June 2023 Summaries

GitLab 16 marks a significant advancement for the DevSecOps platform, integrating AI-powered features to enhance productivity, security, and observability across the software development lifecycle. The launch event showcased the introduction of GitLab Duo, a suite of enterprise-grade AI capabilities, which aims to improve workflow efficiency by 10 times, featuring tools like Code Suggestions and Explain this Vulnerability. GitLab's collaboration with Google Cloud emphasizes developing private and secure AI solutions, while GitLab Dedicated offers a single-tenant SaaS platform for clients with strict compliance needs. The platform includes Value Streams Dashboards and new Product Analytics, providing organizations with insights into software delivery efficiency and user feedback. CARFAX's experience with GitLab illustrates the practical benefits of these innovations, as they report increased productivity and a 20% rise in production deployments.

GitLab has integrated SecureFlag's vulnerability remediation training into its DevSecOps platform, enhancing developer-led security by providing practical, hands-on training for developers within a live environment. This integration helps organizations shift security concerns to the left in the software development lifecycle, allowing for better oversight and control of security measures. SecureFlag's labs offer developers real-time access to vulnerability information, facilitating a clear understanding and effective remediation of identified security issues. The training includes a comprehensive knowledge base with code examples and hands-on labs that simulate real development environments, supporting over 45 technologies with various difficulty levels and scenarios. This approach has proven effective in reducing the number of security retests by equipping developers with the skills to address vulnerabilities accurately on their first attempt. SecureFlag's integration into GitLab provides a seamless experience, enabling developers to access tailored training materials directly from GitLab's security scans, thereby reinforcing an organization's overall security posture and reducing remediation time.

Scammers have been impersonating GitLab and its team members to conduct a fake job scam targeting job seekers, where they deceptively demand payments for technology equipment after a fraudulent interview process. These scammers initially reach out via text messages, claiming to be GitLab recruiters, and conduct interviews through Microsoft Teams, contrary to GitLab's standard practice of using Zoom. They use fake email addresses ending in "gitlabinc.com" and request candidates to create Gmail accounts, which differs from GitLab's protocol of assigning official email addresses. The fake job offers come with poorly formatted documents and unusual requests, such as detailed personal information and upfront money for equipment, which GitLab does not solicit. Job seekers are advised to consult GitLab's Candidate Handbook for authentic application procedures and to be vigilant against signs of identity theft, with resources available for reporting scams and protecting themselves.

GitLab is actively incorporating AI/ML into its DevSecOps platform, aiming to enhance developer productivity through initiatives like extending code suggestions to more IDEs. The latest development is the availability of the GitLab for Visual Studio extension in beta, which supports GitLab Duo code suggestions for both SaaS and self-managed GitLab environments. Users can download the extension from the Visual Studio Marketplace, set it up following the provided instructions, and begin receiving inline code suggestions. Future plans include integration with JetBrains IDEs and a native option for Neovim, along with the development of a GitLab Language Server to standardize and accelerate IDE extensions, enabling broader access to GitLab Duo code suggestions. The company is also exploring AI-assisted features across the software development lifecycle to alleviate time-consuming tasks, with ongoing updates and community collaboration anticipated as part of its AI/ML in DevSecOps blog series.

The integration of cloud services and GitLab through GitOps has gained traction, with continuous integration and delivery (CI/CD) being commonly used for application deployment and Infrastructure as Code (IaC) tools like Terraform managing cloud environments. GitLab CI is central to these processes, but the rise in software supply chain attacks necessitates enhanced security measures, such as OpenID Connect (OIDC) authentication, which GitLab 15.7 supports through ID tokens. While traditional static key methods for integrating Google Cloud and GitLab CI pose security risks, OIDC offers solutions by eliminating the need for long-term key management and reducing leakage risks. To facilitate this, GitLab's Infrastructure Security Team has developed a Terraform module and CI template to simplify the secure integration of Google Cloud and GitLab CI, enabling temporary token issuance and proper management of service account usage. This tutorial outlines the steps for using the OIDC modules, including setting up Google Cloud service accounts, Workload Identity pools, and configuring GitLab CI pipelines, thus reinforcing security and usability for both internal and external applications.

