TechPrufer
Get started
GitLab
GitLab logoGitLab · Feature trail

AI-Assisted Features in DevSecOps

181 posts · Sep 2018 – Oct 2026

What this trail covers

GitLab Duo is being integrated into the DevSecOps workflow to assist with code generation, testing, and security analysis. This post details how to use GitLab Duo to generate AI code, automatically create unit tests, identify vulnerabilities using Duo Chat, and deploy test reports using GitLab Pages. It also demonstrates integrating SAST scanning to detect security flaws in AI-generated code, enhancing the reliability and security of the development process. The platform is evolving to provide m

All GitLab trails
  1. GitLab Transcend: Speed you can trust, all the way to productionThis post announces significant advancements in GitLab's agentic software engineering capabilities, focusing on agent orchestration, data/context management, DevOps workflows, and governance/security. Key new features include goal-driven flows for end-to-end change management, custom flows for chaining agents, GitLab for Slack integration for initiating flows from chat, and the MCP Server for secure AI tool integration. It also introduces GitLab-hosted open-weight models for cost optimization, GitLab Orbit for enhanced agent accuracy with a context graph, Duo Agent Platform Impact Analytics for cost/ROI tracking, and credit/usage controls for AI spend. Infrastructure updates include GitLab Artifact Central for unified package management and GitLab Dependency Firewall for package security rules. Governance and security are bolstered by GitLab Secrets Manager for scoped build-time secrets and the GitLab Security Standard for hardening the software factory. New security flows powered by Anthropic's Claude Mythos 5 and 5.1 are also announced.
  2. DeepSeek-Reasonix: How a poisoned config can hijack an AI coding agentThis post details a critical command execution vulnerability (ConfigPoisoning) found in DeepSeek-Reasonix Studio, a desktop git client for AI-assisted development. The vulnerability arises from how the tool processes repository-specific git configuration files (`.git/config` and `.gitattributes`), allowing attacker-controlled commands to execute when a developer views a file's diff. The root cause is identified as the failure to neutralize the `filter.<driver>.clean` git config key, which is selected per file via `.gitattributes` and not covered by existing hardening mechanisms. The post provides a detailed breakdown of the vulnerability's mechanism, its scope, and recommendations for users and tool builders, including updating DeepSeek-Reasonix, overriding relevant git keys on every call, and testing against hostile configurations. It also highlights that this pattern of trusting repository configuration as tool settings is present in other agentic tools and discusses how GitLab's Threat Research Group can help identify similar vulnerabilities.
  3. Securing the software factory at machine speedThis post introduces a new operating thesis for security in the age of AI and agentic systems, emphasizing that detection is not defense. It outlines a three-layer approach to machine-speed defense: 1. Proactive discovery using AI models on code, infrastructure, and deployment paths. 2. Strengthening the foundation with continuous scanning, secret management, agentic remediation, policy enforcement in the execution path, and treating agents as privileged actors. 3. Protecting shipped software by continuously scanning and reassessing production. It highlights the use of GitLab Duo Agent Platform for continuous triage and remediation and mentions Project Glasswing with Anthropic's models for critical systems. The post emphasizes measuring time from detection to verified remediation as the key metric and discusses the architectural problem of the 'shadow software factory' created by agents operating outside governed systems.
  4. GitLab Duo CLI takes a task from goal to doneIntroduces the `/goal` slash command for GitLab Duo CLI, enabling goal-driven agentic workflows. Details the mechanism of defining a goal and a 'done when' condition, with a separate verifier model iterating until the goal is met or a configured limit is reached. Mentions upcoming Slack agent integration and the underlying capability's extension to various clients. Requires GitLab 19.3+, Duo CLI 9.17.0+, Premium/Ultimate tiers, and Duo Agent Platform enabled.
  5. New MCP tools help platform teams scale automation safelyThis post introduces new MCP server tools for CI/CD (save_pipeline, get_job), merge requests (save_merge_request, get_merge_request, list_merge_requests, save_merge_request_review, accept_merge_request), repositories (list_repository_tree, list_branches, list_tags, list_releases, list_commits, get_commit, add_commit, fork_repository), projects and users (get_project, list_projects, list_project_members, get_user), work items (get_work_item, list_work_items, save_work_item, save_note), and vulnerabilities (list_vulnerabilities, get_vulnerability, save_vulnerability). It also introduces a 'Merge request created' trigger and unified tool governance with default settings for read-only and write/delete actions.
  7. When to use SAST versus an LLM security scannerThis post introduces a comparative analysis of SAST and LLM-based security scanners, advocating for their complementary use. It details the trade-offs in cost, consistency, audit evidence, vulnerability types, and finding validation between deterministic SAST and probabilistic LLM scanners. The post recommends SAST for continuous, per-commit scanning due to its predictable cost and auditability, and LLM scanners for merge-request-level reasoning to catch business logic flaws and validate findings. It highlights that LLM scanners can generate working exploits to validate findings, reducing false positives.
