March 2023 Summaries

GitLab is integrating AI and machine learning (AI/ML) into its DevSecOps platform, focusing on AI-assisted SQL generation to simplify data analysis for users who may not be proficient in SQL. By using natural language processing, AI models can now generate complex SQL queries from simple English queries, making data analytics more accessible and time-efficient for data analysts. This capability is being tested within GitLab's Product Analytics group, which aims to help users understand usage patterns through interactive dashboards. The initiative is part of a broader effort to infuse AI/ML into various stages of the software development lifecycle to enhance efficiency and effectiveness, with ongoing experiments and future plans being shared in a dedicated blog series. Interested users are invited to join a waitlist for these AI-generated features, although GitLab notes that details about upcoming products and features are subject to change.

GitLab's inaugural Contributor Days event, held in March as a fringe event to CfgMgmtCamp at FOSDEM, was designed to facilitate in-person collaboration among contributors and the GitLab team in an unconference-style setting. Initiated by the Contributor Success team, the event aimed to enhance the contributor experience by providing a platform for face-to-face interaction, live pairing sessions, and community engagement, which is typically achieved through virtual hackathons. The event attracted numerous contributors, who participated in activities such as code-pairing and working on curated issues, with the involvement of GitLab team members like Marco Zille and Raimund Hook. The event's success was highlighted by the enthusiastic participation, the sharing of ideas for future iterations, and the warm sense of community it fostered, aligning with the broader goal of strengthening ties within the GitLab community.

Product designers are drawn to the field by the promise of enhancing lives through design, but the evolving demands of the role can lead to burnout if not managed properly. At GitLab, and similar companies, product designers are responsible for crafting user experiences, contributing to business goals, and collaborating with stakeholders, which can create misconceptions about needing to overextend themselves. To avoid burnout, designers should manage their time and communication intentionally, establish realistic availability baselines, and assess the importance of tasks in alignment with personal and business goals. Transparent communication and the ability to say "no" when necessary can prevent overcommitment and maintain quality relationships with colleagues. By understanding personal motivations, being realistic about capacity, and communicating clearly, designers can maintain job satisfaction and effectiveness without succumbing to stress.

GitLab is enhancing its platform by integrating Product Analytics to enable developers to instrument applications, collect and process user engagement data, and gain insights for making informed decisions. This initiative is part of GitLab's DevSecOps lifecycle, aiming to facilitate developers in adding instrumentation to their applications and providing the necessary infrastructure to process and visualize data. The focus is initially on web applications built with JavaScript and Ruby on Rails, using open-source technologies like Snowplow, ClickHouse, Cube.dev, and ECharts for data handling. GitLab emphasizes user privacy, ensuring data control remains with the users and implementing opt-out signals to respect privacy preferences. Currently, GitLab is testing these capabilities internally and is open to feedback from users, planning to release the feature iteratively to existing customers while offering a collaborative environment for data analysis within GitLab projects.

In GitLab 16.0, the CI_PRE_CLONE_SCRIPT variable support in CI/CD workflows on GitLab SaaS Runners on Linux is being removed, necessitating a switch to the new pre_get_sources_script hook. The pre_clone_script was a pre-build script feature allowing custom logic execution before a GitLab Runner cloned the project repository, useful for tasks like cleaning build directories or retrieving necessary files. The new pre_get_sources_script offers a simpler, more visible method for executing scripts before the git clone and CI build scripts, ensuring immediate visibility into the script execution. To adapt, users should check their CI jobs for the CI_PRE_CLONE_SCRIPT variable and replace it with the pre_get_sources_script in the .gitlab-ci.yml file. On self-managed GitLab Runners, additional hooks like post_get_sources, pre_build, and post_build are available, with plans to add support for post_get_sources in the YAML syntax. The blog emphasizes that details are for informational purposes and subject to change at GitLab's discretion.

GitLab is integrating artificial intelligence (AI) and machine learning (ML) into its DevSecOps platform to enhance the software development lifecycle by offering AI-assisted code suggestions. These suggestions aim to improve coding efficiency by reducing errors, accelerating coding tasks, and facilitating better collaboration among developers. GitLab's AI-assisted code suggestions leverage ML techniques to propose syntax improvements, streamline code organization, and suggest more effective methods, which can lead to higher quality and more reliable software. The platform aims to increase developers' productivity, support continuous integration and deployment, and simplify the software development process, including in low-code/no-code environments. GitLab is currently offering these AI-assisted code suggestions to select Ultimate customers in a closed beta, with plans for a wider open beta in the future. The initiative is part of GitLab's broader effort to incorporate AI/ML into its platform, promising to provide significant competitive advantages in delivering software quickly and efficiently.