CI/CD pipelines, integral to continuous integration and delivery processes, can range from simple to complex structures, with their efficiency hinging on rules that dictate execution conditions. This tutorial explores various types of pipelines, such as basic concurrent ones, advanced Directed Acyclic Graph (DAG) pipelines, and multi-project pipelines, demonstrating their application in scenarios like testing applications or deploying containers. It highlights the significance of CI/CD rules in managing job flows, offering control over job execution based on conditions like context, changes, or CI/CD variables. GitLab's CI/CD rules, such as rules:if, rules:changes, and rules:exists, allow for precise job execution control, ensuring tasks are performed under specific conditions, thereby enhancing developer productivity, security, and quality assurance. Moreover, the tutorial underscores the potential for automation within pipelines, exemplified by GitLab AutoDevOps, which automates the detection of technology stacks and job creation. It also introduces the concept of CI/CD Components, an experimental GitLab feature that facilitates the creation of reusable components to streamline pipeline construction.

GitLab's Value Stream Management (VSM) offers a comprehensive solution for optimizing the software delivery process by providing end-to-end visibility and actionable insights into the value stream, from ideation to production. By utilizing the GitLab Value Streams Dashboard, organizations can visualize and measure key metrics, identify bottlenecks, and pinpoint areas for improvement within their software development lifecycle (SDLC). The VSM methodology allows users to map out value streams, assess lead and cycle times, and focus on specific stages or projects to enhance efficiency and value delivery. By integrating DevSecOps into a single platform, GitLab ensures that decisions are data-driven and actionable, promoting consistency and collaboration among stakeholders. This approach enables faster and better software delivery, with the flexibility to customize features and streamline access to critical information.

GitLab 16.0 introduces Remote Development workspaces in beta, offering teams an innovative way to enhance software development efficiency through a cloud-based environment. This feature allows developers to streamline their workflow by creating workspaces directly from their GitLab account, utilizing a Web IDE based on Visual Studio Code. The guide provides detailed steps for setting up a workspace, including prerequisites like configuring a Kubernetes cluster and a GitLab agent, and utilizing a devfile for environment configuration. Once set up, developers can install dependencies, preview applications, make changes, and commit updates directly from the remote environment, all designed to reduce the complexity of local setups and boost productivity.

GitLab Duo is an innovative AI-powered enhancement to GitLab's DevSecOps Platform, designed to assist developers in code development, operations improvement, and software security by providing features like code suggestions, vulnerability explanations, and value stream forecasting. This dynamic tool aims to increase workflow efficiency by offering a broad range of AI capabilities, including planning refinement, security risk resolution, CI/CD pipeline management, and analytics charting, all while maintaining a customer-centric approach focused on privacy and intellectual property security. GitLab Duo's features enable developers to better understand and improve their code through natural language explanations and secure code writing, aligning teams with shared goals and improving collaboration. With GitLab 16, the platform seeks to enhance workflow efficiency by integrating AI across various personas, ultimately aiming for a tenfold improvement in efficiency and a reduction in tool sprawl, thereby empowering organizations to deploy secure software more swiftly.

Git 2.41, released on June 1, 2023, introduced several notable improvements contributed by GitLab's Git team, aimed at enhancing integration with GitLab services. A key update includes the addition of a machine-parseable output format for the git-fetch command, which improves efficiency in repository mirroring by allowing updates to multiple references in a single transaction. Another significant enhancement is a new option for reading Git attribute files directly from a repository's tree, eliminating the need for copying to a separate file and thus simplifying the process. Additionally, several bug fixes were implemented, such as a patch to address truncated commit-graph generation numbers that affected commit history performance, a solution for cleaning up stale lockfiles left by the git-receive-pack process to save server space, and fixes for geometric repacking issues involving alternate object databases, which improve the handling of forks and object deduplication. These updates collectively contribute to performance improvements and reduced complexity in GitLab's Git operations.

For over three decades, The Open Group has played a pivotal role in promoting open source technologies by establishing open technological standards to help businesses achieve their objectives. With around 900 member organizations, The Open Group recently joined the GitLab Open Source Partners community, which allows it to collaborate with other major open source projects and consortia to further enhance open source innovations. An interview with Vice President and CTO Andras Szakal and GitLab administrator David Diederich reveals how GitLab's CI/CD capabilities are instrumental in building scalable open source projects, utilizing its integrated analysis tools to deploy complex solutions efficiently. GitLab is central to The Open Group's digital transformation strategy, underscoring its partnership with GitLab Open Source Partners to shape the future of open source development.

