

oh GitLab is terrible on several levels and is definitely best avoided — for some reason, they think that competing with github involves making all of github’s mistakes, but with a much worse UI
so far I’ve had good luck with codeberg. of your requirements, the only missing feature seems to be vulnerability scanning. CI is available and pretty good, but you have to ask for it to be enabled for your account. I think you’re able to hook self-hosted runners into codeberg’s CI frontend, but the process to do so confused the hell out of me, so you may have to dig a bit to figure out how it works.
“beware, for I am a leader in the Gartner® Magic Quadrant™” is exactly the kind of thing I’d expect an evil wizard to scream moments before I hit him in the head with a mace