March 2025 Summaries

GitLab 18.0 plans to introduce event-level product usage data collection from GitLab Self-Managed and GitLab Dedicated instances, enhancing insights into DevSecOps practices while maintaining user privacy and control. This initiative aims to overcome the limitations of manual data extraction by providing automated and efficient access to detailed user interaction data, excluding GitLab Duo features. Event-level data, which is pseudonymized to protect user identities, tracks actions such as starting CI/CD pipelines or creating issues, offering granular insights that aggregated data cannot. These insights facilitate trend discovery, smarter product improvements, and custom recommendations, improving feature adoption and user experience. GitLab emphasizes transparency and user control by allowing early opt-out options, ensuring no use of third-party collectors, and offering comprehensive documentation. The rollout is accompanied by proactive communication to keep users informed, and while the information shared is subject to change, it is intended to align product development more closely with real-world customer needs.

GitLab provides an efficient solution for automating and securing the export of BigQuery data to Google Cloud Storage, transforming manual processes into streamlined, repeatable workflows that enhance security and save time. The integration utilizes GitLab CI/CD pipelines to automate the export process after storing and version-controlling SQL code within GitLab, executing it against BigQuery, and exporting results as CSV files to Google Cloud Storage. This process involves setting up necessary Google Cloud credentials in GitLab, creating SQL queries, and configuring a GitLab CI/CD pipeline with a few lines of YAML code to authenticate with Google Cloud, execute queries, and manage storage. The approach is designed to improve security through service accounts or Workload Identity Federation, ensure auditability via GitLab's version control and pipeline logs, and enhance repeatability and automation by reducing manual operations and human error. By leveraging GitLab's DevSecOps capabilities, this solution effectively addresses security concerns, permission issues, and manual operation inefficiencies, providing a robust framework for data publishing workflows.

Beginning April 1, 2025, Docker will enforce new pull rate limits on Docker Hub, potentially affecting CI/CD pipelines, including those on GitLab. Unauthenticated users will face a restriction of 100 pulls per six-hour window, which could lead to pipeline failures if limits are exceeded, particularly in environments where multiple users share IP addresses. GitLab users can mitigate these limitations by configuring Docker Hub authentication in their pipelines, using the GitLab Container Registry, or employing the GitLab Dependency Proxy with Docker Hub authentication to increase pull limits. GitLab is actively updating its infrastructure and documentation to support these changes, and encourages users to prepare ahead of the deadline to avoid disruptions. For organizations with significant Docker Hub usage, a paid subscription could offer a straightforward solution by providing unlimited pulls.

GitLab's Security Operations team has developed the User Attestation Module (UAM) as part of their automation strategy to allow security engineers to focus on high-impact tasks by automating routine alerts. The UAM enables team members to verify and respond to security alerts flagged by the GUARD framework, determining whether suspicious activities are authorized. This system records responses for audit purposes and either resolves the alert or escalates it to the Security Incident Response Team (SIRT) if needed. The module is integrated with Slack for direct communication and relies on various components like GitLab's API for user identification and Slack's API for user interaction. By streamlining alert handling, the UAM reduces alert fatigue, maintains an audit trail, and enhances the efficiency of security operations by creating an intermediate response tier for low-priority alerts. Its design principles focus on automation and participation, ensuring that alerts are processed efficiently and escalated appropriately, with comprehensive metrics logged for continuous improvement.

Compliance with the Payment Card Industry Data Security Standard (PCI DSS) is crucial for protecting cardholder data and is mandatory for enterprises dealing with credit card information. GitLab, recognized as a comprehensive AI-powered DevSecOps platform, offers tools to enhance security for customers handling PCI-related data. GitLab has successfully obtained a PCI DSS Attestation of Compliance (AoC) as a service provider following an independent assessment by a Qualified Security Assessor. This attestation reflects GitLab's commitment to security, innovation, and transparency in information security practices. For more information, GitLab's Trust Center and PCI compliance page provide insights into shared responsibilities and support for compliance efforts.

Git 2.49.0 introduces several updates and new features, with contributions from GitLab's Git team and the wider community. Notable highlights include the introduction of a new subcommand, git-backfill(1), and a path-walk API to improve performance when working with blobless partial clones. The release also incorporates zlib-ng, which offers performance improvements over the traditional zlib, and adds Rust bindings for libgit, enabling some Git functionalities to be accessed through Rust. The Meson build system sees further development, aiming to streamline build processes. Additionally, deprecated directories .git/branches/ and .git/remotes/ are slated for removal in Git 3.0. A new name-hashing algorithm, version 2, enhances packfile efficiency by reducing the impact of parent directories. The update also advances the promisor remote capability, allowing servers to direct clients to alternative sources for downloading large files, and introduces a --revision option for git-clone(1), enabling thin clones of specific revisions, which is particularly useful for automated testing.

The "Getting started with GitLab" series introduces newcomers to the GitLab DevSecOps platform by exploring the gitlab-triage gem, a Ruby library that automates Agile workflows by creating bots to perform tasks like labeling, commenting, assigning, and closing issues and merge requests. By automating these repetitive tasks, teams can ensure consistency, improve response times, and boost productivity, allowing them to focus on software development. The post guides users through setting up their own triage bots, obtaining GitLab API tokens, and defining triage policies using a configuration file. Advanced features include using regular expressions, custom actions, and summary policies to create complex workflows. Integration with GitLab CI/CD allows for scheduled automation, and best practices such as starting simple, testing thoroughly, and using descriptive names are recommended for effective implementation. The series encourages users to explore further resources and courses for deeper learning and offers a free trial of GitLab Ultimate for hands-on experience.