GitLab is integrating AI and machine learning into its DevSecOps platform, beginning with the introduction of GitLab Code Suggestions, a feature that uses generative AI to suggest code in real-time for developers. Initially available in GitLab SaaS, this feature is now being extended to self-managed instances with the release of GitLab 16.1, allowing users of VS Code and GitLab's WebIDE to benefit from AI-generated code suggestions. To use Code Suggestions, a self-managed instance administrator must enable the feature, after which users can authenticate their IDEs to GitLab.com infrastructure to receive suggestions. GitLab emphasizes privacy, ensuring no customer code is visible or stored beyond what's necessary for generating suggestions. The company is committed to enhancing efficiency across the software development lifecycle by identifying tasks suited for AI assistance, with plans to continue developing and sharing these features as part of an ongoing blog series.

GitLab Dedicated, now generally available, is a fully managed, single-tenant SaaS deployment of GitLab's DevSecOps platform designed to meet stringent compliance needs such as data residency and isolation. It provides organizations with benefits like faster releases, enhanced security, and improved developer productivity without the overhead of managing infrastructure, as highlighted by GitLab's 2023 Global DevSecOps Survey. The platform supports deployment in over 30 regions, ensuring data residency compliance, and offers high availability, scalability, and enterprise-grade security through features like SAML-based authentication, IP allow lists, and data encryption. GitLab Dedicated also affords customers control over their data, allowing them to encrypt data with their own keys while maintaining full administrative access. Looking forward, GitLab plans to integrate AI capabilities such as Code Suggestions and Suggested Reviewers into GitLab Dedicated, ensuring compliance requirements remain uncompromised.

GitLab ensures the integrity of its Omnibus packages by using a GNU Privacy Guard (GPG) key to sign packages within CI pipelines, which is distinct from other keys used for repository metadata and GitLab Runner signing. The expiration of this Omnibus package signing key, initially set for July 1, 2023, has been extended to July 1, 2024, as part of GitLab's security policy to reduce risks associated with key compromise while minimizing disruption for users verifying package integrity. Users who perform signature verification need to update their package signing key copy, but those who do not verify signatures or have not configured their package managers to do so require no action to continue installing packages. Additional guidance on verifying package signatures can be found in the Omnibus documentation, and the updated public key is accessible via GPG keyservers or directly from GitLab's package distribution site. Users experiencing issues are encouraged to report them through the omnibus-gitlab issue tracker.

This tutorial outlines a method for managing multiple infrastructure environments using GitLab CI and Terraform, focusing on a setup that includes dev, staging, and production environments. It explains the importance of utilizing separate environments for developing, testing, and deploying changes, ensuring rigorous testing before changes reach production. Each environment is organized with its own folder containing Terraform configuration and an environment-specific GitLab CI file, which only triggers jobs when changes occur in that specific folder. A helper file, `helper.yml`, is used to maintain consistency and reduce redundancy across environment-specific configurations by extending common jobs like formatting, validation, building, testing, deploying, and cleanup stages. The root-level GitLab CI file ties these configurations together, defining stages and container images. This setup allows changes to be safely promoted through environments via merge requests, ensuring that all modifications are reviewed and approved, and maintaining stability in the production environment.

On June 14, 2022, GitLab updated its Privacy Policy to enhance clarity around its data processing activities and align with the evolving privacy landscape. These updates include specific clarifications on processing activities for each GitLab product, details on when personal data may be collected for identity verification to enable certain features, and information about data collection for licensing and subscription maintenance. The policy now includes insights into Service Usage data collection, Event Analytics, Call Recordings, and the purposes of personal data collection, alongside updates on the legal basis for processing data in the European Union and data retention practices for inactive accounts. Additionally, GitLab has clarified how users can delete personal data, especially for public projects, and provided a notice detailing processing rights under the California Consumer Privacy Act, including CCPA metrics reporting. These changes aim to empower users to make informed decisions about their personal data, and the full text of the updated Privacy and Cookie Policies is available for further details on GitLab's data processing practices and user rights.

GitLab Mobile DevOps offers Android developers a streamlined way to automate their CI/CD pipeline, addressing common challenges such as Google Play access and code signing. The process begins with setting up necessary tools, including a Google Play developer account, Ruby, and Android Studio, followed by installing and initializing fastlane for the project. Developers are guided through creating a keystore for code signing, configuring Gradle, and securely uploading keystore files to GitLab. The setup involves creating a CI/CD pipeline using a .gitlab-ci.yml file and a customizable fastlane/Fastfile, facilitating the test, build, and beta release processes. Integration with Google Play is achieved by setting up a Google service account and enabling Google Play integration in GitLab, allowing for the manual triggering of beta releases. Once these configurations are committed and pushed, the CI/CD pipeline initiates, running the specified jobs on GitLab Runners.

