyone. Atlassian publishes no comparable figure for Bitbucket at all.

The honest summary is an ordering, not a pie chart: GitHub is the default, GitLab is the clear second and the default for self-hosting, and everything else is a niche with a specific reason to exist. For a company the ordering matters in one practical way — hiring and integrations. Every developer you hire knows GitHub, and every third-party tool supports it first.

What actually differs

On core features — repositories, reviews, pipelines, access control — the big forges have converged; the differences that survive are structural: can you run it yourself, can you read its source, and what does its owner want to sell you next.

Forge	Run it yourself	Source licence	Built-in CI/CD	Free tier on the hosted service
GitHub	Paid Enterprise Server	Proprietary	GitHub Actions	Unlimited private repositories, 2,000 CI minutes a month^[17]
GitLab	Yes, free or paid	Open core	GitLab CI/CD	5 users per private group, 400 compute minutes^[18]
Bitbucket	Paid Data Center	Proprietary	Bitbucket Pipelines	5 users, 50 build minutes^[19]
Azure DevOps	Paid Server edition	Proprietary	Azure Pipelines	5 users, 1,800 pipeline minutes^[20]
Gitea	Yes, free	Open core	Gitea Actions	—
Forgejo	Yes, free	Free software	Forgejo Actions	Codeberg, for open-source projects

Green = most control in your hands · amber = possible, on the vendor's terms · red = none.

List prices for the first paid tier, per user per month: Bitbucket Standard $3.65,^[19] GitHub Team $4,^[17] Azure DevOps Basic $6 after five free users,^[20] GitLab Premium $29.^[18] GitHub Enterprise is $21; GitLab Ultimate is quote-only. The gap is smaller than it looks, because the tiers bundle different things — GitLab puts into Premium what GitHub sells as Enterprise plus add-ons — but for a small team GitHub and Bitbucket are plainly the cheap seats.

Beyond the table, four differences deserve a sentence each:

Breadth versus ecosystem. GitLab sells one application covering planning to deployment to security scanning. GitHub covers less itself and leans on a marketplace of actions and apps. One contract versus best-of-breed.
AI. Every major forge now ships an assistant — GitHub has Copilot, GitLab has Duo — but only GitHub's owner has reorganised the forge under its AI division. Expect GitHub's roadmap to be an AI roadmap.
The Atlassian and Microsoft bundles. Bitbucket's reason to exist is Jira; Azure DevOps's is an existing Microsoft estate. Neither is where its owner's energy visibly goes: Microsoft's announcements are about GitHub, and Atlassian is ending its Data Center line in March 2029, keeping self-hosted Bitbucket alive only through a hybrid licence tied to Bitbucket Cloud.^[21]^[22]
Weight. GitLab self-managed is a substantial system to operate. Gitea and Forgejo are a single binary that runs happily on a small virtual machine.

Pricing is also where ownership shows. In December 2025 GitHub announced a $0.002-per-minute charge on Actions jobs running on customers' own machines, then postponed it within days after the backlash.^[23]^[24] Nothing was broken and nobody was billed, but it demonstrated the point: once your pipelines are written for one forge, the owner sets the price of running them — even on your hardware.

Lock-in: what you lose when you leave

Leaving a forge costs almost nothing for the code and almost everything for the process, and the cost grows with every pipeline and integration you add.

Asset	Leaves with you?	In practice
Commits, branches, tags	Fully	`git push --mirror`
Large File Storage (LFS) objects, wikis	Mostly	Covered by the mainstream importers
Issues, pull requests, review comments	Partly	Importers carry them, but authorship mapping, links and history get lossy
Packages and container images	Partly	Re-publish to the new registry; consumers must change their configuration
CI/CD pipelines	Rewrite	Each forge has its own pipeline language
Organizations, roles, single sign-on, branch rules	Rebuild	Not migrated by any importer
Integrations, bots, webhooks	Rebuild	Every one is re-installed and re-authorised
Stars, forks, inbound links, contributors	No	The network belongs to the forge

The vendors' own documentation confirms the shape. GitLab's GitHub importer brings issues, pull requests, comments, labels, milestones, wikis and LFS objects — and explicitly does not bring organizations, required status checks, custom roles or outside collaborators.^[25] GitHub's Actions Importer converts pipelines from Jenkins, GitLab, Azure DevOps, Bitbucket and others, with a stated goal of an 80% conversion rate and a warning to inspect every result before trusting it.^[26] The last 20% of a CI migration is where the weeks go.

