Git

Content

Basics

Understand the basics of STACKIT Git, learn about key features and how to use the platform effectively.

Getting started

Create your first STACKIT Git service. Follow the guides to build a working setup in minutes.

How-tos

Manage instances, users and repositories. Learn how to use Git with STACKIT.

Reference

Find API documentation, CLI commands and Git documentation.

Release notes

Discover what's new in STACKIT Git, including added features, bug fixes and deprecation notices.

Latest updates

• changed

  Forgejo Runner v13: changes that can break your workflows

  Oct 27, 2026

  We have upgraded the runners of STACKIT Git to Forgejo Runner v13. This release makes expression evaluation stricter, removes legacy workflow commands, limits registry credentials to the job that declares them, and removes the remaining Gitea compatibility. Several cases that used to log a warning now fail the run, so check your workflows for the changes below.

  Invalid expressions and matrices fail the run

  An expression that cannot be evaluated, such as a format() call with fewer arguments than its format string references, now fails the step or job instead of logging a warning. Attempting to exclude a value from a matrix that was never defined in that matrix now causes an error and prevents the workflow from running.

  Check the expressions and matrix definitions in your workflow files.

  Legacy workflow commands are removed

  The ::set-output, ::set-env and ::add-path commands no longer have any effect, and ACTIONS_ALLOW_UNSECURE_COMMANDS does not enable them again. Write to the environment files instead:

  • Replace echo "::set-output name=var::value" with echo "var=value" >> "$FORGEJO_OUTPUT".
  • Replace echo "::set-env name=VAR::value" with echo "VAR=value" >> "$FORGEJO_ENV".
  • Replace echo "::add-path::/custom/bin" with echo "/custom/bin" >> "$FORGEJO_PATH".

  Registry credentials are declared per job

  The runner no longer logs in to registries with the DOCKER_USERNAME and DOCKER_PASSWORD secrets, because these credentials could be sent to a registry they were not meant for. If a job uses an image from a private registry, declare the credentials in that job:

  jobs:
    build:
      container:
        image: private.registry.example/app:latest
        credentials:
          username: ${{ secrets.REGISTRY_USER }}
          password: ${{ secrets.REGISTRY_TOKEN }}

  Gitea compatibility is removed

  The ${{ gitea.* }} context is no longer supported. Replace it with ${{ forgejo.* }} in your workflows.

  Steps no longer run in a terminal

  The runner no longer attaches a terminal to the output of a step. Commands that print colors only when they detect a terminal now print plain text. To get colored output again, set FORCE_COLOR=1. Commands that require a terminal will now fail. For example, replace docker run -it with docker run -i.

  If you operate your own runners

  • Docker Engine 25.0 or later is required. We recommend 28.0.1 or later, because earlier versions can fail to create IPv6 networks with Forgejo Runner v13.
  • The GITEA_DEBUG, GITEA_TRACE, GITEA_RUNNER_CAPACITY, GITEA_RUNNER_FILE, GITEA_RUNNER_ENVIRON and GITEA_RUNNER_ENV_FILE variables are ignored. Remove them from your runner configuration and environment.
  • The container.network_mode option is removed. Use container.network instead.

  For more details, see the release announcement of Forgejo Runner v13.0 and the release notes of Forgejo Runner.

  If you have any questions, feel free to contact our Help Center.

• announcement

  One SSH address for all STACKIT Git instances

  Sep 25, 2026

  On October 27, 2026, from 20:00 to 23:00 (UTC), SSH access to STACKIT Git moves to one shared address. The name of your instance becomes the first element of the repository path. This reduces the publicly exposed surface of your instance and lets us improve the reliability of Git operations over SSH in one place.

  • Previous address: git@ssh.<instance>.git.onstackit.cloud:<owner>/<repository>.git
  • Address after the maintenance: ssh://git@ssh.git.onstackit.cloud/<instance>/<owner>/<repository>.git

  How you are affected

  During the maintenance every Git instance is restarted once and is unavailable for about one minute. The restarts are staggered, so not all instances are affected at the same time. Access over HTTPS, your repositories, your users, your registered SSH keys and your IP allowlists do not change.

  The previous address keeps working until April 27, 2027. Your existing clones and your automation continue to work after the maintenance, so you can move them at your own pace. We remind you before we switch the previous address off.

  What to prepare before October 27, 2026

  • Allow outbound traffic to 213.17.16.145 on port 22, if your network restricts outbound connections.
  • Add the host key of ssh.git.onstackit.cloud, if your systems verify host keys. Its fingerprint is SHA256:I4jgl6ALgx5qOWwpQVC2M613dV7R0Wy6LfQQ5LQKwR4 (ED25519).
  • Make sure the SSH key your client offers to ssh.git.onstackit.cloud is registered in your instance.
  • Identify every place that holds the address: local clones, build pipelines, deployment automation, infrastructure as code module sources and repository mirrors.

  What to do after the maintenance

  Update the remote address of each repository:

  git remote set-url origin "$(git remote get-url origin | sed -E 's#^(ssh://)?git@ssh\.([^.]+)\.git\.onstackit\.cloud[:/]#ssh://git@ssh.git.onstackit.cloud/\2/#')"

  For the full instructions, including how to select the right key when you work with more than one SSH key, see Connect to your repositories with SSH.

  If you have any questions, our Help Center is always at your disposal.

• announcement

  New Pipeline Approvals & Portal Controls

  May 26, 2026

  We are pleased to announce a major update to STACKIT Git & Pipelines, introducing enhanced security controls, pipeline governance, and advanced identity management features directly from the STACKIT Portal.

  Pipeline Governance: Protected Workflows & Approvers

  To ensure higher resilience and meet enterprise change management standards, we have introduced Pipeline Approvers. Empower your team to ensure the highest quality standards by enabling designated members to review and authorize critical deployment pipelines before execution. There are two ways to implement this functionality depending on your setup:

  • Manual Workflow Approval: A seamless UI-driven configuration within the STACKIT Portal to pause workflows and require manual validation before moving to high-risk deployment stages.
  • Split workflow: Configure your code in two different files, so you get the same final behaviour but with less customization.

  Advanced Identity & Access Management (IAM)

  We have significantly improved user life cycle management and access security:

  • Identity Provider (IdP) Integration: Connect your corporate Identity Provider directly to your STACKIT Git instance to automate user onboarding and federation.
  • Local vs. Technical User Creation: Administrators can now differentiate between standard internal users (Local) and automated automation tokens/accounts (Technical Users), reducing the risk of unauthorized privilege escalation.

  Network & administrative controls from the Portal

  You no longer need to manage advanced configuration with API or backend support requests. The STACKIT Portal now offers full self-service capabilities for:

  • IP Address Whitelisting (ACL Control): Secure your Git repositories by restricting inbound and outbound traffic to trusted enterprise network ranges directly from the instance network settings.
  • User Admin Management: Complete control over user permissions, seat allocations, and project visibility through a unified administrative panel.

Git Release Notes