June 2024 Summaries

GitLab's new AI-powered DevSecOps platform, GitLab Duo Workflow, represents a significant advancement in the automation of software development processes, aiming to transform how teams build, secure, deploy, and monitor software. By acting as an autonomous AI agent, it leverages GitLab's unified data store to seamlessly connect relevant data and projects, enabling the Workflow to actively contribute to various stages of the software lifecycle. The Workflow is designed to handle repetitive tasks, optimize applications for performance, automatically identify and resolve vulnerabilities, and streamline onboarding by creating customized remote development environments. It also focuses on automating development, ensuring continuous improvement, enhancing security and compliance, and self-optimizing performance through sophisticated feedback loops. This platform is positioned as a tool to empower developers to concentrate on high-level problem-solving and innovation, while AI manages the background tasks, with the ultimate goal of creating a new generation of AI-driven applications that are both efficient and secure.

GitLab has introduced "GitLab Dedicated for Government," a FedRAMP-compliant DevSecOps solution tailored for public sector organizations and highly regulated industries to facilitate secure cloud-based software development. This offering is a single-tenant SaaS platform that emphasizes data residency, isolation, and private networking, ensuring compliance with stringent security requirements. GitLab's achievement of the "In Process" designation for FedRAMP Moderate Impact Level highlights its commitment to meeting rigorous cloud security standards. As more organizations transition from legacy systems to scalable cloud infrastructure, the demand for secure and efficient solutions like GitLab Dedicated for Government grows, addressing the complexities of compliance and toolchain management. This platform aligns with the Cybersecurity and Infrastructure Security Agency's Secure by Design principles and is designed to consolidate toolchains, enhance data protection, and reduce operational complexities. By offering a managed and hosted service, GitLab provides an integrated DevSecOps environment that prioritizes security, efficiency, and cost-effectiveness, ensuring a quicker realization of value without the burden of self-managing infrastructure.

Secret Push Protection, now available for GitLab Ultimate and GitLab Dedicated customers, aims to prevent sensitive information like keys and API tokens from being pushed to GitLab, thereby reducing the risk of data breaches. This feature checks each commit for high-confidence secrets and blocks pushes if any are detected, thus minimizing the need for time-consuming secret rotations. While traditionally, GitLab relied on Pipeline Secret Detection to identify secrets post-commit, Secret Push Protection offers a proactive approach by preventing leaks at the source. This new feature can be enabled per project and is designed to work in tandem with existing detection methods to maximize security coverage. Users can manage exclusions and audit events to streamline workflows and ensure adherence to security protocols. GitLab has integrated this feature into its operations, gaining insights to refine its functionality further. Customers are encouraged to provide feedback to enhance the tool's effectiveness in safeguarding their software development lifecycle.

GitLab Value Stream Management (VSM) is an essential tool for optimizing software development processes by offering a comprehensive overview of the software delivery lifecycle, enabling teams to enhance workflow efficiency and reduce waste. The introduction of Scheduled Reports Generation further streamlines this process by automating the creation and distribution of detailed reports, providing managers with consistent monitoring and up-to-date metrics without manual intervention. This automation aids in data-driven decision-making and saves time, allowing managers to focus on strategic initiatives. VSM also incorporates AI Impact Analytics to evaluate the productivity improvements brought by GitLab Duo, enhancing developer efficiency in DevSecOps workflows. The Value Streams Dashboard is central to this process, tracking key metrics, assessing process improvements, and helping teams compare best practices to deliver customer value more swiftly.

GitLab has enhanced its Kubernetes integration to provide real-time insights into deployment statuses and troubleshooting capabilities through the use of the Watch API and WebSocket connections. This integration features a dedicated dashboard that visualizes Kubernetes resources like pods and services, offering detailed information on their statuses and facilitating debugging. The GitLab agent for Kubernetes establishes a secure connection between GitLab and Kubernetes clusters, enabling efficient data streaming and event management via the WatchApi class. This class extends Kubernetes API functionality to manage real-time data streams and event categorization, while the introduction of WebSocketWatchManager addresses limitations of traditional streams by aggregating multiple resource watches within a single connection. Users can manage Kubernetes resources from the GitLab interface, with the system automatically switching between WebSocket and Watch API methods for consistent real-time updates. The dashboard's evolution continues, with opportunities for enhancements in error handling and dynamic watch management, inviting user feedback and participation in its development.

