July 2019 Summaries

The UX department at GitLab is focused on creating intuitive navigation structures that align with user needs and workflows, acknowledging the challenges of accommodating diverse user preferences. Over the years, GitLab has undergone various iterations of navigation redesigns, aiming to balance global and contextual navigation elements. Despite improvements, users have expressed ongoing confusion with certain aspects, particularly the left sidebar, due to GitLab's rapid growth and the expanding range of features. The UX team has identified context and discoverability as key themes for future navigation improvements, seeking to maintain user orientation and promote feature discovery without overwhelming users. Upcoming research initiatives will engage stakeholders and users to explore how navigation can better align with GitLab's diverse use cases, striving to address usability issues and optimize user journeys.

Docker's release of version 19.03 introduces automatic TLS certificate generation for Docker in Docker (dind) workflows, impacting GitLab CI/CD processes by requiring TLS certificates for communication. This change, enabled by default from version 19.03, addresses potential security issues but necessitates configuration adjustments, such as mounting certificates in shared volumes under the [runners.docker] section in GitLab Runner configurations. Users can either configure GitLab Runner to use TLS by sharing the certificate directory between the service and job container or disable TLS by setting the DOCKER_TLS_CERTDIR environment variable to an empty value. GitLab.com Shared Runners already accommodate these configurations, ensuring compatibility with both workflows to prevent job failures due to unexpected updates.

All-remote workplaces like GitLab and InVision are redefining traditional office dynamics by eliminating physical locations and fostering a work culture that relies heavily on digital communication tools such as Zoom and Slack. These companies emphasize the importance of interpersonal skills like active listening and collaboration, which are essential for bridging the digital divide in remote settings. Leaders in all-remote organizations must be intentional in engaging with their teams, as they lack the serendipity of in-person interactions. The movement towards remote work is still in its early stages, propelled by advancements in communication technology and a shift in focus from physical presence to individual output and results. While some co-located companies are experimenting with remote work flexibility, there is skepticism about the effectiveness of hybrid models due to inherent cultural disparities. GitLab and InVision prioritize core values like collaboration, diversity, and transparency over the mere concept of being all-remote, seeing it as a means to practice these values rather than an end in itself.

GitLab's redesign of the project overview page aimed to improve readability and user experience by simplifying the display of project status and activity while addressing concerns about the clone button's placement. Initially, the clone button was moved to the header to enhance visibility, but feedback suggested its relocation to the file tree control area for better discoverability, especially since its absence from the repository page drew criticism. To resolve this, a usability test was conducted, revealing that placing the button within the file tree controls improved user success rates and reduced time to locate it. This successful adjustment prompted consideration of similar changes for empty repositories, where the absence of the clone button significantly impacted user experience. Subsequent testing confirmed the need to integrate a clone button into the instructions section, ultimately enhancing functionality and aligning with user expectations. The change is being implemented with community support, signaling GitLab's commitment to optimizing user interaction.

GitLab can be a powerful tool for managing workflows beyond development projects, as demonstrated by a practical example using the HIPAA Audit Protocol. The protocol, typically managed in spreadsheets, faces challenges such as limited collaboration, lack of comprehensive change history, and difficulty managing due dates and assignments. To address these, a Python script was created using the python-gitlab API wrapper to transform each audit inquiry into an issue within GitLab, showcasing the platform's project management capabilities like file uploads, change logging, and milestone tracking. The script reads data from a CSV file and uses it to generate issues with detailed descriptions and labels, illustrating how workflows can be seamlessly migrated to GitLab. This approach not only simplifies the process but also allows for customization and adaptation for various other workflows, such as risk assessments and event planning, by using CSV files and modifying API calls. The ease and flexibility of this method highlight GitLab's potential for organizing and executing non-developer workflows effectively.

The narrative explores the complexities of balancing work and parenting, particularly within the context of societal expectations in the Czech Republic versus more flexible arrangements in other countries, such as Switzerland. The author discusses the societal pressure for women to prioritize childcare over careers, often for several years, and contrasts this with her personal experience of returning to work shortly after childbirth while working remotely for GitLab. She highlights the benefits of a flexible work schedule, which allowed her to balance professional responsibilities with parenting, and notes the support she received from family and her employer. The story underscores the evolving perceptions of parenting roles among younger, more educated individuals and the potential for remote work to provide a fulfilling balance between career and family life, despite traditional societal norms. The author reflects on how these choices have been met with both support and skepticism but ultimately feels content with her decision to maintain her career alongside parenting.

