May 2021 Summaries

Recent supply chain and dependency confusion attacks have highlighted the vulnerability of third-party and value-chain systems, prompting cross-industry efforts to bolster security and protect customers, business operations, and reputations. These attacks, which exploit software applications and code repositories, have grown in sophistication and prevalence beyond traditional nation-state threats. In response, GitLab is enhancing its product, processes, and partner ecosystem controls, and is developing tools like Package Hunter to identify malicious packages through dynamic behavior analysis. GitLab's initiative includes open-sourcing Package Hunter and integrating it with GitLab CI to help users detect unexpected dependency behavior, aiming to secure CI environments and prevent dependency confusion attacks. The company is also reviewing its package registries for Ruby, JavaScript, and Go to ensure they operate securely and adhere to best practices, while planning to introduce a Dependency Firewall product category to verify package integrity, filter approved packages, and audit dependencies. This comprehensive approach is aimed at mitigating the risks associated with evolving supply chain attacks and enhancing the security of software supply chains.

ARM-based processors are increasingly popular for their energy efficiency and performance, as evidenced by Apple's recent adoption, and are now used across a variety of systems, including servers. This shift necessitates robust development toolchains for ARM architecture, where GitLab Runner excels by enabling CI/CD jobs on ARM servers. By integrating GitLab Runner with Oracle Cloud Infrastructure's ARM-based compute instances, development teams can optimize CI/CD infrastructure for both ARM and x86 architectures. Automated deployment via Oracle Cloud is recommended for setting up GitLab, though manual deployment on virtual machines requires attention to specific details, particularly on Oracle Linux Server release 8.x, which lacks support from PackageCloud. For both GitLab Runner and GitLab EE/Core installations, manual repository setup is necessary on ol/8 systems. A notable issue is the ARM64-specific Redis bug in GitLab versions 13.9 and later, which can be bypassed by installing earlier versions or configuring a separate Redis instance. Despite this, the GitLab Runner's support for diverse architectures, including ARM, facilitates varied workloads for development teams.

The third installment of the series on GitLab and Jira integrations provides a comprehensive overview of how to integrate the two platforms, focusing on practical functionalities available post-integration. Once set up, users can reference Jira issues within GitLab branch names, commit messages, and merge request titles, and even move Jira issues through workflow stages using commit messages. The integration allows for viewing and managing Jira issues directly within GitLab, with options to filter and sort issues by various parameters. The integration also supports time tracking and issue transitions using Jira Smart Commits. However, successful implementation requires correct configuration, including proper permissions for Jira users and ensuring compatibility between Jira settings and GitLab functionalities. The guide emphasizes the integration's benefits in enhancing project visibility and streamlining the development process, particularly for Agile project management, and offers additional resources for users who prefer video tutorials on setting up the integration through the Marketplace App.

Visual Studio Code (VS Code) is a versatile code editor developed by Microsoft, supporting multiple programming languages and offering features such as debugging, syntax highlighting, and Git integration. The GitLab VS Code extension enhances productivity by enabling users to perform tasks like cloning projects, viewing merge requests (MRs) and issues, creating MRs, configuring GitLab CI, and managing code snippets directly from the editor. Contributions from GitLab community members have added features such as cloning capabilities, status bar shortcuts for creating MRs, and CI configuration validation. GitLens, another extension, further improves Git integration by providing tools for browsing file history and comparing branches, enhancing workflow efficiency. The GitLab Workflow extension allows users to manage GitLab-related tasks within VS Code, reducing context switching and improving development efficiency. The GitLab community encourages contributions to continue enhancing these extensions, ensuring they remain powerful tools for developers working with GitLab and VS Code.

In GitLab CI/CD, a bug affecting pipeline behavior was addressed in version 13.12, particularly concerning manual jobs that require user intervention before execution. Previously, if a job needed a manual job that wasn't triggered, the pipeline would get stuck, halting subsequent jobs. Manual jobs are now considered optional by default, and pipelines no longer stop if such jobs are not triggered, allowing subsequent jobs to run. If users prefer the previous behavior where a pipeline waits for manual jobs to execute, they can override the default setting by changing the allow_failure attribute to false, making these manual jobs mandatory and thus blocking the pipeline until they are run. The update introduces flexibility with the needs keyword, enabling Directed Acyclic Graphs (DAG) to optimize pipeline execution by defining dependencies beyond stage ordering.

