p.enthalabs

Roku developer repositories moved from GitHub to GitLab

blog.roku.com · Read Story HN original

Comments

The readme.md still says welcome to their GitHub repository :D
A devops friend of mine said GitHub turned into a hot mess.
Because of unreviewed AI code at GitHub services?
Or maybe because the use of GitHub has skyrocketed?
Because MS is at helm
Why? Any specific reasons?
Do you have some time?
>> Why? Any specific reasons?

> Do you have some time?

Okay, I laughed.

I wish they would spill some tea and articulate why they moved.
why? like having a dozen outages in the last couple months isn't a good enough reason why?
Or Microsoft/OpenAI (and others) just blatantly scraping all your codebases and violating thousands of OSS licneses?
We're going to need something more expansive than OSI software licenses for the future.

Something like, "if you look at us, we must be able to look at you"

How about "if you're not the customer, you're the product".
At the risk of stating the obvious, that isn’t a software license.
If the repos are public, hosting location doesn't make a difference.
public repos don't have to be scraped or cralwed all over by bots right?
They should not, then again they are.
No horse in this race but GitLab has been down a few times recently too.
GitLab is just as bad, just not as big so doesn't get the coverage. https://status.gitlab.com/pages/history/5b36dc6502d06804c083...

And of course many people self-host which changes a lot of the equation (which you can also do with GitHub, but not for free - and FWIW our self-hosted premium gitlab has about an hour a day downtime, which we've been told by the team responsible is an unavoidable side-effect of backing up gitlab).

Weird. I’ve been on a self hosted enterprise gitlab and I think we’ve have only one or two performance degradations/outages in the past 6 years
We’re talking about the SaaS version, not self-hosted.
Are you sure?

> [...] and FWIW our *self-hosted* premium gitlab has about an hour a day downtime

AND
I was responsible for administering a self hosted GitLab instance for a medium sized company and our backups never required downtime. The built in backup command doesn't require downtime but also isn't a consistent point in time snapshot (specifically because the instance keeps running while the backup is being taken). If they've decided they need one for some reason, stopping GitLab is certainly the easiest way, but not the only way of accomplishing that goal, but that'll be true of any self-hosted forge, including GitHub.
You could stop it, do a snapshot of the storage and backup that for <1 min of downtime probably.

But at the same time, if you're not a global company, doing it at 3am is probably fine.

It can be an issue if you are using gitlab as your container/package registry and production workloads need to pull from it, though.
They should be pulling from a pull through scanning repository cache anyway, so they can be scanned before going into production.
Doing a snapshot of the storage while it's running wouldn't be bad either, it'd just be like having cut power at the point of the snapshot, right?
Yes. And the database used by GitLab is Postgres which handles that just fine.
Considering the sheer volume GitHub received lately I wouldn’t be surprised if GitLab would experience similar issues unless self hosted.

Or what do you think?

Would also like a write-up. People assume it's just because of GitHub outages, but GitHub is slightly worse in every aspect, so for big projects and organisations it compounds to being quite messy to manage and operate.

GitLab is thought-out to support larger groups with more complex pipelines, and while it's got it's own set of quirks, it doesn't begin to compare, GitHub in contrast seems like a toy forge for toy projects.

Having used GitLab pipelines, I would definitely not describe it as well thought out. Their method of forcing all jobs/pipelines for a repo through one file controlled with a load of ‘if’ rules is a complete mess. Makes running multiple pipelines for one repo a huge PITA. Compared to GitHub Actions or Jenkins its a pretty poor experience
This only happens on poorly thought pipelines and GitHub actions model or Jenkins high level directives won't make up for it. Eventually it'll break.

In Gitlab you can use the main file for describing high level stage pathways (tests, builds, deployments...) and offload individual control of jobs to granular files. Tests can be self contained child pipelines. Templates make them easy to replicate and components give them more flexibility.

You can do a lot more than GitHub actions with a lot less complexity than Jenkins.

Roku uses Gitlab internally so could just be a standardization thing.
Moving changes back and forth between gitlab and github is a pain. Could indeed be as simple as standardization and reducing development pains.
What makes it more complicated than doing a Git push against two remotes? Assuming that one of those is used for collaboration and the other is just a mirror.
The CICD pipeline is not directly compatible, for one.
You don’t need to run the CI/CD pipeline in both. Choose one as your collaboration space, and the other as a mirror.
Probably the lack of transparency regarding AI and AI accounts. They don't require any declaration..
Good. I want everyone to do this. I want to see the downfall of Microsoft. Time and again they've proved that anything they touch can't be trusted nor reliable. I am tired of this. They even bully their users - on Mac OS, GitHub desktop doesn't respect the word "no". It installs all kinds of helpers and acts like borderline spyware. Someone created an issue about it on Github and the MS employees told them to fuck off in corporate[1]

I am even considering hosting my own GIT server myself. Some of our deployments got affected multiple times in the last 6 months alone we were really caught off-guard. Thankfully our clients were understanding of the GitHub outages. But, this should not be the baseline. Reliability should not be the cost of doing business.

