April 2023 Summaries

GitLab is exploring the integration of AI and machine learning into its DevSecOps platform, focusing on enhancing code review processes by utilizing generative AI and large language models to suggest relevant test coverage for changes proposed via merge requests. In a prototype led by Phil Hughes, AI was used to generate test coverage suggestions directly within the merge request interface, offering a new option to provide these suggestions in a sidebar. This initiative aims to bolster confidence in code quality by automatically detecting missing tests and reviewing proposed tests for comprehensiveness. While still experimental, GitLab is iterating on these AI/ML features to improve efficiency across the software development lifecycle, with plans to expand this capability across more tasks and continue sharing developments in an ongoing blog series. GitLab invites interested users to join a waitlist to access these AI-generated features, while emphasizing that information on upcoming products is subject to change.

GitLab's "AI/ML in DevSecOps" series explores the integration of AI and machine learning into its DevSecOps platform, aiming to enhance productivity and streamline operations. The series details various AI-powered features, such as AI-assisted code suggestions to improve coding efficiency, natural language processing for generating SQL queries, and tools for simplifying complex code comprehension. Additionally, the series highlights experiments with large language models for summarizing issue comments and merge requests, generating tests, and explaining security vulnerabilities. GitLab is also experimenting with AI chatbots to facilitate easier navigation of documentation and has integrated MLFlow for model tracking. The platform is expanding its AI capabilities across multiple development environments, including Visual Studio and JetBrains IDEs, while promoting its collaboration with Google Vertex AI for scalable AI deployments. Key features like GitLab Duo and self-managed Code Suggestions are being rolled out, showcasing GitLab's commitment to advancing AI/ML integration in DevSecOps.

GitLab is exploring the integration of artificial intelligence and machine learning into its DevSecOps platform, with a focus on enhancing the merge request process through AI-driven summaries. Merge requests, which are central to code collaboration in GitLab, often become complex and fall out of sync during review cycles. By leveraging AI, GitLab aims to provide relevant summaries of changes within merge requests, allowing reviewers and authors to focus on discussions rather than updating descriptions. A rapid prototype by Kerri Miller, a Staff Backend Engineer, introduced a feature using AI to summarize merge request changes, marking the beginning of GitLab's efforts to incorporate AI/ML capabilities into its platform. These efforts are part of a broader initiative to identify and alleviate time-consuming tasks in the software development lifecycle, with ongoing experiments and a call for user participation through a waitlist. The blog post emphasizes that the information shared is for informational purposes only, with developments subject to change at GitLab's discretion.

The 2023 Global DevSecOps Report highlights the importance of integrating security into the entire software development lifecycle, emphasizing that security is a shared responsibility among development, security, and operations teams. The report reveals an increasing reliance on AI-assisted workflows, with 65% of developers planning to use AI in testing within the next three years, indicating a significant shift in how organizations deliver value. It also notes the challenges of toolchain expansion, with security professionals using more tools than other teams, and warns of the unsustainable nature of this trend amid tightening budgets. The report advocates for a platform approach to DevSecOps, which fosters collaboration, reduces toolchain friction, and enhances efficiency without compromising security. Respondents identified security and efficiency as key benefits of adopting a DevSecOps platform, which allows teams to collaborate effectively, shorten cycle times, and improve vulnerability detection.

GitLab employs strategies like staging environments, feature flags, and canary testing to assess feature stability, alongside A/B testing for user reactions, but its fast-paced release cycles necessitate rapid prototyping and benchmarking. To support data-driven decision-making in its DevSecOps context, GitLab developed SourceWarp, a record-and-replay framework designed to test features before they reach staging or production. SourceWarp uses Git repositories to extract and replay relevant commit sequences, allowing for effective feature testing and benchmarking. In a case study on advanced vulnerability tracking, SourceWarp demonstrated a 30% improvement in vulnerability detection over traditional methods and increased deduplication effectiveness as code evolved. This automated and reproducible approach informed decisions on product integration, showcasing SourceWarp's value in enhancing CI/CD tools and DevSecOps platforms. SourceWarp is open-source and detailed in a research paper to be presented at the 4th ACM/IEEE International Conference on Automation of Software Test (AST 2023).