  8. Prepare for the Cyber Resilience Act's 24-hour reporting deadlineThis post details how GitLab's software supply chain security capabilities can help organizations comply with the Cyber Resilience Act's (CRA) 24-hour reporting deadline for actively exploited vulnerabilities. It outlines four key questions organizations should ask about their continuous detection solutions and how GitLab features like continuous dependency scanning, operational container scanning, group-level dependency lists, vulnerability activity logging, dependency scanning auto-remediation, merge request approval policies, and compliance frameworks address these questions. It also introduces the upcoming Dependency Firewall for preventative policy application at the registry level.
  9. GPT-6 Astra on GitLab: Faster runs, fewer tokens usedIntroduces GPT-6 Astra as a new model available on the GitLab Duo Agent Platform, detailing its performance improvements over GPT-5.6 Sol in terms of run speed (43.4% faster on typical runs, 49.2% faster at the 95th percentile) and token usage (42.7% fewer tokens per run). It also notes a difference in task resolution rate (63.3% for Astra vs. 76.7% for Sol), with Astra returning misses as patches. The post highlights that GPT-6 Astra is particularly beneficial for dependency updates, build fixes, and small multi-file changes where turnaround time and token consumption are critical.
  10. Critical remote code execution in vm2, a widely used Node.js sandbox libraryThis post details a critical sandbox escape vulnerability (CVSS 3.1: 10.0) discovered by GitLab's Threat Research Group in the vm2 Node.js sandboxing library. The vulnerability, found using AI automated tools, stems from default configurations in vm2's README that allow for remote code execution. While GitLab does not use vm2, the research highlights the risks associated with insecure sandboxing configurations, particularly the `require.external` and `require.root` settings. The post explains the technical details of the vulnerability, the limitations of the fix provided in vm2 Version 3.11.7, and provides recommendations for users to harden their configurations and consider alternative isolation methods like containers or separate processes for untrusted code. It also touches upon the broader challenge of recurring sandbox escape bugs in vm2.
  11. When code is abundantThis post discusses the fundamental shift in software development economics driven by large language models (LLMs) making code production abundant. It argues that the primary constraint is moving from producing code to trusting it, necessitating changes in architecture and strategy around context, verification, governance, and evidence. The post highlights how cheap iteration changes development strategy, turning organizational knowledge into executable code (e.g., production failures becoming regression tests). It introduces the concept of 'cost per accepted change' as the key economic unit and discusses how AI agents are exposing existing engineering constraints like slow CI pipelines. The post also outlines three coexisting modes of AI adoption: AI-assisted, AI-augmented, and AI-native development.
  12. Run agentic software delivery inside the boundaries you already trustIntroduces AI Gateway for GitLab Dedicated, enabling AI processing within the customer's single-tenant environment. This allows for data residency and compliance by keeping AI-processed data within the customer's chosen AWS region. Customers can connect their own models or use providers like Amazon Bedrock. This extends the capabilities of the Duo Agent Platform, including custom code reviews, pipeline fixing, and security analysis, to run against chosen models within trusted boundaries.
  13. When your backlog outgrows your team, GitLab scales remediationThis post introduces bulk SAST False Positive Detection and Agentic SAST Vulnerability Resolution for existing vulnerability backlogs, and automated SAST False Positive Detection and Agentic SAST Vulnerability Resolution for new critical and high severity vulnerabilities. It details how these features analyze surrounding code for false positives, confirm real risks, and automatically generate ready-to-merge fixes. The post also clarifies that these features consume GitLab Duo Agent Platform credits and that bulk processing does not incur additional credit costs per execution, but rather queues many at once. It also mentions that concurrency limits prevent bulk jobs from overwhelming pipelines and that jobs can be canceled.
  14. Critical remote code execution in Serena, a popular MCP coding agentThis post details a critical server-side template injection vulnerability (CVE pending) in Serena, an AI coding agent, that allows arbitrary code execution on a developer's machine. The vulnerability arises from the use of an unsandboxed Jinja2 template engine and the processing of project configuration files (`.serena/project.yml`) without adequate trust checks. The exploit bypasses Serena's `trusted_project_path_patterns` control. The post provides a detailed call chain, explains the exposure, and offers recommendations for users to update to `serena-agent 1.7.0` and for developers of AI coding tools to implement robust validation, sandboxing, and comprehensive trust gates. It highlights MCP servers as a new attack surface with significant implications for developer security.
  15. A sandbox is only as closed as what an AI agent can reachThis post details how AI agents can exploit vulnerabilities in package proxies within sandboxed environments, highlighting the need for stricter egress controls and monitoring of internal services accessed by these agents. It emphasizes that allowlists extend reachability to the full internet access of the services they grant access to, and that cyber-capable models require new sandbox considerations.
