GitLab team member here. Thanks for your feedback. I have added a note into the issue https://gitlab.com/gitlab-org/gitlab/-/issues/22027#note_146... and pinged our teams.
313 karma · joined January 28, 2020
Fantastic insights in the issue, next to the scripts. One could write a script that generates Mermaid charts in Markdown, and document the CI/CD infrastructure automatically - with CI/CD pipelines itself. Hmmm :)
Would it be ok for you if I add that command snippet into a blog post I am currently writing about Observability for Efficient DevSecOps Pipelines? Draft MR is in https://gitlab.com/gitlab-com/www-gitlab-com/-/issues/34296 Thanks!
Regarding pipeline visibility and traces: I would love to see the same :-) I tested tracepusher with OpenTelemetry this week, and the timeline for CI/CD traces is a great start in Jaeger. Added a suggestion into https://gitlab.com/groups/gitlab-org/-/epics/5071#note_14582... where CI/CD Visibility is being worked on, with an update on GitLab support for traces in https://gitlab.com/groups/gitlab-org/-/epics/5071#note_14584...
The picture in the blog post needs an update. I just checked a running pipeline that shows the green `latest` label. Added a screenshot of the pipeline, and the update suggestions for our teams into https://gitlab.com/gitlab-org/gitlab/-/issues/414756#note_14...
I have copied it into the feedback issue https://gitlab.com/gitlab-org/gitlab/-/issues/414756#note_14... (also linked in the blog post). Feel free to add more details and thoughts. Thanks!
> But IMO there are plenty of other places to add real value across the GitLab product with AI/ML features.
True, and after starting with ML experiments, the product and engineering teams have been working on new features for entire DevOps lifecycle. All AI workflows on the DevSecOps platforms are described in the GitLab Duo announcement blog post https://about.gitlab.com/blog/2023/06/22/meet-gitlab-duo-the... and website https://about.gitlab.com/gitlab-duo/
I'll share a few highlights that I am personally excited about
- Explain and help fix security vulnerabilities. From my personal experience, I often find CVEs hard to read, especially when I am not the author of the code to fix. Getting help from AI can reduce entry barriers and make development for efficient. Security is everyone's responsibility these days. This follows the AI assisted feature to explain code in general. "What does this magic loop with memcpy do?" might not stay magic anymore, easing the path to code refactoring, improving performance, and reduce the resource usage footprint.
- Summarize issue comments. Feature proposals or bug analysis can have long comment threads that require reading time. AI will help get the gist and better contribute to what has been discussed.
- Summarize MR changes, to avoid reading long change diffs. This helps with faster (code) review cycles. I tested it this week with an MR for our handbook in https://gitlab.com/gitlab-com/www-gitlab-com/-/merge_request...
I'd also like to see AI helping fix CI/CD pipelines fast. Proposal in https://gitlab.com/gitlab-org/gitlab/-/issues/386863 I shared some thoughts in a new talk "Observability for Efficient DevSecOps Pipelines", slides in https://go.gitlab.com/VDAvMw (GitLab blog post coming soon, https://gitlab.com/gitlab-com/www-gitlab-com/-/issues/34296)
Additionally, I learned some new ideas at Cloudland last week, regarding product owner requirements list verification, and end-to-end test automation with AI. Need to create feature proposals :-)
> As a longtime GitLab user (and onetime contributor!),
Thanks for contributing. I'd like to invite you to share your ideas about AI features across the platform :)
When you look at the DevOps lifecycle (image in https://about.gitlab.com/gitlab-duo/) from plan/manage to create, verify, secure, package, release, deploy, monitor, govern - where do you see yourself, and where do you spend the most time in?
Second question: Which process feels the most inefficient? After identifying answers to the questions, please check the AI features https://docs.gitlab.com/ee/user/ai_features.html and/or open new feature proposals for GitLab https://gitlab.com/gitlab-org/gitlab/-/issues/new?issuable_t... You can tag @dnsmichi so I can engage with your ideas. Thanks!
