Petes Linkedin Blog

Before we get too far into 2022, we wanted to take a look back at the most exciting additions to our DevOps Platform over the last year. Since we release every month on the 22nd, there were lots of new features to consider, but these stood out to me. Epic Boards In GitLab 14.0 , we made it easy to keep track of all epics in one place through Epic Boards. Our Epic Boards are customizable with a simple “drag and drop” interface accessible to all teammates, not just the technical ones. Now it’s painless to create general or DevOps-focused workflow states. And teams aren’t just more efficient, they can actually be predictable. Explore our Epic Boards . Integrations with VS Code and Gitpod Fans of Visual Studio Code got a much tighter integration with GitLab in 2021. The GitLab Workflow Extension reduces context switching and improves productivity. And we rounded up 8 ways to get the most out of VS Code and GitLab . GitLab also created a tighter integration with Gitpod. Developers c...

Infrastructure as Code (IaC) has eaten the world. It helps manage and provision computer resources automatically and avoids manual work or UI form workflows. Lifecycle management with IaC started with declarative and idempotent configuration, package, and tool installation. In the era of cloud providers, IaC tools additionally help abstract cloud provisioning. They can create defined resources automatically (network, storage, databases, etc.) and apply the configuration (DNS entries, firewall rules, etc.). Like everything else, it has its flaws. IaC workflows have shifted left in the development lifecycle, making it more efficient. Developers and DevOps engineers need to learn new tools and best practices. Mistakes may result in leaked credentials or supply chain attacks. Existing security assessment tools might not be able to detect these new vulnerabilities. In this post, we will dive into these specific risks and focus on IaC management tools such as Terraform, cloud providers, an...

In almost any kind of software, bugs and security vulnerabilities will be discovered over time. We do our best to proactively spot and fix bugs before and after release, but it’s the nature of humans crafting software that there will be things we miss. In this post, we’ll explore how GitLab handles security bugs and how the way we handle and publicly disclose bugs is unique and important to upholding our values, and why customers should care. Why do I even have to care? GitLab is an open-core platform where businesses can choose to either sign up to GitLab.com, or self-host and self-manage a Community or Enterprise Edition. Everyone can contribute , and that applies to identifying security bugs too! We have a vibrant community of researchers reporting security issues through our HackerOne Bug Bounty Program , we can receive responsible disclosure reports , and of course we have dedicated internal security teams working across an organization where security is everyone’s responsib...

GitLab provides a Dependency Scanning feature that can automatically detect vulnerabilities in your software dependencies. Dependency Scanning covers various programming languages and relies on the GitLab security advisory database , that is updated on a periodic basis by the Vulnerability Research team at GitLab. The GitLab security advisory database covers advisories in software packages that have a CVE identifier, as well as malicious packages marked as such by their ecosystem ( example ). The database is an essential part of the Dependency Scanning feature, which is available in GitLab Ultimate self-managed and GitLab Ultimate SaaS. As of recently, GitLab also provides a free and open-source version of the database, the GitLab community security advisory database , a time-delayed (+30 days) clone of the GitLab security advisory database . In the spirit of Collaboration and Transparency , two of the GitLab core values , we share the database with the open-source community in...

The scientific process and the DevOps lifecycle. At first glance, it’s hard to imagine a connection. Yet, if you look at how some of GitLab’s customers and community members are marrying the two, it makes perfect sense. Take, for example, the European Space Agency (ESA), which uses GitLab extensively for a variety of purposes, including version control, enabling collaboration, increasing security, and coordinating the intellectual resources of its 22 member states. ESA has more than 140 groups and 1,500 projects stored on its GitLab instance. In the first year of using the DevOps Platform, ESA ran more than 60,000 pipeline jobs, allowing the organization to deploy code faster and to simplify its toolchain. The projects range from mission control systems, onboard software for spacecraft, image processing, and monitoring tools for lLabs. The ESA IT Department also uses GitLab to host its code tools and configurations infrastructure. Since adopting GitLab, ESA has enjoyed a culture of co...

This blog post and linked pages contain information related to upcoming products, features, and functionality. It is important to note that the information presented is for informational purposes only. Please do not rely on this information for purchasing or planning purposes. As with all projects, the items mentioned in the blog post and linked pages are subject to change or delay. The development, release, and timing of products, features, or functionality remain at the sole discretion of GitLab, Inc. We would like to introduce you to our software supply chain security direction and landscape. An emerging concern in the software development space is being able to document the entire supply chain and development progress by creating a chain of custody starting from code creation, build, test, package, and going through deployment. GitLab's software supply chain security (SSCS) vision includes everything needed to securely deliver and run software with a high degree of confiden...

There’s no escape: Your company is in the software business, even if it’s not. Competitors, customers, investors, and employees are all demanding updated software on a regular basis, alongside whatever products your organization creates. So embrace the reality (and DevOps ) and invest in creating the most efficient continuous integration and delivery pipelines possible. Not sure how to sell this strategy to management? Start by pointing out it’s likely your closest competitor is already taking advantage of continuous integration/continous delivery (CI/CD). And if you need more ammunition, here are 10 reasons why your business needs CI/CD. What is CI/CD? CI/CD is a two-step process that dramatically streamlines code development and delivery using the power of automation. CI makes developer tasks like source code integration and version control more efficient so software can get into production faster. CD automates software testing and deployment. Together, CI/CD is a powerful and un...