If Alpine prides themselves on focusing so much on security, they probably shouldn’t use GitLab - the attack surface is too great and it’s never going to be easy to keep safe and up to date fully, unless you have FTEs whose main job is just maintaining it.
Just get the source code of Forgejo, audit it thoroughly and run an instance of that.
Just get the source code of Forgejo, audit it thoroughly and run an instance of that.