GitLab's Support team has developed a set of tools to enhance performance monitoring and troubleshooting for self-managed customers, focusing on data-driven decision-making. These tools include the Strace Parser, JSON Stats, and GitLab SOS, each designed to aggregate and summarize performance data efficiently. The Strace Parser helps users quickly identify critical sections in extensive trace outputs, while JSON Stats provides performance statistics from logs, enabling the team to ground their findings in evidence. GitLab SOS offers a snapshot of system activities, aiding asynchronous troubleshooting. Together, these tools facilitate faster problem identification and resolution, improving customer relationships and underscoring GitLab's commitment to performance as a core feature.

Continuous integration (CI) in software development involves automating the building and testing of code before it is merged into the main branch, reducing the risk of bugs. Moving beyond CI to continuous delivery and deployment (CD) involves deploying code and testing it in a live environment, ensuring compatibility with other components, especially in microservices architectures where different teams manage separate repositories. GitLab CI/CD facilitates this process with a configuration file, .gitlab-ci.yml, which defines pipelines and jobs, allowing developers to independently edit and manage their pipeline configurations. The platform supports triggering cross-project pipelines, enabling the integration and testing of interdependent microservices through a bridge job syntax introduced in GitLab 11.8. This mechanism allows for the specification of downstream project paths, branch names, and the passing of variables to downstream pipelines, enhancing flexibility and integration across projects. GitLab also provides pipeline graphs to visualize and navigate through complex pipeline structures, helping users understand the flow and status of both upstream and downstream processes.

Continuous integration and build processes can be complex and time-consuming, prompting companies like Alteryx, ANWB, and EAB to transition from Jenkins to GitLab for improved efficiency and system management. Alteryx, an analytics platform, reduced their build times from three hours to 30 minutes by adopting GitLab, which streamlined their software development lifecycle by consolidating source code management, CI/CD, code reviews, and security scanning. ANWB, serving over 4.4 million members in the Netherlands, enhanced its deployment frequency and team autonomy by moving away from an outdated Jenkins toolchain to GitLab, setting the stage for a future cloud-centric approach. EAB, supporting over 1,500 educational institutions, aimed to simplify its integration processes and foster a "quality first" culture by leveraging GitLab's regular feature releases and affordable pricing, which allowed them to maintain a consistent pace of build releases with reduced complexity.

Andrew Newdigate from GitLab explores how Prometheus's query language can be utilized for anomaly detection in time series data, highlighting its importance for diagnosing incidents, detecting performance regressions, resolving abuse, and enhancing security. By using the http_requests_total metric, he demonstrates the significance of choosing the correct level of data aggregation to effectively identify anomalies without missing genuine issues or generating false positives. Anomaly detection is achieved through z-scores, assuming a normal distribution, or by leveraging seasonal patterns in the data for more precise predictions. The blog post provides detailed methods, including statistical techniques and queries, to set up anomaly detection and alerting systems using Prometheus. Andrew emphasizes the importance of testing data for normal distribution and discusses how seasonal metrics can enhance anomaly detection accuracy, allowing GitLab to respond more effectively to irregularities in their systems.

GitLab's public bug bounty program, launched in December 2018, has significantly contributed to enhancing their security by engaging a broader community of reporters, with 42% of initial participants being first-time contributors. The program has doubled the number of valid reports since its public introduction, identifying 205 valid vulnerabilities by July 3rd, including 10 critical ones, although it has also seen an increase in false positives. GitLab has refined its triage and response processes, implementing automation to improve communication and response times, while also adjusting how fixes are scheduled and reported. Transparency is a core value, and GitLab publicly discloses its findings, using them to inform developer training and enhance security practices. The program has helped identify recurring vulnerability patterns, prompting GitLab to focus on secure coding training and the use of security-focused libraries to prevent future issues.

With GitLab 12.2's release on August 22, Python 3 will become the default version for the Secure stage License Compliance feature, with GitLab.com users experiencing this change at the start of August. Users still relying on Python 2 will need to set the CI variable LM_PYTHON_VERSION to "2" on both GitLab self-managed and GitLab.com platforms to maintain compatibility. The shift in default Python versions aligns with the deprecation of Python 2 due to its official support ending on January 1, 2020. Users already utilizing Python 3 can configure License Compliance to accommodate this version by setting the CI variable LM_PYTHON_VERSION to "3" immediately. License Compliance, previously known as License Management, is being renamed to reflect common industry terminology, and its function is to monitor the licenses of third-party components within projects, ensuring they align with organizational licensing models.

