Tag
Ci tools
24 reviewed tools: 22 free or open source, 1 hosted with a real free tier, 1 paid or paid-led.
Order: free and open source first, then hosted products with a real free tier, then paid-led; catalog order inside each group, with quiet or archived repos last. Not a score, and no tool pays for its place.
24 tools
- DaggerApache-2.0 CI as containers, programmable in your language
Free / OSS · Apache-2.0 · 16.4k GitHub stars
VerdictApache-2.0 portable CI. The pipeline is code; Cloud is optional; its pricing is not confirmed here.
CatchYou need Docker or a compatible engine. Rewriting mature CI YAML is a project, not an afternoon. Dagger Cloud is a separate product with its own pricing.
- Woodpecker CIApache-2.0 container-native CI; self-host forever, no paid tier
Free / OSS · Apache-2.0 · 8k GitHub stars
VerdictApache-2.0 container CI. Self-host free forever; no SaaS tier.
CatchSelf-host only — not GitHub Actions managed UX. Smaller plugin ecosystem than Actions/Drone-era commercial. You own runners, secrets, and forge OAuth. Distinct from GitHub Actions and Buildkite hosted.
- PromptfooMIT LLM evals & red-teaming CLI; Community free, 10k probes/mo
Free / OSS · Freemium · 26.2k GitHub stars
VerdictMIT eval/red-team CLI. Free core; probe cap + Enterprise sales wall.
CatchVs DeepEval/Braintrust: YAML/CLI-first, not pytest-native Python or Braintrust SaaS. Community caps red-team probes (~10k/mo); Enterprise/On-Prem are contact-sales (SSO, dashboards, dedicated runner). LLM API costs are yours. Acquisition governance is a multi-year bet.
- GitleaksMIT secret scanner for git/dirs/stdin; CLI free, org Action needs free key
Free / OSS · OSS/MIT · 30.2k GitHub stars
VerdictMIT secrets CLI. Free forever; org Action wants free license key.
CatchMaintainer marks feature-complete (security patches; focus shifting to Betterleaks). Official Action for GitHub org repos needs a free license key from gitleaks.io — personal accounts exempt. Not a full ASVS/SAST suite. False positives need allowlists.
- GrypeApache-2.0 SBOM-first vulnerability scanner from Anchore; free CLI
Free / OSS · Apache-2.0 · 13.1k GitHub stars
VerdictApache-2.0 SBOM vuln scanner. Free CLI; Enterprise is the paid cousin.
CatchVuln scanner — not Trivy's IaC/secrets swiss-army, not Cosign signing, not Anchore Enterprise governance UI. You still triage CVEs. Anchore monetizes Enterprise separately.
- MailpitMIT local/CI SMTP sink — MailHog successor, not delivery
Free / OSS · OSS/MIT · 10.7k GitHub stars
VerdictMIT MailHog successor for local/CI. Free forever; not a mailer.
CatchSink only — not delivery. Not Resend SaaS, not Postal/Listmonk outbound. Do not point production MX here. Distinct from Resend/Postal/Listmonk.
- moonMIT VCS-aware monorepo task graph beyond Turborepo
Free / OSS · OSS/MIT · 4.2k GitHub stars
VerdictMIT monorepo task graph. Free forever; self-host RE cache after moonbase sunset.
CatchMoonbase Cloud remote cache is sunset - use bazel-remote or Bazel RE API (or Depot). Not a Turborepo drop-in.
- SOPSMPL-2.0 encrypts config values; keys stay readable
Free / OSS · MPL-2.0 · 23.5k GitHub stars
VerdictMPL-2.0 secrets-in-git. Free forever; use age underneath when you want KMS-free recipients.
CatchVs age (file encryption) and Infisical (secrets product): SOPS is the *structured config encryptor*, not a password manager and not a hosted vault UI. You still design key distribution, rotation, and who can decrypt in CI. Binary mode encrypts whole files when structure does not apply.
- OxlintMIT Rust JS/TS linter from Oxc; ESLint-class rules at CI speed
Free / OSS · OSS/MIT · 23.1k GitHub stars
VerdictMIT JS/TS linter. Free forever when you want ESLint-shaped signal without ESLint-shaped CI time.
CatchVs Biome (formatter+linter toolchain): Oxlint is the *linter* product (Oxfmt/Vite+ are separate). Some ESLint plugin edge cases still push hybrid setups. JS plugins called alpha on the docs. Not a bundler. It is part of the Oxc project, the Rust JavaScript toolchain whose parser it runs on (see Oxc below).