GitLab is enhancing its Agile planning capabilities by introducing a new Work Items framework to unify and improve the experience of using issues and epics, addressing the inconsistencies and lack of flexibility in the current system. This framework aims to provide a consistent, user-friendly, and flexible Agile planning experience by supporting both existing and new types of planning objects. The upcoming changes will include a refreshed look and additional features for epics, such as assignees and health status, while maintaining compatibility with existing data and APIs. Over the next few months, GitLab plans to release features like custom fields and configurable statuses to further streamline planning workflows, along with updates to lists, boards, and roadmaps to enhance data visualization. The Work Items framework is designed to protect users from disruptions while allowing GitLab to deliver incremental value and gather feedback through tasks, which have already seen significant adoption. These enhancements are part of GitLab's commitment to evolving with their customers' needs and providing innovative solutions for Agile planning.

Ally Financial has awarded GitLab the Ally Technology Partner Award for Operational Excellence, highlighting the essential role GitLab and its DevSecOps platform play in Ally's operations and customer solutions. The award acknowledges GitLab's contribution to ensuring the resiliency of Ally's products and its commitment to operational support. GitLab has enabled Ally to adopt DevSecOps principles across numerous applications, facilitating thousands of daily builds and streamlined production deployments. Spencer Cremers, Ally's CIO of Enterprise Technology Operations, praised GitLab for its support and for helping explore virtualized development environments and security tools to enhance efficiency and security in the software development lifecycle. This is GitLab's second consecutive year receiving an award from Ally, having previously been recognized for "Velocity with Quality" in 2023, which highlighted its speed, responsiveness, and contribution to a 55% increase in deployment velocity and $300,000 in yearly cost savings.

GitLab is enhancing its platform to address the challenges faced by development and operations teams in managing application performance and resolving defects, which can have significant financial impacts on businesses. By integrating software delivery and monitoring functionalities, GitLab aims to reduce issues related to siloed data and fragmented communication. The company has introduced several features, including Error Tracking and the Beta release of Distributed Tracing, as part of its comprehensive observability offering. Distributed Tracing allows engineers to track and analyze user requests across complex systems, especially in microservices architectures, helping identify performance bottlenecks more efficiently. This feature is expected to improve transparency and collaboration between development and operations by providing insights into application performance in production environments. GitLab also leverages OpenTelemetry for data collection and uses a scalable storage solution with ClickHouse and Kubernetes to manage real-time analytics, aiming to enhance pipeline efficiency and minimize context switching. The company plans to expand its observability and monitoring features further, inviting users to participate in its private Beta program to refine these tools.

Bol, a leading online retailer in the Netherlands and Belgium, utilizes GitLab Ultimate to enhance its development efficiency and compliance adherence, crucial for managing its vast product range and customer base. By adopting GitLab's DevSecOps platform, Bol automates compliance checks, saving thousands of manual hours for its 850 developers, allowing them to focus on creating secure software. This automation helps the company adapt to evolving regulations, such as GDPR and the EU AI Act, while maintaining customer trust by ensuring data security. Bol shifts security left, empowering developers to address vulnerabilities early in the development process, and plans to incorporate more GitLab features, including AI and cloud integration, to further streamline its operations and enhance the developer experience.

GitLab Duo is a suite of AI-powered features designed to enhance DevSecOps workflows by providing predictive code completion, function logic definition, test generation, and common code proposals directly within the coding environment. To efficiently utilize GitLab Duo, developers are encouraged to practice and learn collaboratively by using it for everyday coding challenges, which can improve the developer experience by facilitating quicker adaptation to new programming languages and projects. The tutorial highlights how GitLab Duo Code Suggestions can be paired with other AI features for increased efficiency, offering best practices such as starting with simple prompts, practicing regularly, and using comments for context to generate better suggestions. It emphasizes the importance of combining GitLab Duo's Chat feature for build configuration generation, vulnerability explanation, and code refactoring, while also noting the role of automated workflows in ensuring code quality and security. The guide encourages developers to contribute to open-source projects using GitLab Duo, fostering a collaborative and continuous learning environment, and suggests taking advantage of all GitLab Duo features for improved development workflows on the platform.

The detailed exposition highlights the integration of GitLab webhooks with Twilio to set up automated SMS alerts, facilitating rapid response to issues in a DevSecOps environment. It walks through the process of configuring Twilio to send SMS messages triggered by specific events in GitLab, such as issue creation or updates, thereby ensuring that the right personnel are promptly informed. The setup process involves acquiring a Twilio account with suitable phone numbers, setting up Twilio Functions to process event data, and configuring GitLab webhooks to trigger these functions. The article emphasizes the adaptability of this system, suggesting expansions to notify multiple recipients, handle various event types, and configure settings at a group level. It also discusses the potential for hosting message generation on a personal server using Twilio's Server Side SDKs for enhanced integration with existing systems.