  16. How GitLab tracks vulnerabilities through refactors and reformattingIntroduced a normalized Scope+Offset fingerprinting method for vulnerability tracking that ignores non-functional code (comments and blank lines). This significantly reduces duplicate vulnerability reports caused by code refactoring and reformatting, as demonstrated by a benchmark showing zero duplicates and a 43% reduction in unique fingerprints compared to the original Scope+Offset method. The `scope_offset_compressed` algorithm is now the default for SAST tools in GitLab, supporting multiple languages and reusing existing parse trees with no impact on scan times.
  17. Confidential AI for GitLab Self-HostedThis post introduces the integration of Privatemode AI with GitLab Duo Self-Hosted, enabling the use of confidential computing for AI coding agents. This allows organizations with strict data privacy and regulatory requirements to leverage AI features without sending source code or prompts outside of an encrypted boundary. The integration works by using a self-hosted AI Gateway that forwards requests to a Privatemode proxy, which then uses remote attestation to verify a hardware-based trusted execution environment (TEE) before establishing an encrypted channel for inference. This approach addresses the challenges of using AI in regulated industries by providing cryptographic guarantees that data remains encrypted during processing, even from the service operator or cloud provider.
  18. Secure every commit to production with Claude and GitLabThis post details the integration of Anthropic's Claude security guidance plugin with GitLab's DevSecOps platform. It outlines a five-step workflow for governing agentic coding at scale, focusing on enforcing security controls from code authoring to production. Key contributions include leveraging GitLab's security configuration profiles and merge request approval policies to enforce scans and prevent unauthorized merges, generating audit evidence through pipeline logs and approval records, controlling sensitive data sent to AI models via context exclusions and prompt guardrails, and extending security scanning coverage to dependencies, container images, and infrastructure as code. It also highlights the use of deterministic scanners alongside LLM-based reviews for compliance and auditability.
  19. How to govern agentic AI, MCPs, and AI code assistantsThis post introduces a governance framework for agentic AI in software development, addressing challenges with code attribution, traceability, and scalable documentation. It details controls for agents, MCPs, model access, and tool permissions, emphasizing composite identity and tool approval guardrails. Data privacy and self-hosted AI are discussed, along with defining where human review is still necessary (interactive vs. automated work). Key decision points for code review, testing, and deployment approval are outlined, and five metrics (adoption, acceptance/quality, risk, remediation, ROI) are proposed for measuring AI rollouts.
  20. Bring GitLab Duo Agent Platform to your terminalIntroduces GitLab Duo CLI, a generally available feature that brings agentic AI chat into the terminal. It supports interactive and headless modes, integrates with existing GitLab project context and agent configurations, and allows for shared sessions across different GitLab surfaces. It also includes diagnostic commands like `/doctor` and `/mcp`.
  21. GitLab Duo Security Review spots logic flaws scanners missIntroduces Security Review Flow, a new AI-powered feature on the GitLab Duo Agent Platform designed to detect logic flaws in code changes that traditional scanners miss. It analyzes code diffs in context (original files, changed lines, MR discussion, related code) to identify vulnerabilities such as broken object-level authorization, information disclosure, mass assignment, business logic errors, and race conditions. Findings are presented as diff threads with severity, tier, explanation, and suggested fixes. The feature complements existing scanners and human review, operating at the point of change for cost-effective fixes. It is available in public beta for GitLab Ultimate customers.
  22. Turn multi-step software delivery into agentic flows you can trustThis post announces the general availability of Custom Flows within the GitLab Duo Agent Platform, enabling AI-powered workflows that can be defined once and triggered by native GitLab events. It also introduces the ability to start Foundational Flows from GitLab Duo Agentic Chat, where requests matching specialist work (e.g., implementing a change, reviewing a merge request, fixing a failed pipeline) will trigger a recommended flow for user approval. The post details how Custom Flows can be created, triggered by various GitLab events, and run under composite identity. It also highlights updates to the Code Review Flow, including exclusion rules for bot-authored or branch-pattern merge requests and custom review instructions to shape review criteria. The evolution moves agentic software delivery beyond single-turn chat to multi-step, automated sequences.
  23. When a version bump breaks your build, GitLab fixes itIntroduces Dependency Scanning Auto-Remediation, a new capability that leverages AI (GitLab Duo Agent Platform) to automatically update vulnerable dependencies and fix any build-breaking changes introduced by these updates. This feature aims to reduce the dependency backlog, minimize developer effort in resolving breaking changes, and maintain an audit trail for all automated fixes. It supports multiple package managers and plans to expand to Rust and Go.
  24. How we used AI agents to migrate GitLab rate limitingThis post details the successful use of AI agents, specifically within the GitLab Duo Agent Platform, to migrate a legacy rate-limiting system to a unified implementation in `labkit-ruby`. It highlights the structured workflow ('the pod, the loop, and the observability') that enabled this migration, including AI drafting specs, implementing bounded changes, writing tests, and pre-reviewing merge requests, with human oversight for scope, architecture, rollout, and final review. The post also discusses lessons learned regarding observability, the need for human judgment in defining 'done' and managing infrastructure bottlenecks, and the shift in the bottleneck from code generation to review capacity and operator attention.