In recent years, the evolution of DevOps and Agile methodologies has transformed from a complex toolchain approach to streamlined DevOps platforms, exemplified by GitLab, which integrate planning and execution into a single system, enhancing accuracy, visibility, efficiency, and actionability. This shift alleviates the need for professionals, such as portfolio managers, to adopt technical roles to access necessary information, as these platforms provide real-time data, context, and collaboration opportunities without the integration overhead of past systems. Industry recognition, like Gartner's acknowledgment of GitLab as a leader in enterprise Agile planning tools, highlights the growing trend toward adopting such platforms to improve delivery speed and productivity across various business roles.

Jacie Bandur shares her experience of participating in GitLab's CEO Shadow program, highlighting the invaluable insights gained about the business and the importance of iterative processes. Despite initial feelings of inadequacy, she encourages others to pursue the program, emphasizing that qualifications should not be a barrier. Bandur offers practical tips for future participants, such as informing teams of their absence, consulting with previous participants, and taking breaks post-program. She underscores the significance of attending Group Conversations to grasp the interconnectedness of organizational functions and advocates for regular feedback. The experience reinforced the value of starting projects simply and iteratively building on them, a lesson emphasized by GitLab CEO Sid's repeated advice that complex systems evolve from simple, effective ones. Overall, Bandur found the program enlightening and urges others to seize the opportunity if possible.

The 2022 Global DevSecOps Survey, gathering insights from over 5,000 DevOps professionals, highlights a significant maturation in DevSecOps practices amidst the continuing impact of COVID-19. With 72% of security professionals rating their organizations' security efforts as "strong" or "good," there is a notable shift towards integrating security earlier in the development process, known as "shifting left." Despite this progress, challenges remain, particularly in security testing and bug remediation, as 42% of testing still occurs too late, and security teams struggle with prioritizing and tracking bug fixes. The survey also points out an increase in testing activities, with more developers running SAST and DAST scans and engaging in container and dependency scanning. While collaboration and innovation have improved, reflecting a positive trend in DevSecOps maturity, there are still opportunities for growth and addressing security challenges.

GitLab has introduced measures to mitigate the abuse of free CI/CD pipeline minutes, which have been increasingly exploited for cryptocurrency mining, causing performance issues and cost increases. Starting May 17, 2021, new free users must provide a valid credit or debit card to use shared runners, although the card won't be charged. This requirement aims to deter abuse by verifying users, and those unwilling to provide a card can use their own runners instead. GitLab has implemented several technical solutions, such as quota-based restrictions and enhanced validation services, to further prevent misuse. These changes do not affect GitLab self-managed, paid, or pre-existing users before the specified date. Public projects in new namespaces now have CI minute quotas, and exceeding the quota requires purchasing additional minutes. GitLab continues to seek feedback and intends to enhance its pipeline system to ensure optimal performance and reduce abuse.

GitLab has established a Security Awards Program to emphasize security as a collective responsibility, encouraging team and community involvement to enhance security measures while rapidly developing new features. Launched in 2020, the program rewards contributions to security through a points-based system, with prizes awarded quarterly and annually to those outside the Security team making significant contributions. The initiative aligns with GitLab's values like efficiency, iteration, collaboration, diversity, inclusion, and transparency, promoting a culture where security actions are recognized and celebrated. The program incorporates a simple workflow for nominating and awarding security-related actions, ensuring scalability and automation to minimize human error, and fosters inclusivity by encouraging diverse contributions from the global GitLab community. Additionally, it enhances security awareness and transparency by publicly displaying a leaderboard, while keeping the actions confidential, and is further supported by GitLab's bug bounty program on HackerOne for security vulnerability research.