- HurlApache-2.0 plain-text HTTP tests powered by curl
Free / OSS · Apache-2.0 · 19.3k GitHub stars
VerdictApache-2.0 HTTP test files. Free forever; commit the session, run it in CI.
CatchVs xh/HTTPie (interactive HTTP CLIs) and Bruno/Hoppscotch (API *clients*): Hurl is the *plain-text test runner*, not a REPL client and not a collections GUI. You author `.hurl` files; it is not Postman-shaped collaboration. libcurl semantics apply.
- actMIT run GitHub Actions locally in Docker
Free / OSS · OSS/MIT · 72.4k GitHub stars
VerdictMIT local Actions runner. Free forever; debug the workflow before you burn a push.
CatchVs hosted GitHub Actions and Woodpecker (self-host container CI): act is a *local emulator*, not a forge runner fleet and not a replacement for GitHub-hosted minutes. Event payload fidelity is incomplete; secrets, service containers, and some actions still surprise. Needs a Docker engine.
- GoReleaserMIT Go release automation — archives, checksums, Homebrew, Docker
Free / OSS · OSS/MIT · 16.1k GitHub stars
VerdictMIT Go release CLI. Free forever OSS path; Pro is optional paid power, not required to ship a tag.
CatchGoReleaser *Pro* is a paid closed-source distribution (extra installers, air-gap, NPM publish, AI notes, etc.). The MIT OSS CLI covers most open-source Go release lanes — do not confuse Pro marketing with the free binary. Vs hand Makefile + gh release: you still own signing keys, registry auth, and tag discipline.
- kindApache-2.0 Kubernetes clusters inside Docker
Free / OSS · Apache-2.0 · 15.6k GitHub stars
VerdictApache-2.0 local kube. Free forever; spin a cluster in Docker, tear it down in CI.
CatchVs k3d/k3s (lighter single-binary k8s), colima (container runtime host), and minikube: kind is *Kubernetes-in-containers*, not a production control plane and not a substitute for cloud quotas. Needs a working container runtime; multi-node “realism” is still fake under one Docker host.
- OJRust-native React build tool aimed at agents and CI
Free / OSS · OSS/MIT · 608 GitHub stars
VerdictMIT Rust React builder. Reach for it when parallel agent/CI builds make Vite’s memory cost the bottleneck.
CatchVs Vite (default SPA/library toolchain) and Rolldown/Oxc-adjacent Rust tooling: OJ is the agent/CI-memory-oriented React builder, not the ecosystem default yet. Young Lovable Labs surface — verify plugin compatibility before you rip Vite out of a production app.
- Claude Code ActionMIT GitHub Action — Claude Code on your runner, model calls still bill
Free / OSS · OSS/MIT · 9.6k GitHub stars
VerdictMIT GitHub Action when Claude Code should run in CI on your runner — not the local CLI; budget the model bill.
CatchModel calls still bill Anthropic, Bedrock, Vertex, or Foundry — there is no free model. Vs Claude Code: that gem is the local terminal CLI (paid Max or API); this catch is the GitHub Action that runs on your runner, not the local CLI. Action permissions and secrets are the real gate; pin tag v1.
- GitHub Agentic WorkflowsMIT gh extension — Markdown agent jobs compiled to Actions with safe outputs
Free / OSS · OSS/MIT · 5.4k GitHub stars
VerdictMIT agentic GitHub Actions when you want triage/review/CI-investigation bots with read-only agents and buffered writes — pin versions and budget minutes plus tokens.
CatchMaturity: pre-1.0 and the README itself says use with caution at your own risk; releases `>=0.83.3 <0.85.4` were retired after a security advisory — pin a current version. Cost is real: every run spends Actions minutes plus your engine’s tokens/seat. Permissions, tools, and network access are configurable, so a careless frontmatter undoes the sandbox. Vs claude-code-action: that runs Claude Code on PR/issue events; gh-aw is a multi-engine workflow compiler with a write-buffer safety model.
- TruffleHogAGPL-3.0 secret scanner that finds leaked credentials and checks whether they still work
Free / OSS · AGPL-3.0 · 28.6k GitHub stars
VerdictThe scanner to run when you need to know which leaked keys are live — mind the AGPL and the outbound verification calls.
CatchLicense first: AGPL-3.0 is copyleft, not permissive — check it with your legal team before embedding or modifying it in a product you distribute or offer as a service. Verifying a secret calls the real provider’s API with it, so scans make outbound requests and show up in that provider’s logs. Continuous monitoring of Slack, Jira, Confluence and similar tools is in the paid Enterprise product; the open-source CLI covers one-off and CI scans. Vs gitleaks (MIT, fast regex scanning, no live verification): TruffleHog tells you which leaks still work, at the cost of a copyleft license and network calls.