  25. Claude Sonnet 5 on GitLab: More reliable, more efficientThis post announces the integration of Anthropic's Claude Sonnet 5 model into the GitLab Duo Agent Platform. This integration enhances the platform's capabilities by providing a more reliable and efficient AI for agent-assisted software development tasks. Key improvements include higher quality code generation, better resolution of issues, and more consistent completion of multi-step tasks, which translates to reduced costs and increased productivity for users running GitLab Duo agents in production. The post also highlights the model's performance on benchmarks and its availability across all GitLab tiers and deployment models.
  26. Google Antigravity agents get full context with GitLab OrbitThis post details the integration of GitLab Orbit with Google Antigravity, enabling Antigravity agents to query GitLab's software lifecycle context graph. This integration allows agents to access structured data on projects, pipelines, merge requests, vulnerabilities, and source code, facilitating advanced use cases like blast radius analysis, onboarding and codebase exploration, and dependency mapping with image generation. The integration leverages the Model Context Protocol (MCP) and provides typed results for structured queries, improving agent accuracy and efficiency.
  27. AI Catalog updates for governance and operationsIntroduced event-driven triggers for GitLab Duo Flows, allowing automation based on GitLab events such as merge request conflicts, draft status changes, approvals, and work item creation. Enhanced pipeline event filtering to trigger on specific states (failure, success, cancellation). Added a beta feature for pattern-based approval of tool invocations in local flows. Introduced instance admin settings to disable custom agents/flows and restrict the AI catalog. Implemented flow configuration validation against the Duo Workflow Service before saving. Added a public beta for configuring an allowlist of approved AI models for agentic chat.
  28. One vulnerability view: From scanner coverage to AI governanceIntroduces AI audit event streaming (beta) to record all agent actions as audit events for governance and compliance. Launches Agent tool approval guardrails (beta) allowing administrators to control agent tool execution (autonomous, human approval, or blocked). This enables governed autonomy for AI agents, ensuring sensitive actions are reviewed before execution and all agent activity is logged.
  29. GitLab on Google Cloud: Fully managed, compliant, and AI-readyThis post announces the availability of GitLab as a fully managed platform on Google Cloud, delivered by MSP partners. It highlights the integration of Google's latest AI models (Gemini, Gemma) into GitLab Duo Agent Platform, enabling users to leverage these models within a governed DevSecOps environment. Key technical aspects include: the ability to run GitLab on Google Cloud infrastructure with data residency control, the availability of Gemini 3.5 Flash for high-throughput tasks and Gemma 4 for self-hosted/private cloud deployments, and the option to purchase GitLab and Duo Agent Platform through Google Cloud Marketplace to utilize existing commitments. The post also emphasizes the unified platform approach, combining AI capabilities with GitLab's existing DevSecOps context (merge requests, pipelines).
  30. GitLab: Built for the agentic engineering eraThis post announces and details several new AI-assisted capabilities and infrastructure enhancements: Next-generation Source Code Management (SCM) rebuilt for agent-scale concurrency, GitLab Orbit (a context graph for the full software lifecycle), Agents for security and governance, GitLab Duo Agent Platform (an orchestration system for agents), and GitLab Flex (a new buying model). It highlights the technical challenges of agentic coding on existing infrastructure and presents these new features as solutions to improve speed, control, and efficiency in the software development lifecycle.
  31. Introducing GitLab OrbitIntroduces GitLab Orbit, a live, queryable graph of code, merge requests, pipelines, deployments, vulnerabilities, and ownership. Orbit aims to improve AI agent performance by providing first-party GitLab data instead of stitched-together tool calls, leading to faster execution, fewer tokens used, and reduced hallucinations. It also enables engineers to answer cross-system questions through a Data Explorer, facilitating incident response, migration planning, and vulnerability blast radius mapping. Orbit works by ingesting SDLC data into ClickHouse and serving it via a Cypher-like DSL, MCP, REST, and the GitLab CLI. It scales to tens of thousands of projects and hundreds of millions of nodes/edges. Authorization mirrors GitLab permissions.
  32. Mythos-class Claude Fable 5 arrives on GitLab Duo Agent PlatformThis post announces the availability of Claude Fable 5, a Mythos-class model, on the GitLab Duo Agent Platform. It highlights Fable 5's improved capabilities in first-shot correctness for complex problems, leading to fewer iterations in tasks like multi-file refactors, incident investigation, and infrastructure-as-code definitions. It also emphasizes Fable 5's long-horizon autonomy, enabling multi-day, goal-directed agent workflows with self-correction and sustained instruction adherence. The model's improved bug-finding recall and ability to reason through code paths with greater depth are noted for faster incident resolution and more actionable code review comments. The post encourages users to test Fable 5 on challenging problems and mentions its availability across all tiers and deployment models via the AI Gateway.
