Diffinery

The open-source GitHub and GitHub Actions alternative that runs entirely on Cloudflare. Git hosting, pull requests, code review and drop-in GitHub Actions CI, built for teams of people and AI agents. Deploy it to your own Cloudflare account: no servers, no runner machines, nothing to patch.

Website · Docs · Deploy your own · Compare · Performance · Roadmap · llms.txt

Diffinery hosts Git repositories, pull requests with reviews and a merge queue, issues, releases and a container registry, and runs your existing .github/workflows/*.yml files as they are, marketplace actions included. AI coding agents such as Claude Code, Codex and Cursor get accounts of their own, with guardrails the server enforces, and work through a built-in MCP server, the GitHub-compatible REST and GraphQL APIs, git or the CLI. Everything runs on Cloudflare: Workers, Durable Objects, D1, R2, Queues, Workflows and Containers. It is free, open-source software under the Apache License 2.0, and you deploy your own instance to your own Cloudflare account and domain.

• Source: diffinery.com/codician/diffinery, where development, CI and deploys happen, mirrored to github.com/codician-team/diffinery.
• Documentation: diffinery.com/docs, also as Markdown and in llms.txt and llms-full.txt for AI assistants.

If Diffinery is useful to you, a star on GitHub helps other people find it.

Contents

• Who Diffinery is for
• Why Diffinery
• Screenshots
• Features
• How it compares
• Self-host on your own Cloudflare account
• How it runs on Cloudflare
• Develop locally
• Repository layout
• What Diffinery doesn't do (yet)
• FAQ
• Contributing, security and license

Who Diffinery is for

• Teams looking for a GitHub Actions alternative that keeps their workflow YAML: Diffinery reads .github/workflows/ with the same syntax and runs marketplace actions, on runners with 4 vCPUs and 12 GiB by default.
• Teams that want a self-hosted GitHub alternative without running servers. Like Gitea, Forgejo or GitLab, you run your own instance, but it deploys to Cloudflare's serverless platform instead of a VM or a Kubernetes cluster.
• Teams that want faster CI runners than GitHub's standard 2-vCPU runner for private repositories, without paying a separate runner service such as Blacksmith or Depot.
• Teams working with AI coding agents (Claude Code, Codex, Cursor and others) that should open pull requests a person approves, rather than push to main.
• Cloudflare developers looking for a large, real-world application built on Durable Objects with SQLite, Containers, Workflows, Queues and R2.

Why Diffinery

• Git hosting, pull requests and CI in one serverless app. One Cloudflare Worker serves the web UI, git over HTTPS, a GitHub-compatible REST and GraphQL API, and an MCP server. Each repository is its own Durable Object with its own SQLite database, so repositories scale out instead of sharing one database server.
• Your GitHub Actions workflows run unchanged. The same triggers, expressions, matrices, needs, outputs, reusable workflows, environments, secrets, variables, OIDC, service containers and Docker. Marketplace actions (uses: owner/repo@ref) are downloaded and run. Every known difference is listed in Compatibility with GitHub Actions.
• Runners that exist only while a job runs. Each job gets a fresh Ubuntu 24.04 container on Cloudflare Containers, billed by Cloudflare only while it runs. The default size has 4 vCPUs and 12 GiB of memory, and jobs that use little of it move to smaller sizes on their own. Self-hosted runners cover macOS, Windows, Arm and GPUs.
• Built for AI agents, with a human in the loop. Agents are first-class accounts owned by a person or an organization, with their own tokens and limits. They can't push or merge to protected branches unless a rule allows it, their pull requests need a human approval, and every commit they make records who they act for. Agent tasks run Claude Code, Codex or your own command in a sandbox and open a pull request.
• Secure by default. Passkey sign-in with no passwords, invite-only accounts, branch protection, push protection that blocks leaked credentials, envelope-encrypted secrets, kill switches and an append-only audit log.
• Moving from GitHub is one step. A server-side importer brings a repository or a whole organization over with its history, issues, pull requests, reviews and releases, and gh, Octokit, VS Code and JetBrains IDEs work against Diffinery.

Screenshots

A repository, with the clone URL and one-click open in VS Code, Cursor, Windsurf and IntelliJ IDEA	A workflow run from .github/workflows/ci.yml, with a matrix and needs

Features

How it compares

Diffinery is a forge: it hosts your code and runs your CI. Here is how it sits next to the tools people usually compare it with. Facts about other products come from their own websites and documentation, checked in October 2026; each linked comparison cites its sources.

Read the details: Diffinery vs GitHub · vs GitLab · vs Gitea and Forgejo · vs Blacksmith · vs Depot · vs CircleCI · vs Buildkite · vs Bitbucket · all GitHub Actions alternatives · other Git and CI projects on Cloudflare

Self-host on your own Cloudflare account

Diffinery is designed to be deployed by anyone to their own Cloudflare account and domain. Nobody who uses your instance needs a Cloudflare account; only the deployment does.