Development and security teams are frequently challenged by the overwhelming number of vulnerabilities they must manage, with many organizations addressing fewer than 16% of known vulnerabilities monthly. To efficiently prioritize which security flaws require immediate attention, three key frameworks are utilized: the Common Vulnerability Scoring System (CVSS), Known Exploited Vulnerabilities (KEV), and the Exploit Prediction Scoring System (EPSS). The GitLab 17.9 release incorporates these frameworks, allowing teams to strategically prioritize risks across dependency and container image vulnerabilities. CVSS provides a standardized severity rating, KEV focuses on real-world exploit intelligence, and EPSS predicts the likelihood of exploitation within the next 30 days. By integrating these frameworks, security teams can concentrate resources on vulnerabilities that present the most significant risk. GitLab enhances this process with built-in security scanning tools that can be integrated into CI/CD pipelines, generating a vulnerability report that consolidates findings and facilitates informed decision-making. GitLab also offers AI capabilities to assist in explaining and resolving vulnerabilities, further streamlining the vulnerability management process.

GitLab's "Beautifying our UI" initiative strategically pairs product designers with frontend engineers to autonomously enhance the platform's usability and aesthetics. In this iteration, the focus was on improving the continuous deployment area by extending the initiative over two milestones, allowing for more comprehensive planning and execution. Key improvements included redesigning the Environment List page for better deployment visibility, enhancing the deploy keys interface with a dedicated search function, and refining Kubernetes agent management to streamline user workflows. The initiative also involved engaging community contributions and strategic timing during slower periods, which facilitated deeper focus on improvements. These enhancements not only improved user experience but also strengthened collaboration between GitLab's Frontend and Design teams, fostering a more cohesive working environment.

In early 2024, a focus on implementing better metrics for GitLab's Red Team led to the development of the adoption rate metric, designed to measure how often security recommendations are accepted and executed, thereby linking the team's efforts to tangible security outcomes. Using GitLab, the team tracks this metric through a detailed process involving tagged recommendations and a dynamic Security Recommendations Dashboard powered by the GitLab Query Language. This approach helps the team maintain oversight of recommendations and visualize adoption trends over time. Lessons learned from this initiative highlight the importance of integrating metrics from the start, collaborating with other security teams to enhance effectiveness, and continuously refining processes to improve security outcomes. Additionally, GitLab plans to implement metrics on threat resilience to assess and enhance their ability to prevent, detect, and respond to relevant threats, with the aim of driving strategic decisions across their security division.

GitLab has launched the Open Source Security Center, a collection of security-focused projects developed by its internal security team to help developers and organizations build more secure software and robust security programs. As cyber threats become increasingly complex, the center emphasizes the importance of community-driven collaboration to enhance collective intelligence and defense capabilities. GitLab's commitment to open source, which is central to its identity, allows it to share tools, templates, and frameworks that promote faster adaptation and smarter responses to security challenges. The center features projects like StORM templates for risk management, the GUARD Framework for automation in detections, and the GitLab CIS Benchmark Scanner for improved security auditing. Inspired by industry leaders such as Crowdstrike and Palo Alto Networks, GitLab aims to empower the security community by fostering transparency and collaboration, inviting contributions from security engineers, researchers, and developers to make software safer for everyone.

As organizations rapidly integrate AI technologies, Chief Information Security Officers (CISOs) face new security challenges, prompting a reevaluation of traditional security frameworks. The GitLab AI Security Framework has been developed to guide security leaders in navigating secure AI-powered development, particularly through GitLab Duo. This framework addresses a range of AI-specific security concerns, including uncertainties in responsibility and control, evolving risk assessment models, data protection complexities, and compliance with emerging AI regulations. The rapid adoption of AI across various sectors reveals a fundamental shift in security approaches, necessitating innovative strategies to manage AI-related risks. GitLab's solution includes a responsibility matrix and AI-specific security risk assessments, alongside features like prompt guardrails, to enhance security while fostering innovation.

GitLab Pages offers a convenient and cost-effective solution for creating and hosting a personal or professional website using GitLab's free tier, providing built-in features like SSL certificates and a GitLab-provided domain. The process involves creating a project on GitLab, using a simple HTML/CSS template, and configuring a GitLab CI file to automate the build and deployment of the site. The platform supports easy customization and updates, making it suitable for showcasing personal brands or professional profiles without incurring high costs or requiring extensive technical knowledge. GitLab Pages also allows for automated deployment through its CI/CD capabilities, offering a clean, responsive template that can be personalized with user-specific content and images. Users can manage and troubleshoot their websites through a centralized dashboard that includes domain settings and HTTPS certificate statuses, with upcoming improvements aimed at simplifying domain management and custom domain setups.

The article provides a comprehensive guide on securely building and running containers within a development workspace by leveraging Kubernetes and Sysbox, focusing on creating a Kubernetes cluster on AWS EKS and configuring various components such as GitLab agents and workspaces. It describes the installation of necessary tools like AWS CLI, eksctl, and kubectl, as well as the setup of a Kubernetes cluster with Sysbox for enhanced container isolation. The guide also details configuring sudo access, setting up an Ingress Controller with NGINX, and building and running containers within a workspace using Docker. It emphasizes using GitLab Workspaces to replace traditional local development environments for a secure, reproducible setup, promoting the benefits of ephemeral development environments and offering links to further documentation and video resources for implementation.