December 2022 Summaries

In 2022, GitLab's Application Security team celebrated a record-breaking year for its bug bounty program, awarding over $1 million in bounties across 221 valid reports, significantly up from the previous year. This surge in activity was attributed to increased engagement from researchers and an enhanced bounty award structure. The team received 920 reports from 424 researchers, resolving 158 valid reports and publicly sharing 94. Notable achievements included high earnings by researchers, exceptional reports on remote code execution, and innovative findings like a novel local git read vulnerability. GitLab also introduced new initiatives such as a $20,000 capture the flag bonus and resources like "Reproducible Vulnerabilities" to aid learning. The organization emphasized transparency in their processes and continued to provide educational content through various platforms, reinforcing its commitment to leading in industry standards for bug bounty programs.

GitLab emphasizes its mission of inclusivity by enabling everyone to contribute, which is visually represented through an animated visualization created by Gource that showcases 11 years of contributions to the GitLab repository, amounting to over 300,000 commits. This visualization, which compresses years of collaborative effort into a concise 10-minute video, highlights the diverse file types and the vibrant community behind GitLab's development. GitLab has introduced a new people management framework called TeamOps to further support this inclusive mission, and offers certification through its learning portal. This initiative coincides with GitLab's recent milestone of celebrating one year as a public company, further reinforcing the impact of its collaborative philosophy. During a time of global celebration, the visualization's luminous display is a fitting tribute to the spirit of community, and GitLab encourages new contributors to join by following their contribution guide.

ChatGPT has quickly captivated the tech world since its launch on November 30, with widespread media attention and discussions across platforms like Hacker News and Twitter. GitLab's team has explored its capabilities, such as writing poetry, blog posts, unit tests, and conducting competitive analysis, while recognizing ethical concerns. The GitLab Developer Relations team tested ChatGPT to determine if it could assist in contributing to their platform, focusing on creating a shared Vue component from duplicate code and refactoring tests. Despite some successful implementations, ChatGPT struggled to address specific issues, such as incorrect test results due to parameter inversion, highlighting its limitations in contextual problem-solving. The experience demonstrated that while ChatGPT can aid in certain tasks, understanding the code is crucial, and it functions best as a supportive tool rather than a replacement for human contributors. GitLab views ChatGPT and similar AI tools as potential enhancers of community efficiency, aligning with their open-source strategy and reliance on a global contributor network.

GitLab is set to launch a new Web IDE experience built on top of the open-source VS Code project, aimed at simplifying contributions from both developers and non-developers without the need for a local development environment. The Web IDE Beta, available from December 19, 2022, promises enhanced performance, user-friendly features, and the ability to connect securely to remote development environments, integrating interactive terminal access directly within the IDE. This new version offers a customizable interface, improved memory usage, and better touchscreen support, along with features like contextual actions and an interactive document outline. Self-managed users will receive the update in GitLab 15.7, with a feature flag for activation. The beta phase will run until the planned release of GitLab 16.0 in May 2023, and users can switch between the new and previous IDE versions. GitLab seeks feedback to refine the IDE, with plans to add VS Code extensions and project-wide search, marking the beta as a step towards their broader Remote Development initiative.

Hurl is an open-source tool developed by Orange that simplifies HTTP testing by using libcurl from curl, enabling users to describe HTTP requests in a plain text configuration format. It is designed to tackle complex HTTP testing challenges, allowing users to chain requests, capture values, and evaluate queries on headers and body responses for both XML and JSON APIs. Hurl can be integrated into CI/CD workflows, facilitating automated testing and monitoring of websites and APIs, while also supporting JUnit report formats for better integration into DevSecOps platforms. It offers a user-friendly way to perform HTTP sessions and web application tests, although it doesn't support dynamic JavaScript-rendered content. Hurl facilitates efficient DevOps practices by providing an easy method to verify that HTTP endpoints return the expected responses, making it ideal for both simple monitoring tasks and complex end-to-end testing pipelines.