You need:

• A Cloudflare account on the Workers Paid plan, with R2 enabled. Containers, Durable Objects with SQLite, Workflows and Queues need the paid plan.
• A domain on that account (Diffinery is served at the root of a hostname such as git.example.com).
• A Cloudflare API token with the permissions listed in Deploy your own Diffinery.
• Node.js 22, pnpm 10, Docker, jq, curl and openssl on the machine you deploy from.

Deploy:

git clone https://diffinery.com/codician/diffinery.git   # or the GitHub mirror
cd diffinery

export CLOUDFLARE_API_TOKEN=...            # never commit it
export CLOUDFLARE_ACCOUNT_ID=...
export DIFFINERY_DOMAIN=git.example.com    # your hostname
export [email protected]    # who becomes site administrator on first sign-in

scripts/setup.sh --dry-run                 # checks tools, token and config without changing anything
scripts/setup.sh                           # creates the Cloudflare resources and deploys

The setup script creates whatever is missing in your account (the D1 database, R2 bucket and lifecycle rules, queues, a Turnstile widget and a Cloudflare Access application for email recovery), applies the database migrations, deploys the Worker and the runner image, generates the Worker's own secrets once, and checks that the site answers. Every step is safe to repeat, so the same command updates an existing instance. Then open https://<your host>/auth/access, confirm your email with the one-time code and add a passkey: you are the first administrator.

You can also deploy from CI with the included Deploy workflow on Diffinery or GitHub Actions. The full guide, including email sending, DNS, Access and troubleshooting, is Deploy your own Diffinery, and every setting is described in Configuration.

How it runs on Cloudflare

More in Architecture.

Develop locally

pnpm install
pnpm -r build && pnpm -r typecheck && pnpm -r test
pnpm --filter @diffinery/app db:migrate:local
pnpm dev                                    # http://localhost:8787, signed in as [email protected]
pnpm --filter @diffinery/app e2e            # wrangler dev, real git, the runner agent and Chromium

pnpm dev runs the Worker under wrangler dev with local D1, R2 and queues, so you need no Cloudflare account to work on Diffinery. The end-to-end suite pushes real repositories with git, runs their workflows through the real runner agent, drives the MCP server and the REST API (with @octokit/rest), and signs in with passkeys in Chromium. See CONTRIBUTING.md.

Repository layout

apps/diffinery          the Worker: web UI, git, REST/GraphQL, MCP, Actions, D1 migrations, docs, e2e tests
apps/cli                the `diffinery` command-line client
apps/vscode             the VS Code, Cursor and Windsurf extension
apps/jetbrains          the JetBrains IDE plugin
plugins                 the Claude Code and Codex plugins (marketplaces in .claude-plugin/ and .agents/plugins/)
containers/runner       the runner agent, sandbox server and the container image
packages/git-core       git objects, packfiles, deltas, diff and merge, in pure TypeScript
packages/workflow-yaml  the GitHub Actions workflow parser, expressions, matrices and cron
packages/shared         types shared by the Worker and the runner
scripts                 setup, bootstrap and deploy scripts for Cloudflare

What Diffinery doesn't do (yet)

Diffinery is young, and we'd rather you know its limits before you move:

• Hosted runners are Linux x64 only. macOS, Windows and Arm jobs need self-hosted runners.
• HTTPS only for Git. There's no SSH access.
• No forks. Pull requests are between branches of the same repository.
• No wikis, discussions, Pages-style sites, Codespaces-style cloud editors or app marketplace.
• Reviews are simpler than GitHub's. No pending reviews, suggested changes or thread resolution yet, and branch protection has no code-owner reviews or signed-commit requirement.
• Some GitHub events, such as issues and issue_comment, are accepted in workflows but never start a run.
• No hosted service. Nobody runs Diffinery for you: you deploy your own instance.

The full lists are in Compatibility with GitHub Actions and Diffinery vs GitHub, and where we'd like to go next is in the roadmap.

FAQ

What is Diffinery?
An open-source git forge and CI platform that runs entirely on Cloudflare. It replaces GitHub's code hosting, pull requests and GitHub Actions in one app that you deploy to your own Cloudflare account.

Is Diffinery an open-source GitHub Actions alternative?
Yes. Diffinery runs GitHub Actions workflow files from .github/workflows/ with the same triggers, expressions, matrices, needs, reusable workflows, environments, secrets, OIDC, service containers and Docker, and downloads and runs marketplace actions (uses: owner/repo@ref). Every known difference is listed in Compatibility with GitHub Actions.

