March 2020 Summaries

GitLab is enhancing its platform to support the C and C++ development communities by integrating Conan, a package manager tailored for these languages, allowing users to manage packages and code within GitLab's infrastructure. This integration simplifies the traditionally complex and DIY-driven C and C++ ecosystems by enabling developers to set GitLab as the remote registry for their packages, facilitating a seamless workflow where code and generated packages coexist in a single environment. This development particularly benefits industries reliant on C++ like finance and robotics by streamlining package management and reducing the need for multiple services. GitLab's iteration process promises future enhancements, including a user interface for package metadata, CI templates for automation, and improved game development workflows with features like large file support and partial cloning. This ongoing evolution aligns with GitLab's goal to ease the software development lifecycle for its users, particularly those in domains requiring robust handling of complex dependencies and massive binaries.

GitLab employs a Packagecloud instance to distribute official omnibus-gitlab and gitlab-runner packages, ensuring the integrity of these packages by signing the metadata of apt and yum repositories with a GPG key, separate from the key used to sign the packages themselves. The current GPG key for metadata signing is set to expire on April 15, 2020, prompting GitLab to replace it with a new key, effective from April 6, 2020, with a validity of two years. Existing users who have configured their systems to use these repositories must update their configurations by fetching the new public key to continue accessing packages, as the change will prevent them from downloading packages until the new key is installed. New users, however, will not be affected, as the installation scripts will automatically incorporate the new key. Users experiencing issues are advised to consult GitLab's official documentation or open an issue in the omnibus-gitlab issue tracker for assistance.

GitLab is expanding its open-source offerings by making a significant number of features available to all users under its Buyer-Based Open Core model, which categorizes features based on the intended user, from individual contributors to executives. After a thorough audit of its feature tiers, GitLab decided to open source features across various stages of the DevOps lifecycle, including planning, creating, verifying, packaging, releasing, configuring, and protecting. This move aims to strengthen community collaboration, streamline the development process, and maintain GitLab's commitment to being an accessible, single-tool solution for DevOps. Key features being open-sourced include design management, code quality reports, package managers, and support for multiple Kubernetes clusters, among others. GitLab encourages community members to contribute to the transition of these features to the Core/Free tier, enhancing the platform's functionality and fostering a more inclusive development environment where everyone can contribute.

The transition to microservices architecture has increased the attack surface, as demonstrated by a file upload vulnerability discovered and patched in GitLab's 12.7.4 security release. This vulnerability, rooted in parser differentials, involved GitLab's reverse proxy, gitlab-workhorse, and its main application, gitlab-rails. These components handled file uploads differently, allowing potential attackers to manipulate HTTP requests, thereby accessing arbitrary files on the server. The misalignment occurred because gitlab-workhorse and gitlab-rails interpreted HTTP methods differently, with gitlab-rails accepting overridden POST requests as PUT requests due to Ruby on Rails' Rack::MethodOverride middleware. This discrepancy led to a security loophole, illustrating how parser differentials in modern web environments can introduce vulnerabilities. The issue was resolved by implementing request signing to ensure consistency between gitlab-workhorse and gitlab-rails, highlighting the importance of understanding parser behaviors in complex, microservices-driven systems to prevent similar security risks.

Incorporating UX into Agile practices presents challenges, particularly concerning design integration, yet GitLab's Release Management team is effectively utilizing user stories to tackle this issue. By focusing on user experiences and leveraging real data, the team collaborates closely with product managers and UX researchers to identify user needs and translate them into actionable insights, which then guide the design and development of features like Deploy Freezes. These user stories keep the scope of proposals minimal, facilitate discussions about technical constraints, and serve as a foundation for subsequent design phases. The team strives for constant iteration and refinement, breaking down user stories into smaller, more manageable tasks to ensure clarity and focus. Through this approach, they aim to deliver user-centered solutions that align with the overarching goals of the GitLab platform, all while maintaining a flexible, communication-driven workflow that adapts to the evolving needs of users and stakeholders.

As educational institutions worldwide shift to virtual models due to COVID-19, educators face the challenge of rapidly transitioning to remote teaching without adequate preparation. GitLab, as a leading all-remote company, offers strategies to ease this transition by emphasizing the importance of a Single Source of Truth (SSoT) for consistent information sharing, utilizing transparent communication tools like cloud-based processors instead of traditional email, and implementing asynchronous communication to accommodate diverse schedules. Additionally, fostering relationships in a virtual classroom is crucial, encouraging social interactions through fun channels and video conferences to maintain community spirit. Such practices not only facilitate a smoother transition to online education but also promote a collaborative and independent learning environment.