On January 12, 2023, GitLab will update the default container image used on GitLab SaaS Runners on Linux from Ruby 2.5, which has reached its end of life, to Ruby 3.1, with no impact expected for those who have specified a custom container image in their CI/CD job configurations. Users can verify the container image used by checking the CI job log, and those without a specified image will automatically transition to Ruby 3.1. To proactively address any potential compatibility issues, users are advised to configure their jobs to run in a Ruby 3.1 container by updating their .gitlab-ci.yml files. Additionally, GitLab plans to implement a new maintenance process for container images to ensure they contain the latest security updates, though users are cautioned that the details of future products, features, and timelines are subject to change at the discretion of GitLab Inc.

Automation is increasingly recognized as a crucial component in the DevOps and DevSecOps workflows, offering significant advantages such as reduced human error, enhanced consistency, and streamlined processes. A GitLab survey highlights that over 82% of respondents view automation as vital for faster and safer software releases, with many teams reporting fully automated testing. Leveraging a comprehensive DevSecOps platform, rather than a DIY toolchain, provides benefits like improved visibility, collaboration, and integrated security checks throughout the software lifecycle. Automated processes such as continuous integration, continuous delivery, and monitoring further enhance efficiency by minimizing repetitive tasks and ensuring consistent, reliable deployments. This shift towards automation not only accelerates the development cycle but also maximizes returns by facilitating the rapid rollout of high-quality features while maintaining compliance and configuration management.

As 2022 concludes, a compilation of the year's top 10 technical blog posts from GitLab offers insights into various aspects of software development and DevOps practices. Highlights include troubleshooting GitLab pipeline failures with advice from Brendan O'Leary, using Git Rebase effectively as discussed by Christian Couder, and addressing alert fatigue and 502 errors in GitLab Pages logs, explored by Steve Azzopardi. Fabio Pittino addresses CI/CD complexity through the use of parent-child and multi-project pipelines, while Johan Carlsson shares his journey into hacking and bug bounties. Brendan O'Leary demonstrates the feasibility of running GitLab on an M1 iPad using GitPod, and a guide is provided for applying DevOps principles to database change management. Michael Friedrich delves into Infrastructure as Code security, Viktor Nagy provides a comprehensive tutorial on GitOps with GitLab, and Fatima Sarah Khalid reviews static site generators to optimize GitLab Pages use. Each post offers practical tips, expert insights, and how-to guides for developers and DevOps professionals looking to enhance their workflows and technical skills.

GitLab has integrated its platform into the command-line interface (CLI) by adopting the open-source project glab, enhancing developer workflows by allowing them to interact with GitLab directly from their terminals. This integration builds on GitLab's commitment to open-source development and aims to improve efficiency for developers by enabling tasks like reviewing issues, creating branches, and managing merge requests without leaving the terminal. The project, initially started by Clement Sam, has seen contributions from over 80 developers and has been officially adopted by GitLab to provide long-term support and community collaboration. The transition involved adapting GitHub Actions to GitLab CI, ensuring security through a comprehensive review, and updating distribution methods, with significant contributions from both internal and external communities. GitLab plans to continue enhancing the CLI by addressing community feedback and exploring new feature possibilities, inviting collaboration and input from users to shape its future iterations.

Evolphin Software transitioned its remote, globally distributed team to a GitLab-based workflow to enhance the development and release process of the Evolphin Zoom Media Asset Management system, resulting in a 30% to 40% increase in release velocity. Previously reliant on Subversion, the company faced challenges with slow and complex branching and merging workflows, leading to extended release times. GitLab's open-source platform, with its user-friendly interface and capabilities for decentralized collaboration, enabled Evolphin to create a more agile development environment, allowing for rapid feature development and testing. The adoption of GitLab facilitated smoother, collaborative processes across R&D teams, yielding faster feature releases, regular security updates, and better integration with CI/CD platforms and AWS cloud deployments. This shift not only improved productivity but also helped Evolphin respond more effectively to customer demands in the fast-paced media asset management industry.

Earlier this year, GitLab's research team conducted a study involving 12 GitLab users to understand how they search for content and to improve the effectiveness of GitLab's search tools. The research revealed that many users were unaware of the search bar's existence and its capabilities, leading them to rely on alternative methods to find content. This feedback has informed GitLab's Global Search Product team about the need for enhancements, such as increasing the search bar's visual contrast to improve accessibility and providing users with hints about the types of content the search bar can locate. GitLab is now seeking community contributions to implement these changes, encouraging users to participate in the improvement process by following guidance provided in related blog posts and development guides.