GitLab is exploring the integration of AI/ML into its DevSecOps platform, focusing on enhancing team efficiency through AI-driven features like comment summarization within GitLab issues. This initiative is part of an ongoing series that highlights efforts from GitLab's product, engineering, and UX teams to embed AI/ML into their platform. The company has developed a prototype that uses large language models (LLMs) to generate concise summaries of extensive comment threads, aiming to reduce the time spent by teams on reviewing issue comments and maintaining focus on key information. This experiment involves leveraging generative AI techniques and prompt engineering to create meaningful summaries and is part of a broader strategy to identify and alleviate time-consuming tasks across the software development lifecycle with AI-assisted features. GitLab is iterating on these capabilities and plans to extend them to other platform objects such as epics and merge requests, with ongoing demonstrations and a waitlist for interested users.

Starting in May, GitLab will implement rate limitations on the Projects List API for unauthenticated users, affecting GitLab.com from May 8 and self-managed GitLab from May 22, to maintain platform stability and reliability. The Projects List API, utilized by researchers, developers, and integrators, provides metadata about GitLab projects, and due to increased requests from anonymous users, the platform has experienced performance issues. The rate limit for unauthenticated users is set at 400 requests per 10 minutes per IP address on GitLab.com, with a "429 Too Many Requests" response for excess usage, while self-managed instances have customizable limits. Acknowledging potential inconvenience, GitLab suggests users requiring more frequent access create an account for higher limits and additional benefits.

GitLab is exploring the integration of AI and machine learning into its DevSecOps platform, with a particular focus on AI-assisted code explanations to help developers quickly understand unfamiliar or complex source code. This initiative is part of a broader series of blogs showcasing GitLab's efforts in harnessing AI/ML technologies. The company has developed a prototype that allows users to highlight and receive natural language explanations of code within the GitLab repository source code file viewer, a feature demonstrated by Denys Mishunov and Michael Le. Although currently experimental, GitLab aims to iterate on this feature and potentially extend it across various areas of its platform, such as merge requests and snippets. This work aligns with GitLab's broader goal of identifying and addressing time-consuming tasks in software development that could benefit from AI assistance. The blog emphasizes that information about upcoming products and features is subject to change and should not be used for purchasing or planning decisions.

GitLab's Contributor Success team has developed "community forks" as a new method to enhance the contribution experience for its wider community members, aiming to simplify and make the process more rewarding. This initiative addresses common challenges faced by contributors, such as needing to fork projects individually, limited collaboration options, and constraints on CI minutes and storage quotas, by creating a single, shared fork of GitLab projects available to everyone. The community forks, inspired by a similar approach from the Drupal project, allow both team and community members to collaborate directly on the same merge requests, thereby promoting efficiency and removing barriers like personal CI quotas and manual updates. The experiment, deemed successful due to positive feedback and lack of blocking issues, is transitioning to production, with plans to integrate community forks into GitLab's operations and documentation, automate their management using Terraform, and potentially redefine handling forks in the product. The team hopes this approach will become a standard practice in open-source projects and encourages others to experiment with this concept.

Starting with GitLab 16.0, the delayed deletion feature will be enabled by default for all GitLab Ultimate and Premium customers to prevent accidental deletions of projects and groups, which have been a frequent and costly issue. Previously, immediate deletion was the default, requiring manual activation of deletion protection, but now the option to delete immediately from the Admin Area will be removed, and delayed deletion will be the standard for both SaaS and self-managed users. Self-managed users can set a deletion delay period of 1 to 90 days, while SaaS users will have a fixed 7-day retention period. Despite this default setting, users can still perform immediate deletions through a two-step process in the project or group settings, with projects being renamed automatically during the pending deletion state to allow immediate recreation with the same name. Future updates will include automatic renaming for groups during deletion. The API will be updated to align with these changes, removing specific parameters and requiring double confirmation for deletions. Feedback on these changes is encouraged to enhance the safety and effectiveness of the deletion process.