DEV.co
Open-Source DevOps · gabrie30

ghorg

ghorg is a command-line tool written in Go that bulk-clones or backs up repositories from GitHub, GitLab, Bitbucket, Gitea, and Sourcehut into a single local directory. It automates repository synchronization, making it useful for searching codebases, creating backups, and onboarding team members across multiple SCM providers.

Source: GitHub — github.com/gabrie30/ghorg
2.1k
GitHub stars
185
Forks
Go
Primary language
Apache-2.0
License (OSI-approved)

Key facts

Objective fields from the source. Values we can't verify are shown as “Unknown” rather than guessed.

FieldValue
Repositorygabrie30/ghorg
Ownergabrie30
Primary languageGo
LicenseApache-2.0 — OSI-approved
Stars2.1k
Forks185
Open issues11
Latest releasev1.11.12 (2026-06-27)
Last updated2026-07-04
Sourcehttps://github.com/gabrie30/ghorg

What ghorg is

ghorg uses API calls to enumerate repositories from SCM providers and performs batch git clone/pull operations into a unified directory structure. It supports configuration via YAML files and CLI flags, token-based authentication, filtering/selective cloning, and metrics tracking. Default behavior performs git pull and git clean on existing repos to maintain synchronization.

Quickstart

Get the ghorg source

Clone the repository and explore it locally.

terminalbash
git clone https://github.com/gabrie30/ghorg.gitcd ghorg# follow the project's README for install & configuration

Need it deployed, integrated, or customized instead? DEV.co ships production installs.

Best use cases

Bulk Repository Backup and Disaster Recovery

Clone all organization or user repositories on a schedule (via cron or HTTP server trigger) to create offline backups and audit trails of codebase state across multiple SCM platforms.

Cross-Organization Code Search and Auditing

Pull all repos into one directory to enable grep/ack/ripgrep searches across an entire organization's codebase, useful for security audits, compliance reviews, and technical due diligence.

Onboarding and Team Repository Synchronization

Automate cloning of all team repositories for new engineers and keep local mirrors in sync via cron jobs, reducing manual setup and ensuring developers have current copies of all relevant codebases.

Implementation considerations

  • API token must be created with appropriate scopes per SCM provider (repo scopes for GitHub, read_api for GitLab, etc.) and stored securely; SAML SSO orgs require extra token authorization.
  • Default configuration will overwrite local changes via git clean on re-runs; teams must use --no-clean flag or separate directories if they plan to work in the cloned area.
  • Disk space and network bandwidth scale with repository count and size; consider filtering by repo pattern or topic to reduce scope for large organizations.
  • Configuration precedence: CLI flags override YAML config, which defaults to $HOME/.config/ghorg/conf.yaml; XDG_CONFIG_HOME is respected for non-standard paths.
  • Self-hosted GitHub/GitLab/Gitea instances require --base-url flag; test connectivity and token validity before scheduling automated runs.

When to avoid it — and what to weigh

  • Real-time Repository Mirroring Required — ghorg is pull-based and relies on scheduled execution; it is not designed for continuous real-time mirroring of repository changes as they happen.
  • Managing Very Large Monorepos or Massive Organizations — While ghorg can handle scale, cloning hundreds of large repositories into a single directory can consume significant disk space and network bandwidth; consider git mirrors or federation strategies for extreme scale.
  • Write-Heavy Collaborative Workflows in Clone Directory — ghorg applies git clean and pull by default, overwriting local changes; unsuitable if teams intend to develop directly in the cloned directory without explicit --no-clean flag management.
  • Complex Authentication or Private Networking — Token-based auth works well for standard setups, but complex SAML SSO, OAuth flows, or air-gapped networks may require careful configuration and are not explicitly detailed in provided docs.

License & commercial use

Licensed under Apache License 2.0 (SPDX: Apache-2.0), a permissive OSI-approved license that permits commercial use, modification, and distribution with minimal restrictions. See https://opensource.org/licenses/Apache-2.0 for full terms.

Apache 2.0 is a permissive OSI license that explicitly permits commercial use without royalty or special agreement. No proprietary restrictions apply. However, users should review the license directly to confirm their specific use case aligns with attribution and liability disclaimers.

DEV.co evaluation signals

Editorial assessment — not user reviews. Directional, with an explicit confidence level.

SignalAssessment
MaintenanceActive
DocumentationAdequate
License clarityClear
Deployment complexityLow
DEV.co fitStrong
Assessment confidenceHigh
Security considerations

Token-based authentication (API tokens or GitHub App private keys) is required and must be stored securely; guidance on secure storage mechanisms is not detailed in the provided excerpt. Users handling multiple tokens for different SCM providers should employ secrets management. The tool performs git operations over HTTPS/SSH; ensure underlying git configuration on the system is secure. Disk-based credential storage (conf.yaml) should be protected with appropriate file permissions. No security audit details, CVE history, or formal security policy are provided in the data.

Alternatives to consider

Gitea / Forgejo Repository Mirroring

Self-hosted git forge with built-in repository mirroring and synchronization; better for continuous real-time mirroring but requires running a Forgejo/Gitea instance.

git-repo / repo (Android/Google)

Multi-repository tool designed for large monorepo workspaces; more sophisticated dependency and manifest management but steeper learning curve and primarily Android-ecosystem focused.

Custom Bash/Python Scripts + git clone loops

Direct API calls and git commands offer full control and flexibility; suitable for one-off or highly specialized workflows, but requires in-house maintenance and error handling.

Software development agency

Build on ghorg with DEV.co software developers

ghorg is a lightweight, active CLI tool for DevOps teams and auditors. Install via Homebrew or prebuilt binary, configure your SCM token, and start syncing today.

Talk to DEV.co

Related open-source tools

Surfaced by semantic similarity across the DEV.co open-source index.

Related on DEV.co

Explore the category and the services that help you build with it.

ghorg FAQ

Will ghorg overwrite my local work if I edit files in the cloned directory?
Yes, by default ghorg performs git pull and git clean on re-runs, overwriting local changes. Use the --no-clean flag to preserve local edits, but manage this carefully to avoid losing work.
Does ghorg support GitHub Enterprise or self-hosted GitLab?
Yes. Use the --base-url flag for GitHub Enterprise, and update GHORG_SCM_TYPE to gitlab and provide your GitLab instance URL for self-hosted GitLab. Gitea and Sourcehut (self-hosted only) are also supported.
How do I schedule ghorg to run automatically?
Use cron (Linux/macOS) or Task Scheduler (Windows) to invoke ghorg on a schedule, or use ghorg's HTTP server mode to trigger clones via webhooks or external orchestration.
What SCM providers does ghorg support?
GitHub (cloud and self-hosted), GitLab (cloud and self-hosted), Bitbucket (cloud and self-hosted server), Gitea (self-hosted), and Sourcehut (limited features).

Custom software development services

DEV.co is a software development agency delivering custom software development services to companies building on open source. Our software developers and web developers design, integrate, and ship production systems — spanning web development, APIs, AI, data, and cloud. If ghorg is part of your open-source devops roadmap, our team can implement, customize, migrate, and maintain it.

Ready to bulk-clone your organization's repositories?

ghorg is a lightweight, active CLI tool for DevOps teams and auditors. Install via Homebrew or prebuilt binary, configure your SCM token, and start syncing today.