AI for self-managed instances is also focussing on privacy, while bringing more efficiency to teams. https://about.gitlab.com/blog/2023/06/15/self-managed-suppor...
The training data is publicly documented, and AI features are built with privacy first.
For all URLs please check my comment in https://news.ycombinator.com/item?id=36526159
The training data is documented in https://docs.gitlab.com/ee/user/project/repository/code_sugg...
AI Transparency is important, all available AI features provide documentation for training data, and are built with privacy first.
The GitLab Duo announcement adds more feature details and plans. https://about.gitlab.com/blog/2023/06/22/meet-gitlab-duo-the...
The AI/ML blog series provides insights on experiments, and features being built. https://about.gitlab.com/blog/2023/04/24/ai-ml-in-devsecops-...
Bug fixes, UX improvements and performance improvements are added to the monthly release blog post, for example GitLab 15.11 [1] - in case you want to follow these updates more closely.
[0] https://about.gitlab.com/direction/#fiscal-year-guiding-prin...
[1] https://about.gitlab.com/releases/2023/04/22/gitlab-15-11-re...
I have added your suggestion with MR/PR to remediate security vulnerabilities to the feedback issue [0] for the explain this vulnerability feature. The issue is linked from the blog post that provides more details [1].
[0] https://gitlab.com/gitlab-org/gitlab/-/issues/407295#note_13...
[1] https://about.gitlab.com/blog/2023/05/02/explain-this-vulner...
Negative feedback is good feedback imho. It helps to understand what went wrong, what to improve, and which actions should be taken.
https://about.gitlab.com/handbook/marketing/community-relati... has more insights.
> More neutral might be individual escalation behind the scenes.
Agreed, and this happened. For transparency, I went ahead and posted a comment here. It would be unfair to not respond publicly to the immediate concerns. This happens on all channels when necessary - Hacker News, community forums or social media - outside of the regular support channels, and will need a response to users.
> And lastly, positive one would be an explanation of what went wrong and what steps are taken to prevent it from happening again. (Or writing a defense from your view, which is fair game since the "accuser" went public already.)
In this case, I forwarded the message internally, and asked to escalate, which already was put into action. I do not have updates on what caused the problems, but can follow up tomorrow if it is safe to share, and does not contain confidential customer data.
Thanks for your feedback, and sorry for the trouble. I have shared it with our teams to escalate and come back to you as soon as possible.
Specifically for engineering leaders, I'd recommend checking out
- QCon (London next week, I'm speaking there too)
- KubeCon EU / NA
- Container Days
- SRECON
I've collected them and added more analysis, inventory and mitigation tips in a new blog post. (GitLab team member here)
https://about.gitlab.com/blog/2023/03/16/how-gitlab-can-help...
The blog post includes a Python script to programmatically search CI/CD configurations in GitLab, shows the Dependency Proxy and container registry possibilities, and discusses more ideas around custom Docker images (Dockerfile: FROM), Kubernetes/IaC image usage, policies and Observability. Hope sharing this knowledge helps :-)
When not logged in, gitlab.com will redirect to about.gitlab.com which hosts the website [1] and the handbook [2]
At the top menu on the right, `sign in` will bring up a form to log into GitLab.com. After login, the default dashboard shows an overview of projects, etc. and you can use the main navigation. Tip: "Your work" on the left menu is the first iteration of a new navigation experience, released with 15.9. [3]
The mentioned redirect will not happen when logged in, or by visiting a project namespace directly, for example https://gitlab.com/gitlab-org/gitlab or https://gitlab.com/gitlab-org
To download GitLab and install it in a self-managed setup on the website, follow `Resources > Get Started > Install` to see the available packages for Linux, and cloud-native installation (Kubernetes, cloud) [4]
[2] https://about.gitlab.com/handbook
[3] https://about.gitlab.com/releases/2023/02/22/gitlab-15-9-rel...
Thanks for sharing!
> We’re also toying with the idea of an “enterprise” self-hosted deployment, similar to gitlab’s billing model, and thoughts from the community on this front would be appreciated!