This blog post is the first in a series exploring the challenges of working remotely with children, focusing on parental leave policies worldwide and personal experiences at GitLab. The author examines the generous parental leave policy at GitLab and contrasts it with varying policies across different countries, highlighting significant differences in leave durations and entitlements. In the Czech Republic, employers must keep a job open for three years, a practice mirrored in Germany, while in Switzerland, women typically have 14 weeks of maternity leave. The UK allows up to 52 weeks, and Sweden offers 480 days that can be split between parents, with Scandinavian countries showing higher rates of paternal leave. By contrast, the US lacks a federal mandate for paid leave, offering 12 weeks of unpaid leave under the Family and Medical Leave Act, with some states and companies providing more generous options. The post suggests further resources for more insights and previews the next installment, which will delve into personal experiences and advice for parents working remotely.

Katrin Leinweber, a resident of Hanover, Germany, shares her experiences and motivations for contributing to GitLab, highlighting her involvement in localization efforts to make the platform more accessible to non-programmers. She began using GitLab in 2015 as a backup for her academic work and made her first contribution by fixing a typo in a blog post. Katrin expresses the importance of open-source contributions, emphasizing the ease of contributing to GitLab but also pointing out inefficiencies in the CI pipeline process for non-code changes. She advocates for more environmentally friendly practices, such as supporting renewable energy and using the [skip ci] feature to conserve resources. Besides GitLab, Katrin participates in other open-source projects like The Carpentries, appreciating the community's commitment to sharing knowledge. In her free time, she enjoys outdoor activities such as gardening, cycling, hiking, and canoeing, and invites others to engage with the GitLab community by contributing in various ways.

GitLab CEO Sid Sijbrandij and team members Todd Barr and Melissa Smolensky engage in a discussion about the term "concurrent DevOps," a concept GitLab favors over traditional DevOps methodologies. Unlike "sequential DevOps," concurrent DevOps allows for parallel work without waiting for handoffs, thereby accelerating processes and potentially serving as a broader industry rallying cry. Despite some skepticism from Todd, who views it as a benefit statement rather than a category, the idea of concurrent DevOps aligns with GitLab's mission of inclusivity and "everyone can contribute." Sid acknowledges that while GitLab has larger visions for its platform, the immediate focus remains on solidifying its position within the existing DevOps market, which is anticipated to grow significantly. The discussion reflects GitLab's strategy of promoting a single application for the entire DevOps lifecycle while recognizing the need for a people-centric approach to integrating DevOps into enterprise development cycles.

Managing a complex software and partnership ecosystem is essential for modern businesses, but it poses significant security challenges, especially with third-party applications that can introduce vulnerabilities, as seen in breaches involving companies like Best Buy and Delta. The use of third-party software offers time and resource efficiencies and the ability to quickly implement new capabilities, but it also increases the risk of data breaches, particularly if security standards and compliance requirements are not met. Developers must share the responsibility for risk management by ensuring third-party code is secure and thoroughly tested, as open-source code can often contain overlooked vulnerabilities. Businesses need to take proactive measures such as maintaining an inventory of third-party relationships, establishing formal security requirements, fostering a company-wide security mindset, and implementing data encryption to safeguard sensitive information and mitigate the impact of potential breaches.

GitLab has been working diligently to integrate Elasticsearch on GitLab.com to unlock Advanced Global Search and Advanced Syntax Search features, encountering and addressing several challenges along the way. Initially faced with a "chicken and egg" problem due to the need for more information without an active deployment, the team decided to prioritize changes to enable selective Elasticsearch indexing, starting with the gitlab-org group. This move allowed them to gather necessary data, though it revealed several bugs and scalability issues, which were addressed in subsequent releases. Enhancements made include per-project and per-group controls, automated backfill tasks, and administrative improvements like configurable index parameters. Despite these advancements, challenges remain, such as improving the administration experience, managing the Elasticsearch schema, and reducing index size. The responsibility for the Elasticsearch integration has shifted to the Editor group of the Create stage, and ongoing efforts are aimed at expanding its rollout and enhancing search result quality across GitLab.com.