Is Diffinery a self-hosted GitHub alternative?
Yes. Like Gitea, Forgejo or GitLab, you run it yourself, but instead of a server or a Kubernetes cluster it deploys to Cloudflare's serverless platform, and its CI runs GitHub Actions workflow files instead of a format of its own.

How is Diffinery different from Gitea and Forgejo?
All three are open-source forges you run yourself. Gitea and Forgejo run on your own servers, with runner machines you install for CI. Diffinery runs only on Cloudflare: there are no servers or runner machines to look after, and each CI job gets a fresh container, but your code lives on Cloudflare's infrastructure. Gitea and Forgejo have wikis and a package registry, which Diffinery doesn't. See Diffinery vs Gitea and Forgejo.

Is Diffinery an alternative to Blacksmith or Depot?
For a different kind of team. Blacksmith and Depot keep your code and pull requests on GitHub and run your jobs on faster machines, for a per-minute price. Diffinery replaces GitHub as well: your repositories move to your own instance, and your jobs run on 4-vCPU runners that your Cloudflare account pays for by the 10 ms. If you want to stay on GitHub and run nothing yourself, a runner service is the simpler choice. See Diffinery vs Blacksmith and vs Depot.

Do my GitHub Actions workflows run without changes?
Most do. Diffinery reads .github/workflows/*.yml with the same syntax and runs marketplace actions. Jobs that need hosted macOS, Windows or Arm runners need a self-hosted runner. See Compatibility with GitHub Actions.

Is Diffinery faster than GitHub Actions?
We don't run jobs on GitHub to benchmark it, so we don't claim a speed-up figure. Diffinery's default runner has 4 vCPUs and 12 GiB, while GitHub's standard Linux runner for private repositories has 2 vCPUs and 8 GB, so jobs that use several cores get twice as many. On Diffinery, jobs start about 3 to 5 seconds after they're queued. See the measured performance.

Can I run Diffinery CI while my code stays on GitHub?
Yes. A small GitHub workflow mirrors every push to your Diffinery instance, which then runs the same .github/workflows/ files, and can fail the GitHub job when the runs on Diffinery fail. See Run Diffinery CI while your code stays on GitHub.

What does it cost to run?
Diffinery is free and open source under the Apache License 2.0, with no paid edition. Running it costs whatever your own Cloudflare account bills: the Workers Paid plan plus usage. Hosted runners are Cloudflare Containers, which bill only while a job runs.

Does it run on Cloudflare's free plan?
No. Containers, Durable Objects with SQLite, Workflows and Queues need the Workers Paid plan. See Deploy your own Diffinery.

Does it work with AI coding agents?
Yes. Agents connect over MCP (https://<your host>/mcp), the REST API, git or the GitHub CLI. There are guides for Claude, Claude Code, Codex, Cursor and VS Code, and a plugin for Claude Code and Codex, installable with claude plugin marketplace add https://diffinery.com/codician/diffinery.git (sources in plugins/). See Connect AI apps.

Can an AI agent merge its own pull request?
Not by default. Unless a branch protection rule allows it, agents can't push to or merge into protected branches, their pull requests need a person's approval, their check results never satisfy required checks, and runs of code they pushed get no secrets. See Guardrails.

Can I move my repositories from GitHub?
Yes. The importer brings a repository or a whole organization with history, issues, pull requests, reviews and releases. Secret names come over with a field to enter each value. gh, Octokit, VS Code and JetBrains IDEs work against Diffinery. See Migrate from GitHub.

Can I sign up on diffinery.com?
diffinery.com is the project's home and the instance Diffinery is developed on; accounts there are by invitation for the people working on it. It isn't a hosted service. To use Diffinery, deploy your own instance.

Is Diffinery the only Git platform on Cloudflare?
No. Other open-source projects run Git or CI on Cloudflare too, and Built on Cloudflare lists how they differ. As far as we know, Diffinery is the one where Git hosting, pull requests with reviews in a web UI and GitHub Actions–compatible CI with marketplace actions all run on Cloudflare (checked October 25, 2026).

Where is development happening?
On Diffinery itself, at diffinery.com/codician/diffinery. Diffinery's own CI, deploys and pull requests run there. The GitHub repository is a mirror, and issues and pull requests are welcome in either place; see CONTRIBUTING.md.

Contributing, security and license

• Contributing: see CONTRIBUTING.md, and AGENTS.md if you're an AI coding agent. Please follow the Code of Conduct. Questions go to SUPPORT.md.
• Roadmap and changes: ROADMAP.md and CHANGELOG.md.
• Security: please don't open public issues for vulnerabilities. Report them privately as described in SECURITY.md.
• Citing Diffinery: use GitHub's "Cite this repository" button, or CITATION.cff.
• License: Apache License 2.0. See NOTICE.