January 2020 Summaries

Merge trains offer a structured approach to managing code merges in high-volume development environments, ensuring that the master branch remains stable for continuous delivery. This system sequentially processes merge requests, incorporating changes in a staged manner that assumes successful pipeline completion, reducing downtime from queuing and retries. Merge trains mitigate conflicts by allowing each request to start with the previous merge ref's state and run pipelines in parallel, canceling and requeuing failed requests automatically. Initially released in GitLab 12.0, merge trains have undergone improvements based on internal feedback, such as enhancing concurrency and adding warnings for immediate merges. Future enhancements include supporting fast-forward merges and API integration to automate workflows further. The feature aims to streamline development processes while maintaining flexibility for urgent changes, and ongoing feedback is encouraged to refine its functionality.

In this guide, the author discusses techniques for compressing PNG screenshots on macOS to achieve smaller file sizes without compromising quality, which is particularly useful for sharing images online. The process involves using lossy compression through color quantization with the pngquant tool to reduce the color palette of PNG-32 images to PNG-8, significantly decreasing file sizes while maintaining acceptable image quality, especially for screenshots of simple subjects like buttons and forms. Additionally, lossless compression is enhanced using Google's zopfli library, which provides modest file size reductions. The guide further explains how to automate this compression process using tools like Hazel or Automator by setting up rules to trigger compression whenever a new screenshot is added to a specific directory, such as a dedicated Screenshots folder. The author emphasizes the efficiency of this automated method in achieving up to 80% reduction in file size, making it a valuable approach for frequent users who need to manage and share screenshots effectively.

GitLab's "Insights" is a feature designed to help visualize trends in workflows, bugs, and merge request throughput by leveraging the labeling system within GitLab. Initially created by the Engineering Productivity team to monitor issue trends, the tool evolved to address broader needs and now offers flexible configurations for both group and project levels. The feature is particularly useful for identifying patterns and bottlenecks, enabling corrective actions by tracking merge requests and issue activities through customizable dashboards. Insights is powered by labels and a YAML configuration file, which allows users to create tailored dashboards that align with their workflows, whether manually or through automation. GitLab has been using Insights internally, allowing teams like Support and Quality Engineering to track performance metrics, such as bugs missing service-level objectives (SLOs) and flaky tests, which provides valuable insights for improving overall productivity. The tool is designed to be adaptable, accommodating various labeling practices, and encourages feedback for continuous improvement.

Business students at Hankuk University of Foreign Studies in Seoul are studying GitLab's extensive handbook and business model to gain insights into company transparency, communication, and the intricacies of remote work. Led by lecturer SanJoon Song, the class divided the lengthy 3,000+ page handbook into categories for in-depth exploration, allowing students to present their findings on various aspects, such as compensation, incentives, and remote work, which remains uncommon in Korea. The handbook's level of transparency and detailed protocols, especially regarding mistakes and company values, surprised both Song and his students, highlighting a novel approach to corporate communication and goal-setting. This study emphasizes the importance of clear, effective communication between employees and management, a key takeaway for students aspiring to become entrepreneurs. Song is also teaching a second class focusing on project management and DevOps, further inspiring students by examining GitLab's practices and their applicability to startup success.

GitLab achieved an A+ rating in the Comparably employee survey, earning accolades for Best Company for Diversity, Best Company for Culture, and Best Company for Women in 2019, reflecting its commitment to diversity, inclusion, and belonging (DIB). Despite this recognition, GitLab acknowledges the need for further progress in hiring, retaining, and promoting diverse talent, especially in leadership roles. The survey, conducted anonymously, highlighted positive feedback from employees of all genders, particularly regarding the company’s all-remote work culture and leadership. GitLab's workforce comprises about 29% women, with 23% in leadership roles, and aims to increase these numbers by implementing new policies and training initiatives, including unconscious bias training and employee resource groups. The company believes that enhancing gender parity will not only fulfill ethical obligations but also improve business outcomes, as studies suggest that organizations with 30% or more women in leadership roles experience a 15% increase in revenue.