GitLab's UX team, which expanded significantly in 2019, has embraced an all-remote working model, adapting their collaborative processes to maintain effective communication and engagement despite the lack of face-to-face interaction. To address challenges such as the absence of immediate peer feedback for product designers, they piloted a Pair Designer program, assigning designers to collaborate with peers in the same time zone, which has received positive feedback. They also implement synchronous kick-off sessions for new projects and use video walkthroughs to keep team members informed and involved in the design process. Additionally, GitLab hosts biweekly UX Showcases to share work and insights across the company and employs asynchronous sketching exercises to harness creativity regardless of time zones. They emphasize the importance of thorough documentation in GitLab issues and a handbook to ensure transparency and continuity in their design processes. This all-remote approach is deemed effective, with the challenges of inclusivity and collaboration being met through intentional and persistent efforts to involve cross-functional peers in the design process.

In the shift to remote work, UX designers accustomed to in-person collaboration face challenges in adapting their creative processes to an asynchronous environment, yet companies like GitLab demonstrate how to effectively manage remote design activities. Successful remote collaboration requires clear guidelines, a shared understanding of the project context, and tools that enable easy sharing of ideas, such as Mural or Google Drive. Facilitating communication through supportive comments and creative use of emojis can compensate for the lack of non-verbal cues. Encouraging participation by setting a relaxed atmosphere and emphasizing action over perfection helps team members contribute without fear of judgment. GitLab exemplifies this approach by fostering an inclusive environment where everyone is encouraged to share ideas, regardless of their design expertise, as demonstrated in a structured sketching session with clear, simple rules that promote creativity and engagement.

Getting started with GitLab CI using GitLab's integration with Google Kubernetes Engine (GKE) involves a series of straightforward steps that can enable users to launch GitLab CI/CD pipelines within 15 minutes. The process begins with configuring a GitLab instance with necessary credentials and a Google Cloud project with specific APIs enabled. Users then add a shared runner at the instance level by navigating through the GitLab admin settings to integrate a Kubernetes cluster. This involves naming the cluster, selecting a Google Cloud Platform project, and configuring the number of nodes for simultaneous job execution. Once the cluster is created, users install Helm Tiller and the GitLab Runner application to complete the setup. With this integration, users can efficiently manage their CI/CD workflows, and additional resources are available for building and optimizing pipelines, including autoscaling of GitLab Runners and deploying scalable applications on Google Kubernetes Engine.

The concept of the citizen developer is becoming increasingly vital as companies face a global shortage of software developers amid the growing dominance of software in various industries. Citizen developers, empowered by low-code and no-code tools, can create applications with minimal or no formal coding skills, which has led to a significant rise in their use, as reported by IDC. GitLab is actively exploring the integration of low-code functionalities to democratize programming, with CEO Sid Sijbrandij and senior product marketing manager Parker Ennis discussing the potential of these tools to lower the barrier to entry for coding and inspire future generations. Parker highlights the importance of engaging young people in programming through low-code solutions to address the projected demand for 100 million developers in the coming decade and emphasizes how these tools can facilitate early interest in coding by making it less intimidating. As GitLab considers incorporating low-code tools into its workflow, the company remains open to further advancements, particularly with the emergence of viable open-source low-code options.

Git Merge 2020 celebrated the 15th anniversary of Git, highlighting its evolution into a powerful distributed version control system embraced by millions worldwide. The event, sponsored by GitHub, GitLab, and the Software Freedom Conservancy, featured engaging talks from industry experts, including Tianyu Pu and Ed Thomson, who shared insights into Git's internals and effective branching models. A significant highlight was Derrick Stolee's presentation on Scalar, a Microsoft initiative aimed at enhancing Git's performance with large repositories, showcasing the collaborative spirit between enterprises and the Git community. The event underscored the importance of open collaboration, with contributions such as Partial Clone exemplifying the collective effort to improve Git's functionality. GitLab's ongoing commitment to enhancing Git's usability was evident, as it continues to refine tools like Partial Clone and promote productive development workflows. The camaraderie and knowledge-sharing among participants emphasized the vibrant and inclusive nature of the Git community, with attendees eagerly anticipating future collaborations and innovations.

