fremforge - EU-sovereign CI/CD with Git included

What you get

Everything in one €30/seat plan. No "Advanced Security" add-on, no Actions metering surprise, no Marketplace trap.

Enterprise access controls

Every knob GitHub Enterprise Cloud gates behind Enterprise, wired to a real per-org policy bundle. Change any of them, an audit event fires.

• SSO to your IdP. OIDC or SAML: Authentik, Entra ID, Okta, Keycloak. Per-org session binding; per-tenant auth-source with tenant-scoped group-team maps.
• Real step-up MFA. acr_values passthrough on the authorize request, plus amr-claim verification on every callback. A signed-in session actually proves MFA happened - not a claim buried at first login.
• SCIM 2.0 provisioning. Push users and groups from Okta, Entra, Authentik, or any compliant IdP. Per-tenant bearer-token auth with dual-token rotation.
• SSH certificate authority. Deploy a fremforge-hosted SSH CA per org, or bring your own. Certificate-anchored keys carry TTL, principals, and revocation independent of the key material.
• Hardware-backed keys. WebAuthn-only for 2FA (no TOTP fallback). Enforceable per-org for regulated tenants.
• IP allowlist. Restrict tenant sign-in and API access to your corporate CIDRs. Enforced at the API gate, not just the UI.
• Email-domain allowlist. Members can only add @acme.com-style addresses matching your patterns. Wildcards supported; OIDC sign-in exempt (the IdP attests).
• Max PAT lifetime. Cap personal-access-token TTL below the 90-day platform default. Per-org override.
• Signed-commits required. Block unsigned pushes at the pre-receive gate. SSH-key signing is Forgejo-native; GPG also supported.

Supply chain security, in detail

GitHub charges $49/seat/month for the Advanced Security equivalent. We include the meaningful part.

• Pre-receive secret scanning. High-confidence patterns rejected before the commit enters immutable history.
• Push protection. Detected secrets refused at push time; hash-based override system with cross-tenant operator review; per-tenant failure-mode toggle (fail-open for dev velocity, fail-closed for regulated).
• Dependency scanning on PRs. Trivy + osv-scanner across the repo's dependencies; findings as PR comments; optional merge-block on CRITICAL CVEs.
• Static analysis (SAST) on PRs. OpenGrep runs on every pull request; findings as PR comment + commit status; on by default.
• License scanning. SPDX-based allowlist per repo; findings on PR; policy inheritable from org default.
• Malware scan on binary uploads. ClamAV in front of every upload surface; rejected uploads never enter object storage.
• SBOM per build. Syft SBOM emitted with every runner-built image, cosign-signed and attached to the release.
• SLSA provenance. Hosted runners emit signed provenance; verify with slsa-verifier.
• Signed commits. SSH-key signing as default (Forgejo verifies natively); GPG also supported. No third-party log fan-out.
• SHA-pin rewrite PR. One click to rewrite every uses: actions/checkout@v4 in your workflows to the pinned SHA digest.
• Three-level RBAC. Platform-floor controls, org-default policy set by Owner/Admin, per-repo override that can tighten freely.
• Compliance evidence bundle. On-demand signed HTML/JSON attestation of your tenant's audit-chain + supply-chain posture. Render from live state, hand to a customer, auditor, or regulator without a screen-share.

Keyless commit signing is available via fremverk's self-hosted Sigstore stack on T Cloud Public eu-de (Fulcio + TSA; no Rekor transparency-log fan-out). Endpoints: sign.frem.sh and tsa.frem.sh. No request transits the public Linux Foundation Sigstore instance. Customers opt in per-tenant at Authentication policy → Require OIDC-signed commits. See docs.frem.sh/get-started/keyless-commit-signing.

Sovereign build supply

Every runner job resolves npm, PyPI, Go modules, Docker images, and GitHub Actions through in-region caches. Faster, resilient to upstream outages, and zero direct upstream from your CI.

Anonymous-only upstream pulls - customer Authorization headers never leave fremforge and are never cached. Private packages: override the injected variable per step (NPM_CONFIG_REGISTRY, PIP_INDEX_URL, GOPROXY) or add a scoped registry. Deprecation-notice policy for cache changes - see docs.frem.sh/build/actions/package-caches.

Ship and operate

GHEC-parity for the operator surface - everything an SRE team needs to actually run this in production.

• Deployment environments. Named environments (prod / staging / preview) with per-env secrets, per-env branch restrictions, and required-reviewer gates. Approvals visible in the PR checks and the operator console.
• SIEM forwarding. POST fremforge audit events to your Splunk/QRadar/Sentinel/Datadog endpoint. HMAC-signed payload, per-endpoint retention, test-mint from the admin UI, disable per endpoint without re-onboarding.
• SLA policy per severity. Set remediation SLAs (P1: 24h, P2: 72h, etc.) per severity class. Overdue findings surface as bell alerts and in the security digest.
• Security digest subscriptions. Weekly (or on-demand) email digest of open findings + newly-arrived critical CVEs. Per-user opt-in.
• Audit chain. Per-tenant SHA-256 hash-linked chain of every state change. Anchored to WORM storage every 2 minutes, replicated cross-region.
• Audit retention, configurable. Payload retention 90 / 180 / 365 / 730 days per tenant; the hash-chained index stays forever. Meets ISO 27001 A.8.15 and equivalent DORA record-keeping.
• Disaster recovery. RDS point-in-time recovery 7 days. Nightly age-encrypted database dumps to eu-nl. WORM audit anchor cross-region replica. Documented drill cadence.
• One-click tamper-evident export. Signed tarball: repos + LFS + Actions logs + audit slice + attestations + SHA-256 manifest. If you ever want to leave, standard formats throughout.

Public API for AI agents

Every admin action is a documented REST endpoint. AI coding agents operate against the same surface as the humans, on the same auth model.

Where it runs

Every automated processing surface is operated by entities with no US parent.

See trust for the full sub-processor list, inherited certifications (T Cloud Public: ISO 27001, 27017, 27018, BSI C5 Type 2, TISAX), the own-certification roadmap (ISO 27001 Stage 1 audit within 18 months, certification within 24 months, per DPA §12.1), and the DPA for the contractual posture.

What it isn't