# Attribution

Every component is under a permissive licence. Preserve each project's
copyright and licence notice if you redistribute.

| Component | Licence | Pinned commit | Source |
|---|---|---|---|
| go-gitea/gitea | MIT | `66546045b5d5` | https://github.com/go-gitea/gitea |
| harness/gitness | Apache-2.0 | `main` | https://github.com/harness/gitness |
| woodpecker-ci/woodpecker | Apache-2.0 | `8fcfe04e79fe` | https://github.com/woodpecker-ci/woodpecker |
| nektos/act | MIT | `4f411281417e` | https://github.com/nektos/act |
| semaphoreui/semaphore | MIT | `7102353a6fb7` | https://github.com/semaphoreui/semaphore |
| gitleaks/gitleaks | MIT | `b58d3f102cf3` | https://github.com/gitleaks/gitleaks |
| checkmarx/kics | Apache-2.0 | `8a0f0bbaf380` | https://github.com/checkmarx/kics |
| aquasecurity/trivy | Apache-2.0 | `8f815546c7b5` | https://github.com/aquasecurity/trivy |

## What each does

### go-gitea/gitea
- Licence: MIT
- Role: Self-hosted git forge
- A lightweight git service with repos, issues, pull requests and packages. Fast on a small VPS, complete enough to replace a hosted forge.

### harness/gitness
- Licence: Apache-2.0
- Role: Git platform with built-in pipelines
- Repositories, pull requests and CI in one service - useful when you want the forge and the runner managed together.

### woodpecker-ci/woodpecker
- Licence: Apache-2.0
- Role: Container-native CI engine
- Pipelines are plain YAML, every step runs in a container, and it plugs into your git host. No build minutes to buy.

### nektos/act
- Licence: MIT
- Role: Run GitHub Actions locally
- Test a workflow before you push, on the machine in front of you, with the same syntax.

### semaphoreui/semaphore
- Licence: MIT
- Role: Automation control plane
- A web UI over Ansible, Terraform and shell tasks, with history and access control.

### gitleaks/gitleaks
- Licence: MIT
- Role: Secret scanning
- Scans repositories and history for hardcoded secrets - catches the key someone committed by accident, before it is public.

### checkmarx/kics
- Licence: Apache-2.0
- Role: Infrastructure-as-code scanning
- Finds misconfigurations in Terraform, Kubernetes and Docker before they are deployed.

### aquasecurity/trivy
- Licence: Apache-2.0
- Role: Vulnerability scanning
- Scans container images and dependencies for known vulnerabilities and licence issues. Fails a build on a critical finding.

## Note

Source is fetched at the pinned commits above rather than vendored.
No upstream project is modified.