Scala Studios makes open-source, self-hosted tools for the teams that run infrastructure, and develops them in public. Halo decides who can sign in to which applications, and for how long. Shipyard takes a commit through pipelines, registries and releases to a running deployment. Both are written in Go and keep their state in PostgreSQL. More projects for infrastructure and operations are planned.
Self-hosted identity and access management. Halo is where an organization decides who can sign in to which applications, how they prove who they are, and how long their access lasts.
- Passkeys first. People sign in with passkeys or security keys. Authenticator apps, recovery codes and magic links are fallbacks you can turn off.
- Single sign-on. OpenID Connect, OAuth 2.0 and SAML 2.0 for your applications, and SCIM 2.0 provisioning in both directions.
- Policies you can test. Before a conditional access policy applies, report-only mode shows what it would have done to the last 24 hours of sign-ins.
- Access that ends. Time-limited access packages, access reviews, and joiner, mover and leaver rules are part of the core product.
- Small to run. A Go server, a Next.js interface and PostgreSQL. No Redis, no message queue and no license key.
curl -fsSL https://halo.scala.gg/install.sh | shHalo is pre-release, so the API and configuration may change before 1.0. A hosted version, Halo Cloud, is planned.
Repository · Documentation · Self-hosting guide · Changelog
One control plane for software delivery. Most teams glue the path from source to production together from four or five tools. Shipyard is one binary, one database and one UI that covers all of it.
- Pipelines and runners. YAML pipelines with a dependency graph and live logs, run by distributed runners with labels, heartbeats and leases.
- Artifacts, packages and images. Content-addressed artifacts on the filesystem or S3, npm and Maven repositories, and an OCI registry that works with
docker push. - Releases and deployments. Promote a release into an environment from the same UI that built it.
- Works with your forge. Import a whole organization through a token, OAuth or a GitHub App, and get webhooks, commit statuses and pull request comments.
git clone https://github.com/ScalaStudios/Shipyard.git && cd Shipyard
docker compose -f deploy/compose/compose.demo.yml up --build -dShipyard is alpha. It runs real pipelines against real forges, and the schema and HTTP API are still moving, so pin a commit if you deploy it.
Repository · Try the demo · Deployment guide · API and MCP
|
Self-hosted, all of it Every Halo feature is in its open-source repository, and self-hosting is meant to stay complete, with no paid tier for core features. Shipyard has no per-seat pricing and no SaaS dependency. |
Standards at the edges Halo speaks OpenID Connect, SAML 2.0, SCIM 2.0 and WebAuthn. Shipyard serves the OCI distribution API and npm and Maven repositories, so docker push works against it.
|
|
Secrets stay sealed Halo keeps session tokens, client secrets and API keys only as SHA-256 hashes and seals signing keys with AES-256-GCM. Shipyard encrypts forge credentials and webhook secrets at rest. |
Built to be automated Both publish an OpenAPI 3.1 description of their API. Halo issues API keys to service accounts, and Shipyard ships an MCP server that lets AI agents drive builds and runners. |
| Halo | Shipyard | |
|---|---|---|
| Server | Go | Go |
| Interface | Next.js, React, Tailwind CSS | React, Vite, CSS Modules |
| Data | PostgreSQL, optional S3-compatible storage | PostgreSQL, filesystem or S3-compatible storage |
| Runs on | Docker Compose and Caddy, images for amd64 and arm64 | Docker Compose with Caddy or nginx, BuildKit for images |
| Protocols | OpenID Connect, OAuth 2.0, SAML 2.0, SCIM 2.0, WebAuthn | OCI Distribution, npm, Maven, MCP |
| Tests | Go tests against PostgreSQL, Playwright end-to-end tests | Go tests, an API smoke test |
| CI | GitHub Actions | GitHub Actions |
Both projects take issues and pull requests. A typo or a bug with an obvious cause can go straight to a pull request; for anything larger, open an issue first so the approach is agreed before the code is written. Halo's code of conduct applies to everyone taking part in that project.
| Halo | Shipyard | |
|---|---|---|
| Bugs and ideas | Open an issue | Open an issue |
| Local setup | Contributing guide | Development |
| Before review | go vet, go test, type check and web build |
go test ./... and the UI build |
Warning
Report vulnerabilities privately, never in a public issue, pull request or discussion.
Halo takes reports through GitHub private vulnerability reporting, with a target of acknowledging each one within three working days; SECURITY.md lists the rest of the response targets. For Shipyard, report the problem privately to the maintainers and leave time for a fix before disclosure, as its security note asks. Every other repository follows the organization policy.
scala.gg · halo.scala.gg · Halo · Shipyard