Modern applications rely heavily on databases, cloud services, APIs, and other external services, necessitating the use of sensitive credentials like private keys and API tokens, which must be kept secure to prevent misuse. GitLab is enhancing its security measures for Ultimate users through a partnership with Google Cloud, focusing on detecting and responding to leaked secrets in code. GitLab Secret Detection, now integrated with Google Cloud, offers automated protection for Google Cloud users when sensitive credentials are found in public GitLab projects, automatically mitigating potential damage by collaborating with Google Cloud to secure the affected accounts. This integration is specifically available for GitLab.com users and is part of GitLab's broader effort to embed security throughout the software development lifecycle, aligning with findings from their 2023 Security Without Sacrifices report, which underscores the importance of security in DevSecOps platforms. GitLab's initiative includes support for multiple cloud platforms, with plans for further integrations, reinforcing their commitment to enhancing security and governance solutions for applications across different environments.

GitLab's navigation redesign focused on enhancing accessibility for users who rely on assistive technologies, such as screen readers, by conducting early and frequent reviews of accessibility elements. The team employed techniques like mapping the navigation accessibility tree and using HTML prototypes with ARIA attributes to ensure an intuitive experience. Automated tools like aXe DevTools and manual testing with various screen readers and browsers were used to identify and address Web Content Accessibility Guidelines (WCAG) violations, leading to improvements such as the implementation of "aria-expanded" and "aria-current" attributes for better screen reader interaction. The redesign faced challenges, such as handling interactive content when navigation is collapsed, eventually resolved by leveraging the inert HTML attribute with modern browser support. Through iterative improvements and collaboration with browser vendors, the team achieved a more consistent and familiar navigation experience while remaining committed to ongoing accessibility enhancements and inviting user feedback for future iterations.

GitLab Value Stream Management and its Value Streams Dashboard offer a comprehensive toolset for organizations to visualize, manage, and optimize their DevSecOps workstreams, allowing for data-driven decision-making and tangible improvements in digital transformation initiatives. The customizable dashboard provides a centralized source of truth, facilitating the tracking of key metrics like DORA, value stream lifecycle, and vulnerabilities metrics, while enabling users to drill down into detailed reports for actionable insights. The platform's intuitive interface and adaptability to organizational-specific processes enhance productivity by reducing the learning curve and supporting continuous improvement in software delivery workflows. As GitLab continues to develop the Value Streams Dashboard, planned features aim to further enhance decision-making and operational efficiencies, with future updates including executive-level summaries and advanced filtering options. The roadmap indicates ongoing enhancements to maximize the platform's utility, underscoring GitLab's commitment to evolving its offerings based on user feedback and industry needs.

GitLab is integrating AI and machine learning into its DevSecOps platform, allowing development teams to efficiently deploy AI/ML-related code with an emphasis on security and efficiency. In partnership with Google, GitLab facilitates the deployment of generative AI on Google Cloud, as demonstrated through a tutorial on using GitLab and Google Cloud's Vertex AI to deploy a Python-based credit card fraud detection model. The process involves data preprocessing with the Synthetic Minority Over-sampling Technique (SMOTE) to balance datasets, training a RandomForestClassifier model, and deploying it using GitLab's CI/CD capabilities. The model is stored in Google Cloud Storage and deployed on Vertex AI, where an API endpoint is created for predictions. This integration underscores the synergy between GitLab's DevSecOps tools and Vertex AI's scalable machine learning platform to enable rapid, secure AI deployments.

In an era where rapid software release is crucial for staying competitive, organizations are increasingly focusing on strategies that enhance their development processes. The 2023 Global DevSecOps Survey reveals key practices that contribute to faster software deployment, including cloud adoption, BizDevOps, CI/CD, and tracking development metrics like DORA. Organizations utilizing the cloud for at least half of their applications are significantly more likely to deploy multiple times daily, while those practicing BizDevOps and CI/CD also show marked improvements in release speed and efficiency. Despite these advancements, challenges such as the complexity of cloud environments, the need for secure coding, and management's lack of understanding of CI/CD persist. The report emphasizes the importance of investing in tools that integrate CI/CD with other DevSecOps practices and highlights the role of tracking metrics to signal their importance and improve development outcomes. Additionally, it explores the impact of developer onboarding times and talent acquisition on productivity, offering insights into practices that enhance organizational success in software development.