During the global pandemic and coder shortage, software developer job satisfaction has become increasingly significant, as highlighted by a study conducted by Daniel Graziotin and Fabian Fagerholm, which examined over 1,300 developers to identify the factors affecting their happiness and its correlation with productivity. Their research concluded that developers are generally "moderately happy," with dissatisfaction arising from being stuck while problem-solving, time pressure, and dealing with bad code or poor processes, as well as information overload. The study confirmed that happier developers are more productive, prompting a focus on improving job satisfaction through streamlined processes. The 2021 Global DevSecOps Survey revealed a rise in DevOps adoption, which enhances code quality and developer satisfaction, although the plethora of tools can lead to information overload, negatively impacting happiness. Consequently, adopting a DevOps platform that consolidates tools into a single application is suggested as a solution to improve collaboration, visibility, and development velocity, thereby increasing developer satisfaction and productivity.

Many buttons and visual elements in both the physical and digital worlds act as "placebo buttons," offering the illusion of control without affecting actual outcomes, such as elevator close-door buttons or cross-walk signals. These placebo effects extend into software, where design features provide misleading feedback. GitLab's pipeline graph previously used indiscriminate lines to indicate job relationships, which misrepresented actual dependencies as pipelines grew more complex. To address this, GitLab has been refactoring the pipeline graph to accurately depict job relationships, though the new accurate lines are computationally expensive. Initially, the updated graph rollout excluded connecting lines to avoid performance issues but plans to iteratively introduce improved features in future releases, including a new Job Dependencies view that better reflects execution order.

In a brief interlude between meetings, the author tackled a recurring issue of forgetting the HTML snippet needed to create collapsible sections in GitLab Issue descriptions, which was not standard Markdown but supported by GitLab. By exploring the codebase, they discovered the simplicity of implementing shortcuts and quickly developed a new toolbar shortcut to automate the insertion of this snippet, thus eliminating the need to memorize it. Though not a professional software engineer, the author successfully navigated the process, aided by the collaborative support of UX colleagues for icon design and teammates for resolving test failures. The innovation gained traction within the team, received positive feedback, and after a few months, was successfully integrated into production. This experience highlighted the impact and satisfaction of contributing directly to product development at GitLab.

GitLab, primarily recognized as a comprehensive DevOps platform, also serves as an effective project management tool, as demonstrated by its use within the GitLab Alliances team to manage a strategic partnership with IBM. The platform's utility is highlighted through its ability to organize work into multi-level epics and roadmaps, allowing users to track and manage projects efficiently. The GitLab platform supports collaboration by offering features such as issue boards, which facilitate workflow visualization and management, and milestones, which help in timeboxing events and tracking progress through burnup and burndown charts. Furthermore, GitLab's built-in analytics and insights tools, like the Value Stream Analytics, enable teams to monitor the overall workflow and address any bottlenecks swiftly. By integrating both DevOps and project management capabilities, GitLab provides a single, cohesive environment for managing both technical and non-technical aspects of projects, making it a versatile choice for teams looking to streamline their processes.

GitLab has established a Security Culture Committee to reconcile transparency, a core company value, with the sometimes conflicting needs of security practices, especially as the organization scales. The committee is composed of peer-nominated members who meet monthly and collaborate asynchronously to identify initiatives that align with GitLab's values like collaboration, diversity, and transparency. One of their early initiatives was encouraging the use of public profiles to enhance transparency and collaboration. The committee has also focused on making department meeting notes and recordings available internally to boost transparency and support collaboration. Additionally, they engaged with team members through surveys to identify areas for improving the employee experience, resulting in focus areas like career opportunities, confidence in leadership, and access to learning and development resources. The committee has already seen some success, such as implementing individual development plans and establishing a Security Department Team Day to foster collaboration. As the committee transitions to new members, it continues to prioritize initiatives that strengthen GitLab's values and improve the security culture.

The 2022 Global DevSecOps Survey, gathering insights from over 5,000 DevOps professionals, highlights ongoing challenges and advancements in the software testing life cycle within DevOps. Testing has consistently been identified as the primary cause for release delays, with participants citing issues such as slow writing and execution, insufficient automation, and delegation to QA personnel causing bottlenecks. However, the survey also reveals a growing trend towards automation, with nearly 25% of respondents achieving full test automation, and 28% at least halfway there. Changes in DevOps roles show an increase in developers testing their own code, yet many still recognize the need for further testing improvements. The rise of artificial intelligence and machine learning offers a promising future for testing, as 41% of respondents now utilize bots and AI/ML for code testing and review, a significant increase from the previous year. Despite the progress, a quarter of respondents have yet to adopt AI/ML in their testing processes.

