Comment by whafro | Hacker News Reader

Comment by whafro | Hacker News Reader

We've been paying for GitLab for about a year now, and it's mostly been a good experience. There have been three things that seem to come up weekly for us:

1. Lack of traceability/auditability. We're in healthcare, and have a regulatory burden that requires versioning of basically everything. GitLab does this for code and wikis (thanks to git itself) but not for issues, merge requests, comments, etc. I've ended up building a service that just ingests the webhooks for these to store them away, which feels ridiculous. Since the webhooks for comments doesn't get triggered on update, I even have a TRIGGER shimmed into GitLab's postgres DB. Ech.

2. There's no concept of a bot user, so every integration we want to do is against a single account/identity, in part because...

3. The pricing of Ultimate feels ridiculous, and that's the only way to get something as fundamental as epics. $1000+ a year for every employee?

[edit] $1000/mo -> $1000/yr. (per month would have been even more way cray)

> $1000 a month for every employee?

Typo? Pricing page [1] lists it at $99/mo

[1] https://about.gitlab.com/pricing/

Thanks, edited!

Thanks for the feedback. To address each point:

1. I'd love to see everything versioned in GitLab. We're working on the issue descriptions, but I agree we should move toward versioning everything. There's an epic here [0], that we will be filling out with more issues to address what we haven't yet. Feel free to leave feedback there as well.

2. Most integrations are against projects, groups or instances. For those that require an acting agent, I recommend just creating a normal account for that and call it bot. I think it makes sense for us to have some sort of permanent solution for bots [1]. In the meantime, I propose you talk with our sales team about that. I'm sure they're willing to be flexible.

3. We believe the pricing for Ultimate is fair, given the broad range of tools GitLab replaces, from project management, to CI, to security, licensing and container management tools. That said, we're aware that it's challenging to see the value for every single user. With this release we're taking a step that hopefully helps out, by making guest users free for Ultimate [2]. We welcome further feedback on how we can make GitLab even more accessible to everyone in the organisation.

[0]: https://gitlab.com/groups/gitlab-org/-/epics/237

[1]: https://gitlab.com/gitlab-org/gitlab-ee/issues/6600

[2]: https://about.gitlab.com/2018/06/22/gitlab-11-0-released/#un...

About 1: take a look at sit https://github.com/sit-fyi/sit and git-dit https://github.com/neithernut/git-dit

It would be nice to work with an existing project than roll your own.

Thanks for the suggestion.

As the author of one of these projects (sit.fyi), I'll be happy to show and explain its philosophy & benefits (some are quite interesting and yet to be possible in conventional options). I think that discussion can be of value to all. Feel free to reach me at me-at-yrashk.com if interested!

You might want to check RhodeCode at some point. Because our main customers are in Healthcare/Insurance/Automotive, and all those industries require strong auditability. We built very advanced audi logs capabilities, every permissions change, every comment, is traced with IP user and old data is saved.

In addition to [0], to version-track issue/mr descriptions that was already referenced earlier (within an epic), we also have [1] open, to do the same for comments. Please feel free to comment more there!

[0] https://gitlab.com/gitlab-org/gitlab-ce/issues/15597

[1] https://gitlab.com/gitlab-org/gitlab-ee/issues/3706

The audit logging capability offered by GitHub Enterprise are very comprehensive. Useful for compliance scenarios like this.

If you export and parse the logs (which you should). But out of the box all kinds of write level or auth interactions aren’t exposed in the audit log search UI.

Reply on news.ycombinator.com