GitLab's CI/CD pipelines offer an efficient way to automate tasks, such as deploying to Google Kubernetes Engine and conducting security scans, and can also be utilized to run a Twitter bot using Twitter's API. By consolidating tooling with GitLab, users can manage their bots more easily, leveraging GitLab's Free, Premium, and Ultimate tiers for varying amounts of CI/CD run time. The process involves setting up a GitLab account, obtaining Twitter API credentials, and writing a Python script to interact with the Twitter API. The script, along with a CI/CD pipeline configuration, is created in GitLab's Web IDE. CI/CD variables are used to securely store API credentials, and once set, the pipeline can be executed to post tweets automatically. Users can further schedule the pipeline to run at regular intervals, transforming a simple bot into a tool capable of more complex tasks like sentiment analysis or AI-generated sentences, while illustrating the versatility of GitLab pipelines beyond just bot management.

GitLab has reworked its repository maintenance strategy to improve the efficiency of Gitaly, the service handling Git repositories, especially for large monorepositories. The previous approach relied on client-side heuristics to perform maintenance tasks, which were not optimal for repositories of varying sizes and types. The new strategy, inspired by Git's `git gc --auto` command, introduces a single RPC call, OptimizeRepository, that intelligently assesses the on-disk state of repositories to determine necessary maintenance actions. This change has significantly reduced CPU load and compute time by avoiding unnecessary optimizations and has enhanced visibility into repository states through Prometheus metrics. Initially rolled out for specific GitLab.com repositories, the strategy has demonstrated improved performance and is now default-enabled for all installations starting with GitLab 15.8, with further enhancements planned, such as multi-pack indices and automated housekeeping tasks.

GitLab is streamlining its communication about breaking changes by consolidating all relevant information into a single source of truth (SSoT) on the Deprecations page in its documentation, discontinuing the redundant breaking changes blog post. This page now provides the most current details on deprecations, removals, and breaking changes, and includes new features such as filtering by removal version and toggling only breaking changes. GitLab adheres to semantic versioning, limiting breaking changes to major releases while striving to minimize disruptions to users. The company is committed to improving communication around these changes and welcomes user feedback to enhance the Deprecations page further. Additionally, a Customer Success team dashboard offers comprehensive insights into all changes on gitlab.com, beyond just breaking changes.

Docker, Inc. initially announced the termination of Free Team organizations on Docker Hub, prompting users to upgrade to a paid plan by April 14, 2023, or risk having their images deleted after 30 days. This decision could have impacted open source organizations and users relying on Docker Hub for CI/CD pipelines, Kubernetes deployments, or demo environments. However, Docker later reversed this decision, opting to keep the Free Team plan and clarifying that images wouldn't be deleted, which was a relief to the community. Amidst these updates, the GitLab DevSecOps platform provided various tools and strategies to assess and mitigate any potential impacts on production environments. These include using GitLab's CI/CD pipelines to ensure software reliability, employing advanced search techniques to identify affected images, and implementing mitigation strategies such as using dependency proxies and custom container registries. Emphasizing the importance of maintaining reliable container registries and observability, the discussion also highlighted practices like container scanning for vulnerabilities and enforcing GitLab registry URLs in image tags to ensure security and compliance.

GitLab envisions a future where artificial intelligence (AI) and machine learning (ML) significantly enhance DevSecOps platforms, transforming software development into a streamlined, science-fiction-like experience. By integrating AI and ML capabilities, GitLab aims to improve productivity, accelerate delivery, enhance security, and boost quality assurance within its platform. The company has already introduced features such as Suggested Reviewers and Code Suggestions to automate and assist in the software development process, ensuring efficient and secure code reviews. GitLab is committed to protecting customer data by ensuring code suggestions operate within its platform without external data processing. Looking ahead, GitLab plans to expand AI capabilities across its platform, focusing on automating tasks, improving code security, and supporting AI/ML-backed applications, all while maintaining seamless integration for data science workflows. This initiative is part of an ongoing effort to leverage AI/ML in revolutionizing the software development lifecycle, with future updates to be shared in a dedicated blog series.

Many companies are increasingly incorporating standard code scanning processes into development workflows to identify and address security vulnerabilities before deployment, and GitLab's DevSecOps Platform facilitates this through security scans integrated into CI/CD pipelines. These scans, accessible across different GitLab license tiers, help detect issues like unauthorized access and data leaks. The platform offers a variety of scanners, including static application security testing (SAST), secret detection, and dependency scanning, which can be easily enabled by adding scan templates to the project's .gitlab-ci.yml file. The blog outlines the process of configuring these scans, using a Java application as an example, and emphasizes the importance of reviewing scan results to enhance software security. For GitLab Ultimate users, additional features like a baseline Vulnerability Report in the merge request widget are available to track vulnerabilities introduced by new code changes. The text also offers guidance on enforcing security scans and reviews for critical vulnerabilities and suggests further resources to deepen understanding of GitLab’s security tools and practices.