  33. Agentic coding is only as good as its contextThis post details how integrating external coding agents with GitLab's platform context (issues, pipelines, security policies) improves the quality and security of AI-generated code. It explains how agents can leverage the Model Context Protocol (MCP) server and operate within merge requests to address review feedback, leading to fewer rework cycles and faster delivery. The post highlights the importance of `AGENTS.md` for custom instructions and discusses how structured context delivery, rather than just LLM context window size, is key to efficient AI-assisted development.
  34. Claude Opus 4.8 on GitLab: Complex agentic work, less disruptionIntroduces Claude Opus 4.8 as a new model option within the GitLab Duo Agent Platform, enhancing agentic capabilities for complex, multi-step work. Highlights improved long-horizon agentic execution with more precise interpretation and fewer interventions. Adds support for mid-conversation system prompts, allowing dynamic updates to system instructions without invalidating the prompt cache, which is beneficial for scenarios with changing context like file modifications or updated user context.
  35. Full security scanner coverage of your codebase in minutesIntroduced security configuration profiles as a centralized UI-based mechanism to manage and apply security scanner configurations (SAST, dependency scanning, secret detection) across multiple projects. Default profiles are provided with pre-configured scan triggers (merge request pipelines, branch pipelines for default branch, and push protection for secret detection). This aims to automate and standardize security coverage, addressing challenges of manual configuration at scale and AI-driven code velocity.
  36. More AI models for GitLab Duo Agent Platform Self-HostedThis post expands the capabilities of the GitLab Duo Agent Platform Self-Hosted by enabling the use of more open-source AI models for customers operating under data residency, air-gapped network, or strict compliance regulations. It details the deployment options, including on-premises hardware running vLLM and GPU-enabled virtual machines, and lists newly supported models: Mistral Devstral 2 123B, GLM-5.1, Kimi-K2.6, and MiniMax-M2.7. This addresses the trade-off between model capability and deployment constraints, allowing teams to match the right model to their specific workflow and infrastructure, even in isolated environments.
  37. Beyond BYOK: Why governance matters for AI agentsThis post introduces the GitLab Duo CLI and its integration with the GitLab Duo Agent Platform, focusing on the governance and security aspects of agentic AI in automated workflows, particularly within CI/CD pipelines. It contrasts this with individual developer tools like GitHub Copilot CLI by emphasizing platform-level controls, auditable actions, and composite identity. Key technical contributions include detailing prompt injection detection, custom instruction files (`AGENTS.md`, `SKILL.md`), and the flexibility of supporting both self-hosted and GitLab-hosted models.
  38. Fix bugs with Codex and GitLabThis post details the integration of Codex, an AI coding agent, with the GitLab Duo Agent Platform to automate bug fixing and enhance the software development lifecycle. It outlines three use cases: fixing a Rust WebSocket bug locally, enriching context with GitLab MCP for issue-aligned fixes, and using Codex as an external agent to address review feedback. The post highlights how GitLab's CI/CD, Duo Code Review, and MCP server provide the necessary context and automation to move from AI-generated code to shipped software.
  39. 5 ways to fix misleading vulnerability severities with policyIntroduced vulnerability management policies that allow for automated severity overrides based on defined rules (CVE ID, CWE ID, file path, directory). Supports 'Set Severity', 'Increase Severity', and 'Decrease Severity' operations. Provides use cases for downgrading low-risk CVEs in internal services, upgrading injection vulnerabilities in production code, normalizing severity across scanners, aligning severity with exploitation intelligence, and applying org-wide risk models at the group level. Details on policy creation, validation, and quick reference for parameters are included.
  40. Harden your pipeline perimeter for the era of AI-assisted codingThis post details how GitLab Ultimate integrates application security into the development workflow to address the challenges of AI-assisted coding. It elaborates on the 'See' dimension with specific features like the Group Security Dashboard, Security Inventory, Credentials Inventory, Token Lifetime Enforcement, Audit Event Streaming, and Group SBOMs. For the 'Enforce' dimension, it describes Scan Execution Policies, Pipeline Execution Policies, MR Approval Policies, the Compliance Center, and Secret Push Protection. Finally, for the 'Fix' dimension, it highlights the MR security widget, Advanced SAST, AI-driven false positive scoring, the GitLab Duo Security Analyst Agent, and Agentic Vulnerability Resolution.
  41. GitLab Act 2GitLab is undergoing a significant transformation to lead in the agentic era of software development. This involves a generational rebuild of its underlying infrastructure to handle machine-scale work, reengineering Git for machine scale, and moving from a monolith to modern, API-first, composable services. Agent-specific APIs are being built to allow agents to act as first-class users. The platform is also reimagining CI/CD as an orchestration service that coordinates agents across the full lifecycle, validating work, enforcing guardrails, and driving change to production at machine rate. A key focus is on building a connected data model that accumulates context over years of team work, enabling agents to deliver better results with fewer tokens. Governance, including identity, audit, and policy, is being built into the core platform services to enable enterprises to move fast while maintaining control. GitLab is building one platform that operates across human-owned, agent-assisted, and agent-autonomous work, delivering it cloud and model neutral. The business model is evolving to include consumption pricing for agent work, with plans to introduce more flexibility to mix subscription and consumption models. The company is also adopting new operating principles: Speed with Quality, Ownership Mindset, and Customer Outcomes, built on a culture of excellence.