GitLab Commit is a series of conferences that bring together the GitLab community to share insights, innovations, and inspirations in software development, with the next event scheduled for January 14, 2020, in San Francisco. The conference invites participants to submit talk proposals by October 21, focusing on demonstrating the power of DevOps through real-world results and practical advice. Attendees can expect to explore topics such as cloud-native technologies, DevOps transformations, and live coding demonstrations, with session formats ranging from lectures and panels to lightning talks and 'birds of a feather' discussions. The event emphasizes GitLab's commitment to collaboration and results, encouraging speakers to showcase their achievements in improving software development processes, such as cycle time reductions and enhanced operational efficiencies.

The 2019 Global Developer Report: DevSecOps by GitLab, based on a survey of 4,071 software professionals, highlights the significance and challenges of integrating development, security, and operations teams. The survey revealed that while mature DevOps models can lead to improved security, innovation, and efficiency, many organizations face hurdles, particularly in aligning developers and security professionals to prioritize vulnerability remediation. Only a third of respondents rated their DevOps efforts as good, indicating room for improvement. The findings also suggest that remote work enhances collaboration and transparency, with remote teams reporting better insight and security practices. Despite the benefits of mature DevOps models, early adopters still encounter barriers to achieving effective DevSecOps, emphasizing the need for a unified solution that bridges the gap between development and security processes.

CI/CD pipelines are essential components of DevOps, automating the software development lifecycle by facilitating continuous integration, delivery, and deployment. These pipelines consist of jobs, stages, and runners, and are configured using version-controlled YAML files, allowing teams to manage code changes efficiently and reduce human error. "Pipeline as code" is a best practice within the industry, enabling teams to store CI pipelines alongside application code in a centralized repository, fostering collaboration and version control. GitLab offers a solution for pipeline management, including templates and Auto DevOps, which provide pre-built, flexible CI/CD pipelines that streamline the delivery process and improve code quality. This approach allows teams to manage complex multi-project pipelines, adapt to new CI tools when needed, and benefit from greater visibility and collaboration in the software development process.

Participating in the GitLab CEO shadow program offered a transformative experience, challenging preconceived notions of a CEO as solely work-focused and intimidating by providing a transparent and inclusive view into the company's operations. The program, which took place in GitLab's "Mission Control," an innovative hybrid of a boardroom and living space, primarily utilized video conferencing due to GitLab's all-remote work model, allowing seamless participation in meetings across the globe. Interactions with CEO Sid Sijbrandij showcased his welcoming approach and commitment to transparency, fostering an environment where participants felt included and valued. Observing high-level meetings with executives and investors provided insights into GitLab's strategic direction and the positive reception from major investment firms, enhancing confidence in the company's future. The program underscored the importance of adaptability and openness to new ideas in leadership, as demonstrated by Sid's philosophy of "strong opinions weakly held," and offered a glimpse into the company's collaborative culture. While the experience was limited to two weeks, it provided invaluable lessons and inspiration for future leadership roles, highlighting the importance of continuous learning and the potential for personal growth within a supportive and dynamic corporate environment.

GitLab's UX research team faced challenges with traditional research reports, which were hard to search, siloed, and quickly outdated, prompting a shift towards using the UXR Insights repository as a more dynamic, accessible solution. Originally, UX research insights were documented in reports, but this method proved inefficient due to difficulties in locating specific insights and the rapid pace of product development at GitLab. By transitioning to a system using GitLab's improved issue functionality, insights are now documented directly within issues, allowing better organization and searchability through labels and epics. This approach facilitates real-time updates and integration with product managers' workflows, enabling more actionable insights. Despite the challenges in transferring existing data and training team members in the new system, the transition to the UXR Insights repository has been positively received, reducing the reliance on traditional reports and encouraging a more collaborative and iterative research process.

GitLab's adaptation of the Adobe open-source compliance framework into the GitLab Control Framework (GCF) aims to streamline compliance processes by tailoring controls to meet GitLab's specific needs while maintaining alignment with industry standards. The initial step involved converting Adobe's CCF controls from PDF to CSV for easier modification, ensuring these changes did not disrupt foundational mappings to underlying requirements such as PCI DSS. GitLab prioritized SOC2 certification, focusing initially on 63 controls that aligned with SOC2's Common Criteria, and developed detailed documentation and guidance for each. The process included assigning responsibility within GitLab for each control and conducting a gap analysis to assess current compliance status. To assist smaller companies and GitLab customers in adopting this framework, GitLab has made available a public repository containing the adapted controls and is developing additional tools, such as scripts for turning compliance controls into GitLab project issues and a CSV-to-JSON converter. GitLab encourages feedback to further improve these resources and support broader industry compliance efforts.