The GitLab community held a record-breaking Q1 Hackathon on February 12-13, marked by nearly 150 merge requests (MRs) across over 20 GitLab projects, showcasing the extensive contributions from community members. This event surpassed previous records and highlighted significant contributions to projects such as Charts, Gitaly, Gitter, and more, with notable Epics like replacing Underscore with Lodash and migrating .fa-spinner to .spinner driving many MRs. The Hackathon also featured a remote meetup with the GitLab Hamburg group, emphasizing community engagement and collaboration. Participants who had MRs merged by February 25 received GitLab-branded duffle bags, with special recognition given to top contributors Takuya Noguchi and Rajendra Kadam for their outstanding efforts. The next Hackathon is scheduled for May 13-14, 2020, and GitLab encourages new contributors to start by visiting the Contributing to GitLab page for guidance on how to participate.

Ask Media Group, which operates over 30 websites and engages over 100 million unique visitors monthly, sought to modernize its operations and foster business growth by transitioning from a monolithic system to a microservices architecture. Faced with slow onboarding and software release processes, the company adopted GitLab and AWS cloud services to enhance development speed, cost management, and scalability. Principal software engineer Chenglim Ear highlighted the benefits of this shift, noting that GitLab's comprehensive features and AWS's robust services enabled developers to independently manage code, improve transparency, and utilize Kubernetes clusters for container management. This transition facilitated a paradigm shift in Ask Media's workflow, providing improved customer experiences and operational agility while ensuring the platform's scalability and flexibility to meet business needs.

Interviewing for engineering roles in the tech industry often involves navigating a complex array of technical and situational questions, designed to assess not only a candidate's technical skills but also their cultural fit and problem-solving abilities. At companies like GitLab, rapid growth has highlighted challenges in maintaining a consistent and equitable technical interview process. Traditional methods such as live coding exercises and take-home projects have been critiqued for their biases and pressure on candidates. In response, GitLab has developed a new approach by standardizing interviews through an open-source project called project-seeder, which aligns closely with real work scenarios and is evaluated using a standardized rubric to reduce bias. This method allows candidates to demonstrate their skills in a more realistic setting, promoting a fairer assessment of their abilities. The process is designed to reflect actual work environments, permitting candidates to use resources, thereby emphasizing practical problem-solving over rote memorization. This innovative approach aims to improve the candidate experience and ensure a more diverse and capable workforce.

GitLab announced changes to its CI/CD minutes policy for free tier users, effective March 15, 2020, setting a limit of 2000 pipeline minutes per group per month, regardless of project visibility, while existing free users remain unaffected. Pipeline minutes are the execution time on shared runners, with no limit on execution using personal runners. This adjustment aims to enhance efficiency, a core value at GitLab, and was decided after internal analysis showed most free users utilized less than 1000 CI minutes. If the new limit is insufficient, users can purchase more minutes or use their own runners. GitLab continues to focus on providing value to its community by strengthening its open-source offerings, and upcoming features include dynamic child pipeline creation and autoscaling CI jobs on AWS Fargate.

Modern software development is characterized by rapid iteration and deployment, facilitated by continuous testing, building, and deployment processes, as well as containerization, allowing teams to experiment without disrupting entire applications. However, this speed can obscure the importance of ensuring changes are valuable to customers and the business. Value Stream Analytics, informed by lean principles, helps teams optimize the delivery of value from ideation to production impact. GitLab's Value Stream Analytics, available since version 12.3, provides real-time insights without complex integrations, tracking the development cycle's stages, from issue scheduling to production deployment. Notably, if code review delays are identified as a bottleneck, GitLab offers Code Review Analytics, introduced in version 12.7, to analyze and address these delays by highlighting aged merge requests, encouraging completion of in-process work, and identifying potential areas for team improvement. This tool allows teams to debug issues such as complex code, lack of comments, or insufficient team support to enhance review efficiency. Improvements are ongoing, and user feedback is encouraged to refine these analytics further.

GitLab introduced Seat Link in version 12.9 to simplify the process of managing user charges for self-managed customers, addressing the historical complications of "true-ups" by offering more transparent and prorated billing. The Seat Link feature automatically sends daily user counts from connected instances to GitLab, enabling prorated charges each quarter for any additional users added, thus eliminating the need for manual calculations and unexpected fees at renewal time. Although this solution simplifies billing for most users, it is not available for customers using air-gapped or closed networks, who will continue with the traditional true-up model. Seat Link is designed to be minimal and non-configurable to maximize usability, with the encrypted data transmission ensuring secure communication. While it is available in version 12.9, the processing of prorated charges is expected to begin with version 12.10.