Three habits keep the exit affordable without giving up the forge's conveniences:

Keep pipeline logic in scripts, not in pipeline syntax. A job that runs ./ci/test.sh ports in minutes; a job assembled from forty marketplace actions does not.
Mirror the repositories to a second location you control. It costs nearly nothing and turns an outage or an account suspension from an emergency into an inconvenience.
Treat the forge as the transport for decisions, not their archive. Architecture decisions belong in the repository itself — the reasoning in code review is worth keeping, and a review thread is the first thing an importer mangles.

If your delivery metrics are computed from forge data, note that they restart from zero after a move — one more reason to own the measurement pipeline rather than rent it.

Sovereignty, compliance and the self-host question

For a growing group of companies the forge decision starts from a constraint — where the code may physically and legally live — and only then turns to features.

The hosted forges answer with data residency. GitHub Enterprise Cloud has offered European Union (EU) data residency, on Azure regions, since October 2024.^[27] GitLab offers Dedicated, a single-tenant hosted instance in a region you choose.^[18] Residency settles where the bytes sit; it does not change which country's law governs the company holding them. GitHub, GitLab Inc. and Atlassian's Bitbucket are all run by companies headquartered or listed in the United States.

Organizations that need the second guarantee run their own forge. The most visible recent case is the Dutch government, which in April 2026 began piloting code.overheid.nl on Forgejo — rejecting GitHub as proprietary and GitLab because its open-core model leaves advanced features under a proprietary licence.^[28] On the open-source side the same motive is moving projects to Codeberg, which chose European infrastructure deliberately.^[16]

Self-hosting is not free, though; it swaps a subscription for operations. Someone patches the forge the week a vulnerability lands, runs the CI runners, tests the backups and carries the pager. Self-host when a regulator, a customer contract or your threat model requires it — not to save the seat price, which a fraction of one engineer's time will exceed. The middle path is a single-tenant hosted instance: more expensive than shared hosting, cheaper than an on-call rota.

Which one should you pick?

Pick by constraint first, ecosystem second, price last: the constraint eliminates options, the ecosystem decides among the rest, and price differences are small next to a migration.

You are	Pick	Why	Watch
A solo developer or a small startup	GitHub	Cheapest seats, generous free tier, every tool integrates with it first	Pipelines made only of marketplace actions
An open-source project	GitHub, or Codeberg on principle	Contributors are already there; Codeberg trades reach for member-owned governance	Moving later means leaving the network behind
A product company of 50–500 engineers	GitHub or GitLab.com	Both are mature; choose ecosystem versus single application	Per-seat add-ons for security and AI double the list price
A regulated or public-sector organization	GitLab self-managed or Dedicated; Forgejo if everything must be free software	Control over location, jurisdiction and upgrade timing	The operations cost, and open-core features you may come to need
An Atlassian or Azure DevOps shop	Stay for now	The integration is the value	Both owners are investing elsewhere — budget a migration

Whichever you choose, the second decision matters as much as the first: decide on day one how you would leave, and keep that path cheap.

The short version

Git is portable, the forge is not. History moves with one command; pipelines, permissions, integrations and community do not.
Know the owner. GitHub is a Microsoft AI product line, GitLab is an independent public company that has already entertained buyers, Bitbucket is a Jira accessory, Gitea is a startup, and Forgejo belongs to a members' association.
Open source is not the same as community-owned. Gitea's trademark moved to a company overnight; only a fork and a copyleft licence made Forgejo takeover-proof.
Market share is an ordering, not a number. GitHub first by a wide margin, GitLab second and first for self-hosting, the rest are niches with reasons.
Lock-in lives in CI and configuration. Keep logic in scripts, mirror your repositories, and keep decisions in the repository.
Self-host for a requirement, not for savings. Data residency answers "where"; only your own instance answers "under whose law".
Choose by constraint, then ecosystem, then price — and write down the exit plan the day you sign up.

The mental model: git is a protocol, a forge is a product​

How we got here​

Who owns what​

Market share: what the numbers can and can't tell you​

What actually differs​

Lock-in: what you lose when you leave​

Sovereignty, compliance and the self-host question​

Which one should you pick?​

The short version​

References​