[1] https://github.com/creativefoundrysg/desktop#an-open-letter-...

Github desktop is such a hot mess that I instead choose to continue to suffer with SourceTree. Sourcetree annoys me for reasons I still cannot articulate after a decade, but it at least tends to actually work without being too intrusive as far as updating, doesn't randomly derp out on credentials, and is super handy when trying to visualize janky branch patterns of dev teams.
Just use Sublime Merge, it's probably the best GUI for Git there is.
GitKraken has been good in my experience with it for many years
I'm hosting Forgejo for my homelab and couldn't be happier. I have everything running in containers with dind for CI/CD. Most of my workflows just worked with minimal changes. YMMV and this is far from an enterprises' needs but it's working great so far for my needs.
My friend group also moved to self hosted forgejo. Couldn’t be happier and then I don’t have LLMs training on my code.
Thank you, just looking at it. Looks awesome so far. Thanks so much!
As an idea, do you think an enterprise only Git host would work.

Say annual contracts start at 100k minimum and everyone gets a dedicated support engineer.

You get your own rack. None of this degraded shared capability nonsense.

Does that seem like a solid business ?

Is that Bitbucket?
Both GitLab and Bitbucket still offer free repos for hobbyists.

What I'm thinking of is a company that exclusively caters to the enterprise.

You get a support engineer and they help on everything, migration, CI/CD, hosting, etc.

Nothing goes down without a solid 3 page write up.

I think so, but, only if you differentiate in the privacy angle (think Proton vs GMail) and this is similar to how most enterprise GIT offerings work, too. The risk is GitHub offering to existing orgs who are already on Office 365 a self-hosted version (I think they already do). So, this business model will fail in the SWOT analysis itself. Still, there might be some looking to exit MS office ecosystem, it might make more sense for them.
It’s a dream, I don’t have the money to do it.

But it could work as a franchise model too, maybe I just refer your company to an affiliate located in your country of choice.

For example, most European clients would pick German locations.

If I was in the EU I’d be applying for a grant to build on the idea. Their’s no rational reason for European companies to fully trust Microsoft to act in good faith.

No. You'd be competing with multiple mature cloud services plus Github Enterprise Cloud/self-hosted plus multiple open source options.

I don't need or want a dedicated support engineer for my VCS, I need it to integrate with all the bullshit products I already have, tick off the compliance and governance checkboxes for the suits, give me controls so SWEs do less dumb shit and above all, not be something I have to think about except at contract renewal time.

I'm just not going to trust a rando to run all that for me and get it right, especially not at that price point.

Thank you for the blunt feedback.

Ideally this would be DevOps as a service. But I’d have to charge an absurd amount of money to do it right.

Back to the drawing board

>Good. I want everyone to do this

Every other free service would die nearly instantly, so maybe only want useful things to move to other services.

>I am even considering hosting my own GIT server myself.

It's mostly a good idea.... but, with the current security apocalypse we seem to be under making sure your own shit doesn't get pwned is a full time job. The level of security hostility on the internet recently has reached numbers I've never seen before. RCE's dropping about every day, more targeted scans than I've ever seen in my life, swarms of AI bots breaking into services.

Running an up to date self hosted Gitea server takes like 5 minutes a week.
I mean, last year, but if you're updating once a week now, that means you've had 6 days to get exploited.
Nope. Take a look at gitea update frequency.
Missing the point completely. It doesn't matter how often they update, it matters how fast attackers find exploits.
> making sure your own shit doesn't get pwned is a full time job.

Not if you didn't vide code your architecture. I have a 7 year box running without a single incident (touchwood) because 7 years ago we didn't have vibe coding and I used a compiled language. To use PHP for anything serious in 2026 is just insane, let's be honest.

Thanks for a good laugh, FOSS in 2026 is nothing without the money of big corporations, including Microsoft.

Everyone spent years talking against GPL, business friendly licenses like MIT and Apache were the way of the future, not viral and co.

Now we are here, most projects have their key contributors working at corporations like Microsoft, or gladly getting their acquisition money to pay the VCs, embrace your business friendly licenses.