GitLab employees share a variety of tips for effective remote work, emphasizing the importance of setting boundaries, maintaining routines, and creating a conducive work environment. Flexibility in defining the end of the workday is key, as some find external cues like a partner returning home helpful, while others prefer a structured routine to delineate work hours. Emulating a commute by taking a walk or drive can mentally prepare individuals for the workday, while dressing appropriately, even if casually, helps foster a professional mindset. The presence of a closed door can signal undisturbed work time, and the absence of snacks at home helps minimize distractions. Overall, establishing a dedicated workspace and avoiding lunch at the desk are recommended practices for better productivity and work-life balance.

Gitaly, GitLab's service that interfaces with Git data, was developed to remove the dependency on NFS, a task completed in the summer of 2018, to improve data availability and correctness. Although performance wasn't the initial focus, rewriting most RPCs in Go inadvertently enhanced it. However, performance issues, particularly for large GitLab instances using NFS, were observed, prompting the addition of feature flags to improve performance by reverting to Rugged implementations. A significant challenge was the detection of N + 1 query patterns, such as in the pipeline index view, which led to the development of the ListCommitsByOid RPC and the implementation of a 'cat-file' cache in GitLab 12.1 to enhance performance by caching repositories per Rails session. The Gitaly team prioritized automatically enabling Rugged for GitLab servers using NFS to mitigate performance regressions, with plans to eliminate the need for NFS by achieving high availability for Gitaly, thus enhancing both performance and availability.

Open source business models have evolved significantly, as illustrated by companies like GitLab and Red Hat, transitioning from a rare approach to a popular strategy among startups. GitLab CEO Sid Sijbrandij discusses with OSS Capital founder Joseph "JJ" Jacks the complexities of open source models, emphasizing the balance between open source and proprietary code in the "open core" model and the role of community feedback in shaping releases. Licensing has become a spectrum, with new non-compete licenses introduced by companies like Redis and MongoDB, alongside traditional freemium and proprietary models. Sid highlights transparency as a core value, crucial for maintaining trust and facilitating open communication with the community, which has been instrumental in GitLab's ability to compete with proprietary vendors. He advocates for early adoption of transparency in open core startups despite its challenges, particularly in areas like security, as it requires consistent effort to implement effectively across all company layers.

Group conversations at GitLab have become more accessible through a new podcast format, complementing the existing livestreams and videos available on GitLab Unfiltered. Inspired by the Support team's podcast adaptation of their meetings, GitLab now offers an audio feed of these discussions, allowing listeners to tune in via their preferred podcast player. The process involves a GitLab CI pipeline that automates the conversion of video meetings to audio, generates an RSS feed, and uploads the files to object storage, all hosted on a static site through GitLab Pages. This innovation not only provides insights into team collaborations and future GitLab features but also showcases how GitLab CI can streamline and automate workflows.

Maintaining a visually appealing user interface in an open-source product like GitLab is challenging due to its rapid feature development and low contribution barriers, leading to minor UI bugs slipping through. To address these issues, GitLab is focusing on tactical UI fixes, updating its visual design strategy, and developing a cohesive design system called Pajamas to enhance both aesthetics and usability without compromising speed. Recent efforts include refining threaded discussions, improving the visibility of the "Changes" tab in merge requests, and aligning icons for better page scanning, all of which have been positively received by the community. With the addition of senior product designer Jeremy Elder, GitLab aims to further refine its visual design, ensuring that its DevOps tool remains both functional and visually pleasing.

Infrastructure-as-code tools like TerraForm/OpenTofu and configuration management tools like Ansible are integral to mission-critical workflows, but often lack the rigorous development practices applied to business software. Many such automations are crafted by system or infrastructure engineers who may not be versed in DevOps or CI/CD, especially in large organizations with siloed teams. GitLab has leveraged its unified DevSecOps platform for over a decade to support enterprise-scale automation workloads, and this article details a DevOps workflow utilizing OpenTofu and Ansible, all orchestrated via GitLab CI/CD. The project demonstrates provisioning an AWS lab environment with OpenTofu, deploying a Tomcat web server using Ansible, and integrating security and code quality checks within GitLab's platform. It showcases the capabilities of GitLab's Terraform State management, security scanning, and container registry to ensure scalable, auditable software delivery pipelines. The process automates infrastructure provisioning, application deployment, and security testing, highlighting GitLab's role in creating a governed and scalable automation platform.