- GiteaMIT self-hosted Git forge in a single Go binary — repos, PRs, issues, packages, Actions-compatible CI
Free / OSS · OSS/MIT · 58.6k GitHub stars
VerdictThe default self-hosted Git forge when you want GitHub-style workflows on your own box — MIT, but company-steered.
CatchGovernance first: in 2022 the trademark and domains moved to the for-profit Gitea Ltd, which sells Gitea Cloud and an enterprise edition; that is why the community forked Forgejo. You run it, you own backups, upgrades and runner security — Actions compatibility is good but not complete, so some marketplace actions need tweaks. Vs forgejo (GPLv3+ community fork, runs Codeberg): same roots, pick Gitea for MIT and the larger ecosystem, Forgejo for community governance.
- preloopMIT self-hosted GitHub Actions with microVM-isolated jobs
Free / OSS · OSS/MIT · 224 GitHub stars
VerdictSelf-hosted GitHub Actions with real VM isolation — promising, but young; try it beside your existing CI first.
CatchYou run a server, not a one-shot CLI — expose it on a tailnet, tunnel or your own domain and keep it patched. It is a small, young project (first commit mid-2026), so expect rough edges and pin versions. Vs act (runs workflows locally in Docker containers with one command): preloop is the heavier choice when you want real isolation and a standing CI service you own.
- OneDevMIT self-hosted Git server with CI/CD, kanban and code search
Free / OSS · OSS/MIT · 15.3k GitHub stars
VerdictAn underrated all-in-one GitLab alternative — strong if you want CI and code intelligence in one box.
CatchIt is one big Java application, heavier than Gitea or Gogs. Starting with 16.9.0, Intel Macs and FreeBSD are no longer supported. Issues and PRs live on the project's own instance (code.onedev.io), not GitHub, so the GitHub repo is a mirror. Fewer third-party integrations than GitLab.
- GitifyMIT menu-bar app for GitHub, GitLab, Gitea and Bitbucket notifications
Free / OSS · OSS/MIT · 5.4k GitHub stars
VerdictA small, reliable way to stop living in the GitHub notifications tab.
CatchIt shows the notifications your forge already sends; it does not add smarter rules or triage. Feature support differs by forge (Bitbucket and Gitea have no mark-done or unsubscribe), and Azure DevOps and Gerrit are not supported. You hand it access tokens for each account.
- RagasApache-2.0 RAG/agent eval metrics — synthetic data + CI scorers
Free / OSS · Apache-2.0 · 16.1k GitHub stars · quiet 180d+
VerdictApache-2.0 RAG/agent eval metrics when faithfulness and context precision beat a hosted eval bill — not DeepEval pytest, not Promptfoo red-team.
CatchVs DeepEval (pytest-native agent/chat metrics + Confident AI cloud) and Promptfoo (YAML/CLI red-team): Ragas is RAG-first metric library + synthetic data, not a full red-team harness and not Confident AI dashboards. LLM-as-judge burns provider tokens; cloud extras (if any) are optional — core library stays OSS.
- GitHub ActionsCI/CD that lives where your code does
Free tier · Freemium
VerdictThe default CI/CD for GitHub repositories.
CatchYAML syntax has a learning curve. Debugging failed workflows is frustrating. Costs scale with build minutes. Complex workflows become hard to maintain.
- BraintrustEval-first LLM platform that blocks bad prompts in CI
Paid-led · Freemium
VerdictThe platform for teams whose deployment loop is change-measure-ship.
CatchEval-first means observability is secondary—if your primary loop is debugging traces, look elsewhere. Learning curve to build eval datasets that actually represent production.
FAQ
- What is the top free pick among Ci tools?
- Dagger leads the Stack Gems list for Ci tools. Verdict: Apache-2.0 portable CI. The pipeline is code; Cloud is optional; its pricing is not confirmed here.
- How many Ci tools does Stack Gems review?
- 24: 22 free or open source, 1 hosted with a real free tier, 1 paid or paid-led. Each review has a verdict and an honest Catch; no tool pays for its spot.
- Which Ci tools can I self-host for free?
- Dagger, Woodpecker CI, Gitleaks, Grype, Mailpit, moon, SOPS, Oxlint and 13 more.
- Which Ci tools have the most GitHub stars?
- act (72.4k), Gitea (58.6k), Gitleaks (30.2k), per GitHub on 2026-10-21. Stars measure attention, not fit; read the Catch.
- What is the catch with Dagger?
- You need Docker or a compatible engine.