  42. Automate deployment processes with GitLab Duo Agent PlatformThis post introduces the GitLab Duo Agent Platform, a new capability that allows users to create custom AI agents to automate complex and repetitive engineering tasks, specifically focusing on onboarding new microservices into existing GitOps deployment workflows. It details the process of generating system prompts using GitLab Duo, creating and managing custom agents, and using these agents to automate the creation of manifests, update delivery pipelines, and configure image automation for new microservices. The post provides a concrete use case with TanukiBank, demonstrating how a custom agent can onboard a new microservice in minutes, significantly reducing manual effort and ensuring enterprise control through versioned and auditable artifacts within GitLab.
  43. Claude Code and GitLab: Three workflows that shipThis post details the integration of Claude Code with GitLab's CI/CD, security scanning, and code review workflows. It introduces three scenarios: fixing a C++ bug with Claude Code and then using GitLab CI/CD and Duo Code Review; adding GitLab MCP context to Claude Code for richer issue understanding; and using a Claude-powered external agent in Duo Agent Platform to address code review feedback directly in merge requests. It highlights the use of the Model Context Protocol (MCP) for seamless context transfer and automated merge request creation.
  44. 8 Agentic AI patterns reshaping team collaborationThis post introduces eight capability patterns for agentic AI that reshape team collaboration: providing status updates, routing work between humans, facilitating team communication, role-specific agents in chat, conversational context, role-based access control (RBAC) for agents, governed environments for agents, and collaborative agent building. It highlights how these patterns help teams move faster, work smarter, and stay in control. It also notes that a unified experience integrating environment grouping, catalog sharing, and managed promotion pipelines is a rare capability. The post emphasizes GitLab's structural advantage in integrating agents into its existing DevSecOps lifecycle via the GitLab Duo Agent Platform.
  45. Atlassian will train on your data: Opt out with GitLabThis post highlights Atlassian's new policy to collect customer metadata and in-app content from Jira, Confluence, and other cloud products for AI training, which is opt-out by default and mandatory for Free, Standard, and Premium tiers. It contrasts this with GitLab's approach of no data collection and no AI training on customer data, regardless of tier. The post emphasizes GitLab's unconditional data commitments, transparency through its AI Transparency Center and Continuity Plan, and the availability of GitLab Duo Agent Platform for on-premises AI processing. It also mentions IP indemnification for Duo-generated output.
  46. GitLab and Anthropic: Governed AI for enterprise developmentThis post details the integration of Anthropic's Claude models into the GitLab Duo Agent Platform, enabling governed AI capabilities for enterprise development. It highlights how Claude powers various SDLC workflows, including code generation, review, agentic chat, and vulnerability resolution. The integration emphasizes enterprise deployment flexibility by leveraging Google Cloud's Vertex AI and Amazon Bedrock, allowing organizations to route AI workloads through existing cloud governance frameworks and hyperscaler commitments. It also mentions the availability of GitLab in the Claude Marketplace for consolidated AI spend. The post reinforces GitLab's commitment to agentic software development by integrating models with strong reasoning, reliability, and safety characteristics within a governed platform that ensures auditability, attribution, and policy enforcement for AI agents.
  47. Give your AI agent direct GitLab access with glab CLIThis post introduces the integration of the GitLab CLI (`glab`) with AI agents via the Model Context Protocol (MCP). It details how `glab` provides structured access to GitLab project data (issues, MRs, pipelines) in JSON format, enabling AI agents to interact with GitLab programmatically. Key technical aspects include the `glab mcp serve` command, the automatic `--output json` flag for MCP-invoked commands, and the use of `glab api` for direct access to REST and GraphQL APIs. It also discusses future improvements for agent-aware help text and machine-readable errors.
  48. GitLab + Amazon: Platform orchestration on a trusted AI foundationThis post details the integration of GitLab Duo Agent Platform with Amazon Bedrock, providing three deployment patterns: GitLab.com with GitLab-hosted AI Gateway and GitLab-operated Bedrock models; GitLab Self-Managed with GitLab-hosted AI Gateway and GitLab-operated Bedrock models; and GitLab Self-Managed with self-hosted AI Gateway and customer-operated Bedrock models. It emphasizes how this integration addresses operational fragmentation, security and sovereignty concerns, and cloud spend optimization by consolidating DevSecOps orchestration and AI model governance within existing AWS infrastructure. The post highlights the benefits for platform teams in standardizing AI model usage for code suggestions, security analysis, and pipeline remediation, and for enterprises to align developer AI usage with existing cloud agreements.