The National Security Agency (NSA) highlights the risks associated with using manually managed languages, such as C and C++, due to potential memory management issues that can lead to severe security vulnerabilities. These vulnerabilities, including memory leaks, buffer overflows, and segmentation faults, can be exploited by malicious actors, impacting both individual applications and broader network infrastructures. Microsoft and Google have reported significant percentages of their vulnerabilities were related to memory mismanagement, prompting the NSA to recommend using memory-safe languages like Python, Java, and Go, which handle memory allocation automatically. While it may not be feasible to eliminate manually managed languages completely, tools like GitLab's static application security testing (SAST) can help identify and address vulnerabilities early in the development process. GitLab provides a comprehensive suite of security tools, including dynamic application security testing (DAST), infrastructure as code (IaC) scanning, and dependency scanning, to safeguard applications at various stages. By employing these tools and strategies, organizations can manage vulnerabilities effectively and enhance their security posture, even if not all risks can be entirely eliminated.

GitLab has introduced customizable roles, addressing customer feedback that the existing static roles were insufficient for specific use cases, particularly regarding the Guest user role in private projects. To balance flexibility and security, GitLab's minimal viable change (MVC) allows Ultimate tier customers to create a custom "Guest+1" role, enabling Guest users to view code across projects, a feature previously limited to Self-Managed GitLab or public/internal projects. This update responds to Ultimate customers' needs for more valuable user roles, enhancing the utility of their subscription by offering more meaningful access privileges. The long-term vision includes a more comprehensive customization of roles, allowing users to toggle permissions to suit their needs without overwhelming complexity, by consolidating permissions into logical groups. This initiative reflects GitLab's commitment to iterative improvement and solving customer pain points, promising further enhancements in role customization.

Innovation and growth in retail can be challenging, especially when managing modern applications across multicloud environments. GitLab and Google Cloud offer a solution by providing a comprehensive DevSecOps platform that integrates with Google Cloud's Distributed Cloud Edge and Anthos container platform, enabling retailers to create, secure, and scale software efficiently. This collaboration offers retailers enterprise-class features like Agile planning, continuous integration, configuration management, and built-in security, which streamline the management of distributed, hybrid environments. Retailers benefit from the ability to deploy and manage applications seamlessly across various locations, with real-time data access and automatic resource scaling. GitLab's platform facilitates operational efficiencies by allowing developers to build, test, deploy, and secure applications while maintaining compliance and security standards. The use of GitLab's platform in conjunction with Google Cloud supports automated deployment at scale, enabling retailers to manage resources effectively and respond quickly to changes, ultimately increasing ROI and fostering growth and innovation.

Effective April 3, 2023, GitLab will increase the price of its Premium service from $19 to $29 per user per month, marking its first price hike in over five years, with existing customers receiving a transitional rate of $24 until April 2, 2024. This adjustment aligns with GitLab's growth into a comprehensive DevSecOps platform, having added over 400 features since February 2018 to improve cycle times, developer experience, and collaboration. Enhancements include ease of use with Auto DevOps, efficient pipeline execution, Agile planning tools, and advanced analytics to track software delivery efficiency. The platform also offers robust release controls, compliance frameworks, and improved performance and fault tolerance through features like GitLab Geo and Gitaly. The price change does not affect GitLab Ultimate customers or participants in community programs, and new customers can benefit from a limited-time discount. For further details, customers are advised to consult the FAQs or contact their GitLab sales representative.

GitLab has announced the expansion of its GitLab for Startups program, starting March 15, 2023, which aims to support startups by offering access to its comprehensive DevSecOps platform at a discounted rate, or potentially at no cost for the first year, depending on their funding level and duration in the program. This initiative is designed to help startups streamline development processes, reduce time to market, and enhance product quality by using a single application for the entire DevSecOps lifecycle, thus enabling them to focus on customer growth, revenue increase, and product differentiation. Qualifying startups backed by external funding are encouraged to apply starting from the specified date, with continued support through deep discounts in the second year, and further information can be found on the GitLab for Startups page or by reaching out via the provided contact email.

Amazon S3's Static Website Hosting feature enables users to host static websites directly from an S3 bucket, which can be enhanced by integrating with Amazon CloudFront for a cost-effective and scalable solution, especially popular for single-page applications. The detailed guide outlines the process of setting up an S3 bucket, configuring OpenID Connect (OIDC) in AWS, and deploying applications to S3 using a GitLab CI/CD pipeline. It includes prerequisites such as Node.js, Git, and AWS and GitLab accounts, and provides step-by-step instructions on configuring the S3 bucket, setting permissions, and deploying a React application. Additionally, the guide explains configuring OIDC for secure identity federation between GitLab and AWS, creating necessary permissions policies and roles, and setting up a CI/CD pipeline in GitLab to automate the build and deployment process using temporary AWS credentials. The guide concludes with testing the pipeline by making changes to the application and verifying deployment, offering a complete overview of creating a CI/CD pipeline that automatically deploys to Amazon S3 while emphasizing security with GitLab's built-in tools.