Appsparokhet
Your code, behind the veil.
On parokhet, you own your code. Your repositories, your CI/CD and your packages live in one private forge. Move from GitHub or GitLab and your workflows run unchanged. Every artifact ships signed.
One push from commit to signed release
- GitHub
- GitLab
- Gitea
- Gogs
- OneDev
- Any git server
Why parokhet
- 01
Big tech holds your code.
On GitHub or GitLab, your repositories live on a platform someone else owns. On parokhet, you own your code, your builds and your packages. Repositories stay private by default.
- 02
Switching forges breaks your pipelines.
Your existing workflows run unchanged. Pull mirroring keeps the old forge in sync while you move.
- 03
You ship builds nobody checked.
Every artifact gets a signature, an SBOM and provenance. You build once and promote the exact digest you tested.
From commit to shipped artifact
Five steps, one forge. What you tested is what you ship.
- 01CommitPush to a private repo inside your client’s organization.
- 02CheckRequired checks and approvals guard the main branch.
- 03BuildYour workflow runs unchanged on a self-hosted runner.
- 04SignThe image gets a signature, an SBOM and provenance.
- 05PromoteThe same digest moves forward without a rebuild.
Private by default.
Give every client an organization of their own. Lock the main branch. Bring your repos across while the old forge stays in sync.
- One organization per client. Teams, secrets and runners stay scoped to each one.
- Branch protection with required approvals, required status checks and signed commits.
- Protected file patterns block pushes to the files you name.
- Migrate repos with issues, labels, milestones, pull requests, releases, wiki and LFS.
- Pull mirroring keeps both forges in sync until you cut over.
Actions-compatible CI.
Push your existing workflow files. parokhet runs them unchanged on self-hosted runners.
- Runners register at the organization, repo or user level.
- Secrets and variables live at the organization, repo or user level.
- Common actions such as checkout run from mirrors on the forge.
- Start any workflow by hand with a manual dispatch.
Every artifact signed.
Signatures, SBOMs and provenance on every image. The verification status sits right in the UI.
- Build once. Promote by digest. The bytes you tested are the bytes you ship.
- Provenance records how each image was built. The SBOM lists every dependency inside.
- Verify before you run. Every CLI binary ships with an SBOM and provenance.
Ship from the same place.
Container and package registries on object storage. Release channels and an updater feed for your apps.
- Containers, npm, PyPI, Maven, Cargo, Go, NuGet, Helm and 13 more package types.
- Link each package to the repo behind the package.
- Publish releases to a channel and serve updates from your own feed.
One identity.
One sign-on with passkeys and social login replaces a separate forge password.
- Sign in with Touch ID, Face ID, Windows Hello or a security key.
- Or use a social login you already trust.
- One account follows you from the browser to the CLI.
Your forge in the terminal.
Log in, clone, tail a deploy, promote a run and migrate a repo. One signed binary per OS.
- parokhet login signs you in from the terminal.
- Tail a deploy and watch the logs stream as the run moves.
- Promote a tested run by digest without leaving the terminal.
- Migrate a repo from your old forge.
21 package types in one registry
Publish containers and packages next to the code behind them. Link each package to its repo.
- container
- npm
- pypi
- maven
- cargo
- go
- nuget
- helm
- debian
- rpm
- alpine
- composer
- rubygems
- conan
- conda
- cran
- pub
- swift
- chef
- vagrant
- generic
Your code stays yours.
Your repositories belong to you. No third-party telemetry runs on the forge.
- Private by default.
- No third-party telemetry.
- Signatures, SBOMs and provenance on every image.
- Verification status shown in the UI.
- Sign-in by passkey or social login.
- Built on open-source Forgejo.
Built for teams who ship
- An agency gives every client a private organization.
- A team leaves GitHub without rewriting a single workflow.
- A release lead promotes the tested image by digest without a rebuild.
Work from the browser or the terminal
One signed binary per OS.- Web forgeRepos, pull requests, runs and packages in any browser.
- CLI for MacOne universal binary.
- CLI for LinuxA signed binary for amd64.
- CLI for WindowsA signed binary for amd64.
- REST APIFull API at /api/v1 with Swagger docs.
Bring your team in
Create an account with a passkey or a social login. Make an organization for each client. Invite your team and protect your main branch on day one.
- 01Sign in with a passkey.
- 02Create an organization for your first client.
- 03Migrate a repo with mirroring on.
- 04Push. Watch the workflow run unchanged.
Questions
Do my existing workflows run?
Yes. parokhet runs Actions-compatible workflows unchanged on self-hosted runners.
How do I move my repos in?
Migrate from GitHub, GitLab, Gitea, Gogs, OneDev or any git server. Bring issues, labels, milestones, pull requests, releases, the wiki and LFS. Pull mirroring keeps both sides in sync until you switch.
What does promote by digest mean?
You build an image once. Promotion moves the exact same digest forward. You ship the image you tested.
How do I verify a build?
Every image shows the signature, SBOM and provenance status in the UI.
Do I need a separate password?
No. Sign in with a passkey or a social login.
What is parokhet built on?
parokhet runs on the open-source git forge Forgejo 15. SiliconBlast adds the sign-in, the theme and the CLI.
Put your code behind the veil.
One identity. One forge. Every artifact signed.