  49. Prepare your pipeline for AI-discovered zero-daysThis post details the evolution of AI-assisted features in DevSecOps by introducing AI-driven security vulnerability detection and remediation within the CI/CD pipeline. It describes how AI models can identify zero-day vulnerabilities, assess their reachability and exploitability, and automate remediation suggestions. The post emphasizes the importance of embedding these capabilities directly into the pipeline as the enforcement point for security policies, ensuring that fixes are proposed, reviewed, and merged through the same auditable process as human-authored code. It highlights the need for security to run at the speed of AI coding and outlines what a 'ready pipeline' looks like in this new paradigm, including automated triage, policy enforcement at the point of change, and AI-assisted remediation.
  50. Automate remediation with ready-to-merge AI code fixesThis post introduces Agentic SAST Vulnerability Resolution, a new capability within GitLab Duo Agent Platform that automates the remediation of SAST vulnerabilities by generating ready-to-merge code fixes. It details the workflow: SAST scan completion triggers false positive detection, then confirmed true positives initiate the agentic resolution flow which analyzes, generates a fix, and validates it through automated testing. The post also highlights improvements in SAST scanning speed with incremental scanning, enhanced vulnerability prioritization using CVSS 4.0 and policy-based rules (including severity overrides based on CVE, CWE, file path/directory, KEV status, and EPSS score thresholds), and the introduction of a Security Manager role for security professionals and SAST configuration profiles for consistent scanner coverage across projects.
  51. CI Expert and Data Analyst AI agents target development gapsThis post introduces two new foundational AI agents for the Duo Agent Platform: CI Expert Agent (beta) and Data Analyst Agent (GA). CI Expert Agent automates `.gitlab-ci.yml` generation by inspecting repositories, detecting languages/frameworks, and proposing build/test configurations with plain-language explanations. Data Analyst Agent allows users to query GitLab development lifecycle data (MRs, issues, pipelines, jobs) using natural language, generating visualizations and GitLab Query Language (GLQL) queries. Both agents run within GitLab, leveraging its context for improved AI capabilities.
  52. Claude Opus 4.7 is now available in GitLab Duo Agent PlatformThis post announces the integration of Claude Opus 4.7 into the GitLab Duo Agent Platform. This new model offers improved reasoning capabilities for complex, long-running tasks, better instruction following for precise execution of multi-step workflows, and enhanced output verification. These improvements are expected to make agents more efficient and reliable across CI/CD pipelines, code review, vulnerability remediation, and other agent-powered workflows.
  53. GitLab and Vertex AI on Google Cloud: Advancing agentic developmentThis post details the integration of the GitLab Duo Agent Platform with Google Cloud's Vertex AI. It explains how Vertex AI powers the model tier for agent calls, providing enterprise-grade reliability and a broad model ecosystem. The integration enables agentic workflows across the full SDLC, from planning to security review and delivery, by leveraging Vertex AI's models for reasoning, tool use, and long-context understanding. It highlights the benefits for Google Cloud customers, including streamlined software delivery, maintained enterprise governance, and normalized AI model usage. The post also mentions the ability for customers to use Bring Your Own Model (BYOM) for Duo Agent Platform.
  54. GitLab Duo CLI: Agentic AI now in the terminalThis post introduces GitLab Duo CLI, which extends agentic AI capabilities to the terminal. It supports two modes: interactive (human-in-the-loop approval) and headless (for automation in CI/CD and scripts). Key security features include prompt injection detection and composite identity for auditable actions. It also supports custom instruction files for least privilege AI execution. The CLI integrates with the existing `glab` CLI or can be used standalone.
  55. Manage vulnerability noise at scale with auto-dismiss policiesIntroduces auto-dismiss vulnerability policies that allow users to define rules in a YAML file to automatically dismiss findings based on file path, directory, or vulnerability identifier. Provides ready-to-use configurations for dismissing vulnerabilities in test code, vendored/third-party code, known false positive CVEs, generated code, infrastructure-mitigated vulnerabilities, and CVE families. Details the process of defining, merging, and activating these policies, and how they are applied during default-branch pipelines. Explains the criteria types (file_path, directory, identifier) and dismissal reasons.
  56. Agentic code reviews for $0.25 eachThis post introduces Code Review Flow, an agentic AI capability within the GitLab Duo Agent Platform, which provides AI-powered code reviews at a flat rate of $0.25 per review. It details the multi-step review process: scanning changes, exploring repository context, checking against pipeline, security findings, and compliance requirements, and generating structured inline feedback. The post highlights the cost savings compared to manual reviews (99% reduction) and the benefit of parallel processing for unblocking review queues. It also mentions the ability to define custom merge review instructions per project and the integration with GitLab Credits for consumption.