Building mobile apps can be challenging, but Firebase by Google simplifies the process by offering a comprehensive Backend-as-a-Service (BaaS) platform that includes features like databases, storage, user authentication, and serverless functions. The text outlines a project to create a link shortener using Firebase and Vue.js, demonstrating Firebase's capabilities in user authentication, database management, and URL redirection through Firestore. It emphasizes the importance of integrating Firebase with source code management and CI/CD tools, suggesting GitLab as a complementary tool for automating deployments. The project setup involves using Firebase's CLI for initialization and deployment, with GitLab CI/CD managing automated deployments through the use of Firebase API keys and configuration in .gitlab-ci.yml, ensuring that changes in the infrastructure trigger only necessary deployments.

Git, a widely-used version control system, has introduced a new feature called Partial Clone to address the challenges faced by projects with large binary files, such as video games, which do not typically use Git due to the inefficiency of downloading every file version. Partial Clone, developed with contributions from GitLab, GitHub, Microsoft, and Google, allows users to work with large repositories by filtering out unnecessary data during cloning and fetching, thereby reducing data transfer and local disk usage significantly. This feature eliminates the need for Git LFS and its associated complexities by allowing Git to manage large files natively without additional tools or storage classes. While still experimental, Partial Clone simplifies the process by not requiring users to manage separate storage for large files and provides flexibility in storing and accessing these files. It also introduces improvements in performance and usability, although it requires learning new configuration options. As Git continues to advance support for large repositories, the Git community is actively working on integrating features like file locking and tool integrations to enhance the workflow for projects that rely heavily on large binary files.

GitLab introduced a CI/CD feature for users with private repositories hosted on GitHub, Bitbucket, or other Git servers, allowing them to use GitLab CI/CD regardless of where their source code resides. Initially offered free of charge for a limited time, the free period was extended, but it ended on March 22, 2020. Users wishing to continue using CI/CD for private external repositories beyond this date need to upgrade to at least a Silver plan, although public repositories on GitHub mirrored to GitLab remain eligible for free CI/CD capabilities. As part of GitLab's commitment to transparency and open source, all public repositories on GitLab.com receive top-tier Gold plan features for free. The change means private repositories will require an upgrade to maintain CI/CD functionality, affecting users relying on GitLab Pages through private GitHub repositories unless they transition to an eligible plan. Users are encouraged to contact GitLab's Sales team for general or pricing inquiries and review support options for technical concerns.

Security as code is an essential approach to integrating security into DevOps by embedding security checks, tests, and gates into development workflows without causing delays or extra costs, thereby facilitating the shift towards DevSecOps. This practice involves defining security at the start of a project and automating tests and scans in the development pipeline, allowing developers to address issues in real-time and learn best practices during coding. By automating security processes, such as static and dynamic analyses and penetration testing, teams can ensure that security policies are consistently applied across projects, thus enhancing efficiency and preventing deployment mishaps. Security as code aims to align security practitioners and developers, fostering a common understanding and enabling the development of robust security protocols within the software development lifecycle. GitLab provides a DevSecOps methodology assessment tool to help teams evaluate their capabilities and maturity level in integrating security throughout their software development processes.

GitLab's Compliance Dashboard, introduced in version 12.8, is designed to help self-managed instance administrators enforce compliance with various business and government regulations, such as SOC 2, HIPAA, Sarbanes-Oxley, and GDPR, by providing a centralized view of compliance-related settings and evidence artifacts. This tool aggregates data from across projects or groups, allowing administrators to track approved merge requests and audit trails, which can be crucial during compliance audits. Future iterations of the dashboard are expected to include more features such as merge request approval settings, security scanning data, and an overview of compliance policy adherence, aiming to assist teams in promptly addressing vulnerabilities and policy violations. The development of this feature reflects the complex nature of regulatory compliance and the challenges faced by teams in managing compliance tasks alongside their primary responsibilities, as experienced by the feature's product manager, Matt Gonzales. The ongoing development of the Compliance Dashboard is part of GitLab's efforts to mitigate security risks by providing visibility into code changes and access management, thus helping businesses protect their environments and data.

Kubernetes has revolutionized infrastructure management by enabling scalable application deployment, but its complexity often requires expert setup. Amazon's Elastic Kubernetes Service (EKS) simplifies this process by abstracting the intricacies of Kubernetes setup on a trusted platform, offering better security and resource management. GitLab enhances developer productivity by automating Kubernetes cluster creation on Amazon EKS, allowing seamless CI/CD integration through GitLab Runner, and simplifying the management of shared clusters and review apps. By integrating with Amazon EKS, GitLab facilitates the setup of Kubernetes clusters with minimal manual intervention, enabling developers to focus more on coding rather than infrastructure management. This integration supports AutoDevOps, which automates application deployment and monitoring, further streamlining development workflows. The tutorial outlines the necessary steps to set up AWS resources and permissions for GitLab to manage EKS clusters, reducing the time and effort required for developers to deploy and manage applications at scale.