Transparency and an open stewardship of the project can help: https://about.gitlab.com/company/stewardship/ Make it clear what features are paid, and define that for example free features are never moved to the paid tier.
I've created an MR to link MVC in the handbook: https://gitlab.com/gitlab-com/www-gitlab-com/-/merge_request...
(GitLab team member here)
"Stage leaders" is specific to GitLab, referring to the stages of the DevOps lifecycle [1]. Stages are part of the product hierarchy definition [2], with sections, stages, groups, categories, features. Maybe the term is similar to "product group leader" in other areas.
FYI, created a merge request to link the product handbook from the acquisitions handbook, providing more context on stage leaders. [3]
[1] https://about.gitlab.com/handbook/product/categories/#devops...
[2] https://about.gitlab.com/handbook/product/categories/#hierar...
[3] https://gitlab.com/gitlab-com/www-gitlab-com/-/merge_request...
Running the GDK on Gitpod can be alternative: https://gitlab.com/gitlab-org/gitlab-development-kit/-/blob/...
Which website did you open to download and install GitLab? about.gitlab.com > Resources > Install provides an overview of all distributions and installation methods (packages, cloud native, etc.) at [0]
> You need to further dig the docs to find the location of the source in the webpage, too.
I assume that the intention was to download GitLab's source code and start the installation from there?
The recommended way to install GitLab is through packages and cloud-native deployments. There are many components involved in the architecture [1], and these methods also help ensure that (database) migrations are run as intended, keeping upgrade maintenance short. Installing from sources is not recommended, albeit possible.
The source code is available for both, open source (CE) and source available (EE), following GitLab's stewardship promise [3].
Maybe this needs an update for the website, please let us know.
[0] https://about.gitlab.com/install/
[1] https://docs.gitlab.com/ee/development/architecture.html
You can learn more about the Remote Development direction in [0], follow iterations in [1] and read about the steps to integrated the client-only VS Code as new Web IDE into the GitLab DevSecOps platform [2]. I'd encourage you to try the Web IDE Beta next week on Dec 19, and add thoughts, ideas and feedback into this issue [3]. Thanks!
[0] https://about.gitlab.com/direction/create/editor/remote_deve...
[1] https://gitlab.com/groups/gitlab-org/-/epics/7419
This blog post about the future of the Web IDE [0] provides insights on the evaluation and plans, published in May 2022. The remote development direction page [1] dives into all plans, challenges, etc. and also links engineering and product resources (issues, epics) to subscribe to. I'd suggest commenting on the epic with thoughts and ideas [2] - thanks!
[0] https://about.gitlab.com/blog/2022/05/23/the-future-of-the-g...
[1] https://about.gitlab.com/direction/create/editor/remote_deve...
Sorry to hear about your troubles. GitLab is working on adding remote development into the DevSecOps platform. I suggest reviewing the direction page [0] and implementation planning in the main epic [1] (with child epics and issues), and add your feedback and thoughts into the epic. (via the direction page in the 'how you can help' section [2])
[0] https://about.gitlab.com/direction/create/editor/remote_deve...
[1] https://gitlab.com/groups/gitlab-org/-/epics/7419
[2] https://about.gitlab.com/direction/create/editor/remote_deve...
Started investigating how it can be integrated into GitLab CI/CD in the most efficient way.
Simple - install Hurl using before_script every time into the used container image. Example in https://gitlab.com/everyonecancontribute/dev/hurl-playground...
Efficient - build a custom container image (the upstream container image behaves unexpected when overriding the entrypoint for CI/CD, need to investigate and create an issue) Example in https://gitlab.com/everyonecancontribute/dev/hurl-playground...
A quick example to check the website body can be achieved with
$ vim dnsmichi.at.hurl
GET https://dnsmichi.at
HTTP/1.1 200
[Asserts]
body contains "Everything is a DNS problem"
$ hurl --test dnsmichi.at.hurl
$ vim hackernews.hurl
GET https://hn.algolia.com/api/v1/search
[QueryStringParams]
query: gitlab
tags: front_page
HTTP/2 200
[Asserts]
jsonpath "$.hits" count > 0
$ hurl --test hackernews.hurl
Will add more use cases, upstream PRs, and a blog post soon. https://gitlab.com/everyonecancontribute/dev/hurl-playground
Documentation as code might be a good alternative path, using the same tools and processes as software development and embed documentation tasks into engineering workflows. More insights in https://about.gitlab.com/blog/2022/10/12/five-fast-facts-abo... how the GitLab technical writing team collaborates.