At KubeCon NA 2019, software engineers Sean Holung and a colleague presented on the importance of ephemeral environments for acceptance testing, emphasizing their role in preventing production failures and maintaining agility in software deployment. Ephemeral environments, which mimic production settings but focus on first-level dependencies, enable rapid iteration and automated testing, reducing reliance on manual checks. Their demonstration included a Go-based demo application that handles message storage and notifications, showcasing the integration of Pulumi and GitLab to construct pipelines that validate application, infrastructure, and deployment processes. They used Kubernetes to manage containerized applications, ensuring configurations align with Google Cloud Platform resources. Acceptance tests executed within these environments serve as quality gates, detecting issues pre-production and illustrating the setup's efficiency. The discussion highlighted the necessity of automated testing in evolving system architectures to ensure long-term reliability, with their pipeline leveraging GitLab and Kaniko for building and deploying Docker images, thereby embedding quality into the development process from the outset.

Next generation software development has revolutionized coding practices, enabling rapid and scalable code production, but this advancement introduces significant security challenges that cannot be addressed by treating security as an afterthought. Security must evolve alongside development processes, as cyber threats continue to advance beyond outdated methods. To address these challenges, Chief Information Security Officers (CISOs) need to understand key shifts in how software is composed, delivered, and complies with regulations, integrating security as a fundamental outcome of DevSecOps efforts. As highlighted in a recent book, this approach necessitates understanding new attack surfaces, adapting security strategies, and uniting iterative development with security workflows. Success in this environment relies on maintaining basic security hygiene, implementing automated monitoring, and fostering continuous improvement through standardization and policy automation. The book concludes with actionable steps for developing a next-generation security program, emphasizing the importance of risk-aligned metrics, broad software testing, and the application of Zero Trust principles.

Goldman Sachs, traditionally known as a global investment banking giant, has expanded its capabilities by partnering with GitLab to modernize its development processes and overall company operations. George Grant, head of the US SDLC engineering team, explained during GitLab Commit Brooklyn 2019 how this collaboration has enabled the firm to adopt a more agile approach, essential for developing applications like those running on iPhones. By integrating GitLab, Goldman Sachs aims to streamline its software development lifecycle (SDLC), moving away from a tightly coupled, legacy system to a more flexible, cloud-based Git solution. This change has led to a significant increase in efficiency, allowing for faster release cycles and enhancing the firm's DevOps and QA metrics. The partnership has not only improved operational transparency but also positioned Goldman Sachs as an investor in GitLab, reflecting the tool's strategic importance in the company's future development roadmap.

GitLab experienced significant growth within its community in 2019, marked by a substantial increase in merged merge requests (MRs) and contributors, culminating in a record number of MRs for the 12.6 release. The number of contributors nearly doubled from the previous year, reaching almost 900, and the regular contributors with five or more merged MRs also saw a notable rise. This growth reflects GitLab's thriving open-source community, with an emphasis on both code contributions and community insights. Looking ahead, GitLab will participate in FOSDEM on February 1st and 2nd, where they will host a stand, a meetup session, and talks by team members, while also planning a Happy Hour event to engage with community members during the conference.

The process of upgrading bootstrap-vue in GitLab's UI from version 2.0.0-rc.27 to the latest stable version encountered several challenges due to backward compatibility issues throughout GitLab's codebase. GitLab CI proved instrumental in managing these changes, allowing the team to use innovative strategies like creating downloadable package artifacts to test development builds without releasing them publicly. This approach facilitated collaboration across the company and leveraged GitLab's extensive CI pipeline to identify and fix issues iteratively. Key challenges included adapting to new import statements and syntax changes, such as those affecting BTable and BTabs components, and managing the significant refactoring of tooltip and popover components. The team faced issues like the tooltip directive's requirement to be attached to the DOM document, which led to failures in existing test suites. They addressed these by migrating tests from Karma to Jest, rewriting them with vue-test-utils, and using Jest's manual mock feature to decouple tests from the tooltip's implementation. The upgrade highlighted the impact of technical debt on dependency updates, emphasizing the need for modern testing practices and clear distinctions between unit and integration tests.