GitLab's education program, launched over two years ago, aims to provide students and faculty worldwide with free access to GitLab, fostering the development of future developers and DevOps professionals. The program has grown significantly, reaching over 737 educational institutions in 67 countries and nearly 1.5 million users. As the program evolves, a new program manager with a background in geospatial technology and open-source education has been appointed to enhance and restructure the initiative to better align with institutional needs. GitLab plans to gather feedback through surveys and encourages participants to share their experiences, with the goal of enriching the program and promoting the use of GitLab in teaching and research.

Amid the global COVID-19 pandemic, many companies are shifting towards remote work, often with little preparation, and GitLab, a leading all-remote company, is sharing its expertise to assist others in this transition. GitLab has developed comprehensive resources, including a remote work emergency toolkit for leaders and a starter guide for employees, covering aspects such as asynchronous communication, combating burnout, and effective remote onboarding. Their open-source approach encourages other companies to adapt and contribute to these resources. Despite the challenges posed by the lack of in-person interactions, GitLab emphasizes intentional opportunities for team bonding, although the pandemic has led to the cancellation of their annual in-person gathering, Contribute. As an all-remote company, GitLab remains resilient against disruptions, advocating remote work's potential benefits for business continuity and encouraging shared learning to facilitate this shift across industries.

GitLab Flow is a streamlined alternative to the traditional Git flow, designed to simplify the software development process by integrating issue tracking directly into the Git workflow. It addresses the complexities and unnecessary branch switching inherent in Git flow, particularly the use of develop branches instead of master and the cumbersome release and hotfix branches. GitLab Flow emphasizes a simpler branching model that includes feature, production, and release branches, allowing for a more transparent relationship between code changes and issue tracking. This workflow ensures that all code changes begin with an issue, move through feature branches, and are eventually merged into master, facilitating easier deployment and visibility of code in production environments. GitLab Flow also incorporates best practices such as continuous testing and code reviews to enhance efficiency and maintain high standards throughout the development lifecycle, promoting a cohesive approach from the idea stage to production.

In 2019, GitLab's meetup community experienced significant growth, expanding its presence to over 20 countries and increasing membership by more than 400%. The GitLab Developer Relations team aims to further develop these community programs, emphasizing the importance of in-person interactions to foster diversity, inclusion, and belonging. Meetups serve as a platform for individuals to connect, enhance their skills, and pursue their passions, offering opportunities for participation as organizers, speakers, hosts, or members. GitLab supports these endeavors by providing financial aid, materials, and guidance to ensure the success of events. By engaging in meetups, participants can expand their professional networks, develop critical skills such as public speaking, and advocate for shared values and interests within the tech community.

GitLab's 12.8 release introduces continuous accessibility testing, reflecting the company's commitment to building accessible software and allowing everyone to contribute. Accessibility testing has historically been conducted late in development, often too late for impactful changes, but GitLab aims to address this by integrating an accessibility scanning feature within its Core product. This feature, triggered by including a specific template in the .gitlab-ci.yml file, generates an HTML report identifying accessibility issues according to W2CAGAA standards, enabling developers to enhance software inclusivity from the onset. The initiative highlights the importance of accessibility in software development, not just as a legal safeguard, but as a moral imperative to create inclusive digital experiences. While the current capabilities mark an initial step, GitLab plans to evolve the feature by focusing on scanning only modified pages, presenting new issues directly in merge requests, and offering comprehensive accessibility reports, thus fostering ongoing improvements in software accessibility.

Logging plays a crucial role in understanding application problems, especially in modern, distributed architectures where raw logs can be complex to navigate. GitLab addresses this by integrating Elastic Stack for log aggregation and Log Explorer, which allows interaction with logs in one place. This update is part of GitLab's broader DevSecOps platform, which emphasizes monitoring as a critical final stage in the DevOps lifecycle to ensure applications behave as expected post-deployment. Observability, which includes metrics, traces, and logs, is essential for proactive system introspection, and GitLab aims to provide a comprehensive observability tool. With features like Prometheus for monitoring and Jaeger for distributed tracing, GitLab facilitates the deployment of monitoring solutions in Kubernetes clusters, offering customizable metrics and log aggregation for enhanced visibility. By moving a significant portion of observability features to an open-source codebase, GitLab supports cloud-native compatibility and invites user feedback to enhance its logging and monitoring capabilities.