So, the solution is just "suck it up and deal with it"? We pay good money to Microsoft for some of our client orgs and defending this level of piss poor reliability is just cope in the name of support for FOSS. I don't see why this should be accepted. This is mainly because their shitstorm that's Azure.
Hardly any different from dealing with Amazon or Google clouds problems and support, other FOSS darlings.
We did the same, quit happy
GitLab will eventually just get overran with 24/7 agents spewing from their AI Slop Cannons
> GitLab will eventually just get overran with 24/7 agents spewing from their AI Slop Cannons

That's fine. GitLab offers self-hosted solutions where companies run the service in their own infrastructure and limit who has access to it. The same cannot be said by GitHub, though.

Wouldn't that be Github enterprise? It's been around since 2012 IIRC.
Yes, though enterprise is expensive and GitLab still had a free option last time I checked.
> The same cannot be said by GitHub, though.

That isn't true. Self hosted Github exists, and has for years now. From what I hear (from a friend who had to administer his company's instance) it's not a good product by any means, but it does exist.

It's a paid enterprise offering vs GitLab Open Source
I moved my projects over to GitLab about a year ago.

GitLab's model is different - at least it was when I moved over to it. They charged for public repositories and gave you a free private ones as a sampler for trying out the platform. That approach is far less prone to getting overrun by millions of slopositories.

GitLab never tried to be the social media of software development. Theirs is a much simpler, classical model - one of the reasons I switched to them: you pay them money, they provide you services for that money.

It already is. (source: we use it as our primary forge)
They recently added more limits which should prevent a lot of AI abuse (which GitHub should have added a year ago). They also require a credit card now, and require payment immediately for exceeding storage limit or more than 5 people on a free/personal team.
So they replaced a tool from an evil corporation by another one disguised as an open source project.
This logic baffles me. This would mean no one gets any work done and we go in a perennial cycle of victimhood

    > disguised as an open source project
A software project either is or isn't open source. Gitlab CE is source-available (here: https://gitlab.com/gitlab-org/gitlab) with an MIT license, which is a permissive open-source license.

Gitlab CE is open-source. There exist versions of Gitlab with features that require payment. This does not mean that Gitlab (the product) is not open-source; it means that Gitlab (the company) has a core product which is open-source, and then sustains its development through the sale of licenses to product tiers beyond that.

I always found it wierd that people flocked to github. The app sucks, if I have to use it for work it infuriates me at nearly every turn with its sad excuse for UI. People like free sh*.

As for gitlab...yuck. But whatever. Most of the dev tool space is really just "sh* we have to put up with now", none of it is any good, all of it is dated from the early aughts, and taken as a whole is even worse because none of it works together.

While software development itself got better in the last ten years these tools stayed the same or got worse (enshittification). And this is part of why folks are self hosting.

The other part is that AI is destroying the Internet and its time to pack your bags anyway. The smart people already have.

Well you're a developer. Why don't you make something better instead of complaining?
> I always found it weird that people flocked to github.

Same reason we ended up with git. Their predecessors were significantly worse, and then they had enough momentum to keep going.

> I always found (...)

You broadcasted your negative feedback but it seems you had no positive remarks to give. If you feel everything is so bad, would you mind sharing what tolerable alternatives are there to GitHub and GitLab?

> mind sharing what tolerable alternatives are there to GitHub and GitLab?

Not the op, and while your criticism of their negativity may be somewhat justified, the ask is kind of silly. There are a bunch of well known alternatives:

Self-hosted free software:

Gerrit <https://www.gerritcodereview.com> Phorge <https://we.phorge.it>

SaaSsy:

Codeberg <https://codeberg.org> SourceHut <https://sr.ht/>

There are a lot more, of course, these are just the ones I have experience with.

> Not the op, and while your criticism of their negativity may be somewhat justified, the ask is kind of silly.

Not really. It's pointless to go around accusing everyone of picking what they believe to be subpar alternatives when they even fail to establish what the par actually is, let alone what would be a preferred option.

It's as if they post this blend of comments just to try to feel smug.

> There are a bunch of well known alternatives:

See, that's what makes these exercises pointless. Those might work for your weekend pet projects, where you have the luxury of wasting all Sundays toying with how to deploy CICD systems because you have nothing better to do. For actual work, not so much. For example, SourceHut is renowned for being in perpetual alpha. It's baffling how it's being floated as a reasonable alternative to either GitLab or GitHub. Here's what they have to say about the risk of choosing them at this stage:

https://sourcehut.org/alpha-details/

There are none. This industry is a joke on all of us.
Worth mentioning that Roku is being acquired by Fox so in the virtue battle with Microsoft neither are clean
it seems like all the media companies are being bought up by a select few people

does not portend good things for the future

for the future? this has already been happening for years and is a major reason we're in the predicament we're in
What predicament are we in?