GitLab has adopted an iterative approach to enhance its error tracking feature, aiming to allow developers to identify and resolve errors before they impact users. Sid Sijbrandij, CEO and co-founder of GitLab, emphasizes the importance of iteration, highlighting that small, incremental changes can lead to faster development and improved functionality. The Monitor:Health team has integrated error tracking with Sentry, focusing on a minimal viable change strategy to incrementally improve the product by breaking down tasks into manageable steps. This method has involved both frontend and backend iterations, with the aim of creating a "Create an Issue" button to streamline error resolution within GitLab. The process has demonstrated the power of iterative development, as it has increased the rate of merge requests and empowered team members to actively participate in product development. However, GitLab acknowledges that an iterative approach requires disciplined communication to prevent information from becoming too dispersed. Despite being a work-in-progress, this strategy is recognized for its potential to enhance both engineering and product development processes.

GitLab APIs and Continuous Integration serve as powerful tools for managing bulk tasks, particularly in testing projects across multiple repositories under a single group. In a practical scenario involving Company XYZ, the need arose to evaluate project builds using new hardware to reduce execution costs, with automatic issue creation upon build failures. Leveraging GitLab CI and APIs, the process enables automatic issue generation through the Issues API, executed whenever a job fails, and employs private tokens for authentication. Subsequently, all created issues are aggregated using the Group Issues API, forming a JSON object that is stored as a pipeline artifact. This data is then transformed into a markdown report and published on a project's Wiki, offering a comprehensive overview of build failures. This automated workflow facilitates efficient testing and reporting across numerous projects, ensuring compatibility with new CPU architectures.

GitLab has joined the OWASP Foundation, a non-profit focused on enhancing software security through open-source projects, local chapters, and educational initiatives. By integrating OWASP tools and resources, GitLab aims to enhance security features within its development lifecycle and protect applications and infrastructure from security threats. GitLab particularly values initiatives like the OWASP Top 10, WebGoat, and the ZED Attack Proxy, which aid in raising awareness and testing for vulnerabilities in web applications. This membership not only supports OWASP projects but also allows GitLab to influence the future direction of the OWASP community. GitLab is sponsoring the OWASP AppSec California conference and is actively hiring for its engineering and security teams.

GitLab CI/CD pipelines are designed to integrate every stage of the DevOps lifecycle by building, testing, and deploying code within a cohesive workflow, aiming to enable faster and higher-quality software deployment through continuous iteration and feedback from the GitLab community. While GitLab CI excels in continuous integration, the platform seeks to enhance its continuous delivery capabilities by introducing features like the resource_group attribute in version 12.7, which helps manage concurrency by ensuring only one job deploys to a specific resource group at a time. This feature addresses issues like unintended consequences from concurrent deployments, particularly in environments with limited resources, by queuing jobs that attempt to deploy to the same resource group simultaneously. By allowing teams to define multiple resource groups within their .gitlab-ci.yml file, GitLab ensures that deployments are orderly and reliable, reflecting ongoing efforts to refine their continuous delivery processes. Future improvements aim to include features such as implicit environment locking and flexible concurrency values, continuing GitLab's open approach to community collaboration and feedback to drive product evolution.

GitLab has introduced Windows Shared Runners in beta, allowing users to run build jobs on Windows virtual machines (VMs) fully managed by GitLab, complementing the existing Linux Shared Runners. This development is particularly beneficial for those who prefer not to manage their own Runners, providing a secure, auto-scaling environment pre-configured with essential software like Chocolately, Visual Studio 2019 Build Tools, and Microsoft .Net Framework. Each job runs on a new, isolated VM instance that is deleted after completion, ensuring security and ease of maintenance. While the beta version of Windows Shared Runners matches the pricing structure of Linux Runners, future pricing adjustments are anticipated. Users can start using this feature by incorporating specific tags in their .gitlab-ci.yml file, although the current beta has limitations like longer provisioning times and the absence of Docker executor support. Feedback from the community is encouraged to refine the service, with users invited to report issues or request features through GitLab's issue tracking system.