Generative AI is revolutionizing software development by simplifying the processes of development, security, and operation, as exemplified by GitLab Duo's new AI-powered Root Cause Analysis feature. This feature aids DevSecOps teams in identifying and addressing failures in CI/CD pipelines by analyzing logs, offering a more efficient alternative to traditional manual troubleshooting. The AI system pinpoints errors such as missing dependencies or runtime issues, significantly reducing the time and expertise required to resolve pipeline failures, and helps ensure faster, more secure software releases. GitLab Duo Root Cause Analysis is designed to operate within the GitLab interface, utilizing AI to summarize, analyze, and propose solutions to pipeline problems, a task well-suited to AI due to the complexity and unstructured nature of log data. This innovation also offers the potential for further development, allowing users to ask follow-up questions and explore alternative solutions through GitLab Duo Chat, thus enhancing the software development process with AI-driven insights and efficiency.

Secure by Design, introduced by the Cybersecurity and Infrastructure Security Agency (CISA), emphasizes integrating security principles throughout the software development process to mitigate cyber threats. GitLab 17 exemplifies this approach by enhancing secure coding practices, managing vulnerabilities at scale, transitioning to memory-safe languages with AI, and aligning deployment strategies with zero trust architecture. By incorporating advanced features like Static Application Security Testing (SAST), vulnerability insights, AI-powered code assistance, and customizable security policies, GitLab aims to uphold CISA's Secure by Design principles. This commitment is further solidified by GitLab's participation in CISA's Secure by Design Pledge, demonstrating a proactive stance in fostering a security-centric culture and leveraging AI to enhance software development processes.

GitLab Support is implementing a new policy starting August 1, 2024, requiring users to sign in to raise support tickets, building on last year's changes that required pre-listing support contacts. This change aims to enhance customer service by allowing GitLab Support to pre-fill organizational details in tickets and tailor support experiences based on the customer's purchased products. The new process will streamline problem identification by focusing on relevant issues for the specific products customers own, improving overall efficiency. After a customer's initial purchase, they must create a login at support.gitlab.com and open a ticket to manage support contacts. Existing customers will only need to sign in to access support, and those who have forgotten their passwords can reset them via a provided link.

The author shares an insightful journey into building GitLab CI/CD components, drawing parallels with their father's tool-making skills as a mechanic. Over the past four years, they have developed includable, shared templates for GitLab CI/CD, evolving into a formalized approach through the GitLab CI/CD Catalog, which allows global publishing and usage of CI/CD components. The catalog introduces independent component versions, enhancing stability and flexibility, a crucial aspect of DevSecOps. The author highlights various components, such as security scanners and automation tools, emphasizing best practices like pegging container tags and expanding configuration documentation. They also focus on promoting discoverability and usability by employing consistent tagging and repository topics, aiming to make their components accessible and beneficial for others. The narrative underscores the importance of integrating personal lessons with established best practices to create robust and user-friendly CI/CD solutions.

GitLab is integrating AI deeply into its DevSecOps workflows by focusing on continuous analysis, performance validation, and functional readiness to ensure optimal performance of its AI suite, GitLab Duo. The GitLab Test Platform team developed an AI continuous analysis tool to automate data collection and analysis within the Visual Studio Code IDE, enabling efficient performance monitoring and improvement opportunities. This tool assesses metrics such as latency and user experience by automatically entering code prompts and recording AI suggestions, generating comprehensive reports for actionable insights. Performance validation involves testing GitLab components' interaction with AI services without relying heavily on third-party providers, while multi-regional latency tests ensure optimal request servicing. GitLab employs rigorous unit, integration, and end-to-end testing strategies, using both real and mock AI responses to maintain high-quality AI-driven features. Exploratory testing and internal usage (dogfooding) help identify edge cases and enhance the overall user experience. GitLab encourages organizations to leverage GitLab Duo for AI-powered workflows, offering a free trial to experience its benefits.

Generative AI is revolutionizing software development by simplifying the creation, security, and management of software, as explored in a blog series by product and engineering teams. The series provides insights into the development, testing, and deployment of AI features within GitLab Duo, offering DevSecOps teams improved outcomes. It highlights the evaluation and fine-tuning of large language models (LLMs), the introduction of an AI Impact analytics dashboard for measuring AI return on investment, and the integration of AI throughout the software development lifecycle. Additionally, it details methods for enhancing the security and reliability of AI-generated code and the blending of AI with Root Cause Analysis to fix CI/CD pipeline issues. Recent enhancements to GitLab Duo Chat are discussed, demonstrating how these updates improve workflow efficiency and productivity. The series concludes with a tutorial on using GitLab Duo to address security vulnerabilities, showcasing the AI-powered suite's capabilities in the DevSecOps workflow.