Auto DevOps, a feature set within GitLab, streamlines the development and delivery process by automating tasks and supporting DevOps best practices through a convention-over-configuration approach. Initially released in GitLab 11.0, it has evolved to cover 15 stages from project building to deployment, with a focus on simplifying DevOps practices for organizations. Despite its value to users, especially those transitioning to Kubernetes, Auto DevOps faces challenges such as slow pipelines, difficulty in troubleshooting, limited scalability, and restricted deployment targets, which often require users to customize templates. The tool targets two main user types: larger companies with dedicated platform teams needing standardized processes, and smaller companies where lead engineers manage pipelines with minimal effort. To address these challenges and better serve its users, GitLab plans a Design Sprint to reimagine Auto DevOps, aiming to facilitate easier adoption of DevSecOps practices.

GitLab's 10-day certification offer, featuring a 100% discount, saw an overwhelming response with over 60,000 new accounts on GitLab Learn and more than 8,000 enrollments in the GitLab Certified Associate Self-Service pathway within just two days. The unexpectedly high participation exceeded the user capacity of their learning management platform and internal training infrastructure, leading to an early end to the discount period. GitLab expressed gratitude for the enthusiasm shown and apologized for the inconvenience caused by the system limitations. They are working to enhance their training systems to better accommodate future demand and continue to offer free learning resources such as GitLab 101 and 201, Remote Work, and DIB badges. GitLab invites feedback to improve their offerings and ensure a better experience as they scale their educational platform.

Since hiring its first designer in 2014, GitLab's UX department has significantly evolved, progressing through several UX maturity stages as defined by Nielsen Norman Group. Initially focused on improving the UI design away from vanilla Bootstrap, the UX team expanded from one to six members by 2016, aligning more closely with the Engineering department to enhance iteration speed. By 2017-2018, as the team grew to 12, foundational work for future UX developments began, including the establishment of personas, category maturity scorecards, and the initial steps toward the Pajamas Design System. The period of 2019-2020 saw the UX department expand to nearly 60 members, achieving a balanced ratio of Product Designers to Product Managers, integrating broader department changes, and placing a greater emphasis on research, which became crucial in decision-making. This growth facilitated the embedding of UX into cross-functional teams and introduced tools like Figma and Mural, while also adding tech writing to the UX department. Looking forward, GitLab aims to enhance its DevOps tooling and continue evolving its UX maturity, embracing iteration and aiming to become a User-Driven corporation.

In the wake of a global pandemic, GitLab's 2021 Global DevSecOps Survey reveals a significant advancement in DevOps practices, highlighting increased automation, faster release cadences, and stronger security postures among over 4,300 professionals. The survey illustrates a shift towards a new DevOps maturity model, with 60% of developers releasing code twice as fast as before and 72% of security professionals rating their efforts as "good" or "strong." The adoption of AI and machine learning has surged, with 75% of teams using or planning to use these technologies for test and code review, reflecting a 41% increase from 2020. The evolving roles within DevOps teams show developers taking on testing and operations tasks, with operations focusing on cloud infrastructure and security integrating into cross-functional teams. Despite challenges in testing, where delays are still prevalent, the use of AI/ML is seen as a potential solution to revolutionize software testing. The survey also notes a growing adoption of advanced technologies like Kubernetes, with usage rising from 38% to 46% since 2020. Looking ahead, participants plan to invest in cloud technologies and AI, signaling a strategic shift from the foundational focus of the previous year.

In March 2021, GitLab's Digital Experience team launched a new design for the GitLab blog, affecting over 1,300 posts and marking the largest project for their design system, Slippers. The transition faced challenges, particularly in integrating Tailwind CSS's Preflight styles with existing CSS, which led to conflicts with legacy components. To address this, the team employed web components, utilizing the shadow DOM for CSS encapsulation to isolate old and new styles, ensuring they didn't interfere with each other. This approach allowed them to maintain critical content accessibility even if JavaScript failed to load. While this added complexity to the build process and introduced client-side rendering to a static site, the near-perfect CSS encapsulation achieved justified these trade-offs. The team views web components as a promising future and is committed to using them responsibly.