GitLab Epics are a strategic tool for organizing work into coherent collections of issues, facilitating planning and execution for diverse teams such as product managers, engineers, and operations. Recent enhancements to GitLab Epics include the ability to create issues directly from epics, thereby streamlining workflows and reducing the need for manual association, while also improving visibility into project progress through weighted roadmaps. These updates allow team members to self-access progress data, enhancing communication efficiency, especially in remote settings. Additionally, the feature to expand epics on roadmaps provides a clear hierarchical view of tasks, enabling better sequencing of work and ensuring alignment with project timelines. The Plan:Portfolio Management team is further advancing these tools with upcoming features like dependency mapping, which will help teams identify work sequences and potential blockers, thereby enhancing multi-project planning and execution for larger organizations.

In November 2019, MulticloudCon, a collaborative event with Upbound, brought together industry experts to discuss the evolving role of multicloud technology, particularly in CI/CD and DevOps. The panel highlighted the importance of multicloud strategies for reducing single points of failure and ensuring high availability, fault tolerance, and disaster recovery. Experts like Ana Medina, Denver Williams, and Angel Rivera emphasized the challenges and complexities of managing applications across multiple cloud providers, underscoring the need for robust testing and consistent workflows to avoid inefficiencies and bugs. Tools like Crossplane were noted for their ability to facilitate orchestration and abstraction, simplifying the integration of multicloud services. The discussion also covered best practices in CI/CD, such as maintaining platform-specific code separately and incorporating chaos engineering to enhance system resilience. Multicloud architectures, enabled by cloud-native applications, support the management of diverse services within a unified framework, with CI/CD crucial for maintaining workflow consistency across deployments.

GitLab has been recognized as a Challenger in the 2019 Gartner Magic Quadrant for Application Release Orchestration (ARO), marking a significant advancement from its previous position as a Niche Player. This improvement highlights the company's efforts and rapid progress in the ARO sector, which is relatively new for GitLab. The company invites readers to explore its commentary on the ARO market and its future plans for continuous improvement, which will be linked to its roadmap items. Although Gartner's research reflects the opinions of its organization and does not endorse any specific vendor or product, GitLab views its placement as a positive indication of its growth and potential in the market.

GitLab.com is transitioning its content delivery network (CDN) provider to Cloudflare to enhance security, availability, and performance, replacing the current provider, Fastly. The switch is scheduled for the weekend of March 28, 2020, after being postponed from an earlier date. This change targets GitLab.com users, excluding those with self-managed GitLab instances, and will involve routing all traffic through Cloudflare, necessitating updates to firewall configurations for users with whitelisted sites. The transition will allow GitLab.com to leverage Cloudflare's suite of tools, including a Web Application Firewall (WAF), Spectrum, and Argo, to improve service reliability and speed. Users are advised to monitor GitLab's blog and status updates for further information on the transition's timeline and any required actions.

Development teams have increasingly relied on open-source components to build innovative software rapidly, but integrating security into this process has often been an afterthought, traditionally viewed as a cumbersome task that slows down production. To address this, organizations are shifting to incorporate security earlier in the software development lifecycle (SDLC) to detect and fix vulnerabilities more efficiently. GitLab and WhiteSource collaborate to integrate security seamlessly into the development process by providing developer-focused tools within the GitLab UI and CI/CD pipeline, allowing continuous vulnerability management without sacrificing agility. This integration enables developers and security professionals to gain rich insights into vulnerabilities of open-source components directly in the GitLab environment, enhancing the ability to manage and resolve security issues as soon as they arise. The partnership aims to empower developers to leverage open-source innovation without compromising security, and a forthcoming guide will offer detailed instructions on implementing WhiteSource within GitLab to secure open-source components effectively.

GitLab's bug bounty program has evolved from a small, swag-based initiative into a robust public platform that recently surpassed a million dollars in payouts, engaging hundreds of security researchers worldwide. Initially launched as a public vulnerability disclosure program in 2014, it transitioned into a private, paid bounty system before becoming fully public in December 2018 with the help of HackerOne. The program emphasizes transparency, allowing public access to resolved bug reports on GitLab.com while respecting privacy for sensitive issues. Iteration and feedback from the security community have been integral, leading to improvements like faster bounty payouts and increased rewards for critical findings. GitLab's commitment to security and transparency aims to foster trust and engagement, encouraging continuous contributions from researchers to enhance product security.