Note: GitLab team member here.
Sharing a personal insight - I'm currently moving flats in the Nuremberg area in Germany which is a little hectic because forced out by the new house flat owner. Async work enables me to take calls and go shopping to organize the move, whilst shifting work hours into the evening or early morning. I am also able to take paid time off (PTO) when needed to prepare the move early December. In my previous office job, I would have needed to reserve a lot of vacation days for this, and ask for permission to start later than 10am, or leave earlier than 4pm. Here at GitLab, I am my own manager [0] and take care about my working hours - it is a personal freedom, and I appreciate these less stressful times a lot. In return, I can take time to focus on private life, and come back refreshed to produce great results (blog posts, talks, helpful replies here and other community channels, etc.).
What I learned in the past 2 years and 9 months at GitLab, is to provide as much context as needed so that someone else in a different timezone can continue async, and is not blocked by anything (low context communication [1]). Also, short toes [2] enable everyone to add their thoughts and opinions, and work with the directly individual responsible (DRI) for the best outcome.
The Slack retention period of 90 days is a great reminder (and also enforcement) to document everything in the handbook. Example from today: I learned that Google docs supports the colon for emoji live-search. Thought of sharing in Slack, but then went with editing the handbook and sending a MR [3] to help everyone find this little efficiency tip in the future - that said, Slack is not a knowledge base. The GitLab handbook is.
Thinking about the past year with a public discussion about speaker diversity at events, I admire our teams to take action to ensure events align with our diversity, inclusion and belonging values. We have updated our event requirements for speakers (MR [4], handbook page [5]), and are working with event organizers and the wider community to help with mentoring and coaching to inspire future speakers.
Last but not least, transparency [6]. Internal and external, I can read and learn async at my own pace. Most of my meetings are optional, and the meeting notes/recording are detailed, with follow-up actions. You'll never recap old meeting notes the next time but reference actioned issues and merge requests. Many issues/epics are public - if you'd like to learn more about my thought leadership strategy for Observability, and all content created and planned, you can follow this epic [7] or my profile activity [8] for example.
I haven't met everyone in-person yet, because of the pandemic, and travel only for some events (KubeCon EU/NA, PromCon EU [9] [10]), but I am looking forward to meet and value these moments. Hard to describe, I feel incredibly connected to my teams albeit living far far away. :-)
Happy to share more thoughts and insights - my role is on the community relations/developer evangelism team, I'm the stable counterpart for the product teams, and collaborate in cross-functional initiatives often. [11] My first [12] and second [13] year blog posts share more experiences too :-)
[0] https://about.gitlab.com/handbook/leadership/#managers-of-on...
[1] https://about.gitlab.com/handbook/communication/#effective-c...
[2] https://about.gitlab.com/handbook/values/#short-toes
[3] https://gitlab.com/gitlab-com/www-gitlab-com/-/merge_request...
[4] https://gitlab.com/gitlab-com/www-gitlab-com/-/merge_request...
[5] https://about.gitlab.com/handbook/marketing/corporate-market...
[6] https://about.gitlab.com/handbook/values/#transparency
[7] https://gitlab.com/groups/gitlab-com/marketing/-/epics/2593
[8] https://gitlab.com/dnsmichi
[9] https://dnsmichi.at/2022/06/13/my-kubecon-eu-experience-firs...
[10] https://opsindev.news/archive/2022-11-23/#promcon-eu
[11] https://about.gitlab.com/handbook/marketing/community-relati...
[12] https://dnsmichi.at/2021/03/02/my-1st-year-all-remote-at-git...
[13] https://dnsmichi.at/2022/03/02/2-years-all-remote-and-2022-v...