Creating an automated CI/CD pipeline for an Apple iOS application using GitLab and fastlane can streamline the complex processes of configuring build environments, managing code signing, and integrating with the Apple App Store. GitLab Mobile DevOps offers a suite of features to address these challenges, enabling developers to set up an efficient pipeline. The process involves installing fastlane, configuring it to manage code signing through fastlane Match, and integrating with the Apple App Store Connect by creating an API key. Sample Fastfile configurations are used to define build and release actions, while a .gitlab-ci.yml file ties these configurations into GitLab CI, facilitating automated builds and deployments. The build lane focuses on development builds, while the beta lane handles app store releases, including uploading to Test Flight. This setup aims to reduce time and errors in the deployment process, allowing mobile teams to focus more on development and less on manual configurations.

GitLab has been recognized as a Leader in the 2023 Gartner Magic Quadrant for DevOps Platforms, marking a significant achievement for the company and the DevOps industry. Positioned highest on the Ability to Execute axis, GitLab's comprehensive suite of solutions integrates development, security, and operations teams on a unified platform, eliminating the need for disparate tools and a 'Do it Yourself' approach. The platform enhances developer productivity and operational efficiency by embedding security throughout the software lifecycle and automating policy enforcement, compliance, and security testing. GitLab's AI-powered DevSecOps platform further drives innovation with open core contributions, providing insights through value stream management and DORA metrics to optimize software delivery processes. This recognition underscores GitLab's role in maturing the DevOps Platform category and supporting mainstream technology adoption, while maintaining a focus on customer empowerment and digital transformation.

Demand for integrated software delivery platforms is on the rise as organizations seek to overcome the challenges of disjointed solutions, siloed operations, and cybersecurity risks. GitLab's DevSecOps Platform has been recognized as the sole leader in The Forrester Wave: Integrated Software Delivery Platforms, Q2 2023. The report, which evaluated 13 vendors based on 26 criteria, highlights GitLab's strengths in security tool integration, automation, roadmap, community involvement, and pricing transparency. GitLab's platform, designed as a single application with a unified data store, enhances efficiency, collaboration, and security across the software delivery lifecycle. It integrates artificial intelligence (AI) and offers robust governance and security features, making it an attractive option for enterprises aiming to consolidate their toolchains. Trusted by over 30 million users, including more than half of the Fortune 100 companies, GitLab continues to innovate by incorporating transformative technologies, such as AI and enhanced supply chain security, to accelerate and secure software development and delivery.

Achievements have emerged as an effective tool for gamification across various sectors, including social media and education, and are now being leveraged by GitLab to enhance user engagement and productivity. This new feature enables organizations to recognize and reward GitLab users for their contributions through custom achievements, which can be created, awarded, or revoked by namespace maintainers or owners. Previously, GitLab offered forms of recognition such as hackathon leaderboards and swag but lacked a centralized system for achievements. The introduction of this feature aims to foster a culture of continuous learning and skill development, motivating employees by acknowledging their efforts and potentially leading to a more skilled workforce. By implementing achievements, organizations may see benefits such as increased innovation and improved competitive advantage, with the system available for both SaaS and self-hosted GitLab users.

GitLab is enhancing its DevSecOps platform by integrating AI and machine learning to boost developer productivity, focusing on experimental support for Code Suggestions across various development environments such as Visual Studio, JetBrains IDEs, and Neovim. These experiments, led by different engineers, aim to provide real-time code suggestions using extensions and plugins tailored to each environment, allowing developers to accelerate their coding efforts. GitLab is iterating on these integrations to refine the user experience and expand support to additional editors, signaling a broader initiative to embed AI/ML into the software development lifecycle. The company is actively seeking feedback from users to improve these features and is inviting interested parties to join a waitlist for updates on AI/ML advancements in their DevSecOps series, while noting that the information is subject to change as part of their ongoing development process.

Understanding the time spent during the development lifecycle is essential for software leaders to optimize value delivery to customers, and the new Value Stream Analytics Total Time Chart in GitLab provides a visualization to aid this process. This tool allows managers to track the entire development process from idea to production, revealing the time spent in each workflow stage. Integrated into GitLab, Value Stream Analytics uses a unified data model to aggregate stage-level data, breaking it down into container objects, event pairs, and stage events. The Total Time Chart utilizes a stacked area chart to illustrate each stage's contribution to the overall development time, providing insights into how these contributions change over time. The chart's interactive features, such as tooltips and stage breakdowns, enhance understanding by sorting stages in order and offering detailed views of stream performance metrics. It also supports a top-down optimization flow, allowing users to drill down into project performance or view organization-level metrics. While the chart is limited to completed items within a selected date range, it provides valuable insights into workstream progress and potential areas for improvement by highlighting gaps with a dashed line and flat stage lines when no data is available.