Serverless Function as a Service (FaaS) solutions, such as AWS Lambda and Knative, allow developers to write discrete functions triggered by events, abstracting away server management and often resulting in significant cost savings due to on-demand resource provisioning. As these solutions gain popularity, tools have emerged to simplify their use, including a GitLab project template that facilitates the deployment of serverless applications without command-line interaction. To illustrate the process, a step-by-step guide details setting up a project using the GitLab serverless template, configuring AWS credentials, and deploying an AWS Lambda function. The guide also demonstrates creating a simple calculator function using the Serverless Framework, showcasing how changes can be made and deployed seamlessly through GitLab's CI/CD pipeline, culminating in an accessible web page where the function can be tested. This approach provides a user-friendly introduction to serverless computing, encouraging experimentation and further exploration.

As the demand for efficient software development increases, integrating DevOps tools like GitLab and Mattermost has become essential to streamline processes and enhance productivity. GitLab offers a comprehensive open-source DevOps platform that covers the entire development lifecycle, while Mattermost provides a ChatOps platform for seamless team communication and action. For instance, itk, a company in France, successfully integrated Mattermost with GitLab to enhance collaboration, resulting in significant growth in project management and code deployment. Another software development firm in Maryland benefited from this integration by improving transparency and real-time visibility of code and configuration changes. The synergy between GitLab and Mattermost allows development teams to manage workflows more efficiently, consolidate communication channels, and keep track of development activities without switching between different applications, ultimately accelerating productivity and collaboration.

Cloud computing and adoption are central to discussions on scalability and growth, yet many enterprises persist with legacy IT systems due to various challenges and strategic considerations. Regulatory compliance, particularly in fields like banking and healthcare, often necessitates maintaining control of infrastructure to safeguard sensitive data and ensure privacy, with organizations hesitant to entrust these responsibilities to public cloud providers despite their built-in compliance features. Cost considerations also play a crucial role, as large-scale operations may find on-premises solutions more economical compared to cloud services' pay-per-use model, especially when existing infrastructure and processes are deeply embedded. While managing on-premises systems demands significant expertise and resources, some companies are exploring hybrid cloud solutions that combine the control of private clouds with the flexibility of public clouds to balance cost, control, and risk. This hybrid approach allows organizations to leverage public cloud scalability during peak demands while maintaining sensitive operations in a private environment. As organizations weigh the benefits and challenges of cloud adoption, strategic decisions must consider the unique needs and capabilities of their operations, requiring leaders proficient in both cloud and traditional infrastructure management.

In 2019, GitLab experienced significant growth and achievements, setting the stage for its planned 2020 IPO. The company more than doubled its workforce, enhancing its product to become a true multicloud solution with features like multi-level child epics, automated HTTPS certificate renewals, and merge trains. The GitLab community also thrived, with over 2,500 contributors submitting over 2,437 merge requests, marking a 50% year-over-year growth. GitLab's valuation soared to $2.75 billion after a successful Series E funding round. The company expanded its bug bounty program to the public, resulting in an influx of new contributors. Corporate events like GitLab Contribute and the new GitLab Commit user conference further solidified its community and user engagement. Additionally, GitLab introduced a CEO shadow program to provide insights into its operations, reflecting its commitment to transparency and leadership development.

Transitioning from North American to Asia Pacific working hours has provided significant learning opportunities, highlighting the importance of being true to oneself, recognizing that productivity is not linear, and understanding the subjectivity of work/life balance. The shift required adapting to drastic time differences, which underscored the value of asynchronous communication, particularly in environments like GitLab that support such practices. The author realized that adhering too rigidly to traditional "9 to 5" work hours could lead to burnout, and instead found greater productivity by chunking the workday into focused tasks and personal breaks. This experience also sparked introspection about work/life balance, revealing that it is subjective and varies based on personal values and motivations, and prompted a deeper appreciation for GitLab's supportive work culture. Overall, this time zone shift has led to a reevaluation of personal productivity and work principles, with an open mindset toward continuous iteration and improvement.