A big thing with Github its the unified functionality across most of the OSS world - that we can search across all projects, leverage pipeline actions from other projects, and easily have a single dashboard for our own contributions and interests across all projects.
I'd hate to see a move to forge balkanization lose this functionality. But this would not be heavyweight data to federate. So are there any forges with a good story for federation?
There was some work to address this issue with federation in Gitea, but I haven't kept up with how well that went. Our practical solution was to just mirror our Gitea repos into GitHub. That way they're discoverable, releases can be downloaded, and so on. Not a perfect solution because users get confused as to why they can't open issues, etc.
I was one of the members who was a part of the initial grant for federation in Gitea, but sadly due to illness and other similar neither I nor my teammate were able to work on the grant (so no funding ended up being released), however the work we did start was completed, and we have continued to work on foundations since. Since spam/moderation/limitations are so significant we are focused on that portion first, since we don't want to open up another vector for it without having at least the minimum of protections in place. We have also been extremely fortunate to have experienced developers who do work on existing federated software share so much of their time, expertise, and experiences with us to help shape our work.
That would be good for following, but I'd worry about contributions. Single-sign-on would help but if you're going to ask the user to create a new username+password to log a bug you're not going to get bugs from anybody except your most hardcore users.
Also, unified dashboards/notifications are so useful (even though Github's notification UI is a bit mediocre, imho).
Your first concern is not the reliability of GitHub (lost $$$) or any dark patterns they push, or their security, but the network effect?
Source repository should be its own thing.
Artifacts repository arguably should be its own thing.
PRs, own thing.
CI, own thing.
The Balkanization has always existed. Lot of stuff that isn't on GitHub.
That's the chief differentiator you're giving up when you give up on github vs a self-hosted forge. And the network effect of the CI pipelines should not be discounted since it means actions published anywhere on GH are automatically available for use without any import or install step.
Yes, you could feasibly split off the CI from the git+PR service, but you'd still want it to be federated.
Pipelines are not magic. You want a couple of primitives in there, variable substitution, maybe lite secret management. Depending on the type and languages you work across they could also be 100% unique to each company, language, project, and industry. LLMs have also further made pipeline creation pretty trivial.
If you can use or make a GitHub action you will be just fine in GitLab, CircleCI, Jenkins, or a couple of shell scripts hacked out over pizza and beer on a weekend.
There's no pipeline moat, to put it another way.