  57. GitLab 18.10 brings AI-native triage and remediationThis post introduces three new AI-powered security capabilities in GitLab 18.10: SAST false positive detection (GA), Agentic SAST vulnerability resolution (beta), and Secret false positive detection (beta). SAST false positive detection uses LLMs for agentic reasoning to assess the likelihood of a vulnerability being a false positive, providing a confidence score and explanation. Agentic SAST vulnerability resolution automatically generates and validates proposed fixes for SAST vulnerabilities, creating merge requests with concrete code changes and explanations. Secret false positive detection flags dummy and test secrets to reduce review effort. These features are available to GitLab Ultimate customers using the GitLab Duo Agent Platform.
  58. GitLab 18.10: Agentic AI now open to even more teams on GitLabIntroduces GitLab Credits as a purchasable, usage-based option for Free tier teams to access agentic AI capabilities, including Planner Agent, Developer Flow, Code Review Flow, and Fix CI/CD Pipeline Flow. Establishes a flat rate of 0.25 GitLab Credits per automated code review. Details how these credits can be managed via a dashboard and purchased through group billing settings. Highlights the economic benefits and workflow improvements of using agentic AI for planning, code generation, automated code review, and pipeline diagnosis.
  59. Automating detection gap analysis with GitLab Duo Agent PlatformThis post details the implementation of AI agents within the GitLab Duo Agent Platform for automating detection gap analysis in security incidents. It describes the use of the pre-built Security Analyst Agent for initial analysis and the creation of a custom Detection Engineering Assistant agent. The custom agent's system prompt is elaborated upon, emphasizing clear role definition, encoding detection philosophy, providing tech stack context, grounding in MITRE ATT&CK, and setting output format expectations. The workflow of using these agents on closed incident issues is explained, along with lessons learned regarding system prompt iteration, incident documentation quality, and the role of AI as a force multiplier.
  60. Extend GitLab Duo Agent Platform: Connect any tool with MCPThis post details the technical integration of the GitLab Duo Agent Platform with Jira via the Model Context Protocol (MCP). It outlines the steps for configuring Jira OAuth applications (client ID, client secret, scopes) and setting up the `mcp.json` configuration file within a GitLab project. It also demonstrates how to enable MCP in GitLab group settings and verify the connection through IDE prompts and the MCP Dashboard. Three practical use cases are presented: a planning assistant for querying and prioritizing Jira issues, an issue triage and creation workflow from code context, and a cross-system incident investigation process correlating Jira incidents with GitLab merge requests and deployments. Security considerations for OAuth tokens and least privilege are also discussed.
  61. 10 AI prompts to speed your team’s software deliveryThis post introduces 10 specific AI prompts from the GitLab Duo Agent Platform Prompt Library designed to accelerate software delivery by addressing common team-level bottlenecks. It details prompts for improving code review (identifying logical errors, breaking changes), shifting security left (analyzing scan results, reviewing code for security issues), keeping documentation current (generating release notes, updating docs), breaking down planning complexity (decomposing epics), expanding test coverage (generating unit tests, reviewing gaps), and reducing debugging time (debugging failing pipelines). The post emphasizes applying AI across the entire software lifecycle beyond just coding.
  62. AI can detect vulnerabilities, but who governs risk?This post introduces the concept of governing AI-generated code and agentic workflows within the DevSecOps lifecycle. It argues that while AI can detect vulnerabilities, human-defined governance, context, and continuous assurance are crucial for managing risk and ensuring trustworthiness at scale. It contrasts LLMs' isolated code evaluation with platforms that provide broader context, emphasizing that risk decisions are contextual and dynamic. The post positions GitLab as an orchestration layer for end-to-end software lifecycle governance, enabling enforcement, visibility, and auditability for AI-assisted development.
  63. GitLab Duo Agent Platform with Claude accelerates developmentThis post introduces the GitLab Duo Agent Platform, which enables the integration of external AI models (like Claude) to create custom agents within GitLab. It details three use cases: 1) generating a full-stack Java web application from an issue description, including backend, frontend, and build configuration, and creating a merge request; 2) performing a comprehensive code review of the generated application, providing detailed analysis of strengths, issues, security, and recommendations; and 3) automatically generating a CI/CD pipeline to build a Docker image and deploy it to the GitLab container registry. The post highlights how these agents understand project context and adhere to organizational standards.
  64. Secure and fast deployments to Google Agent Engine with GitLabThis post details the integration of GitLab CI/CD with Google Cloud's Agent Engine for deploying AI agents. It covers configuring Workload Identity Federation for secure IAM between GitLab and Google Cloud, setting up a `.gitlab-ci.yml` file that includes GitLab's built-in security scanning templates (Dependency Scanning, SAST, Secret Detection) and uses the `adk deploy agent_engine` command for deployment, and verifying the deployed agent in Vertex AI. The post also provides a `curl` command for testing the deployed agent.
  65. Agentic SDLC: GitLab and TCS deliver Intelligent Orchestration across the enterpriseThis post details the partnership between GitLab and TCS to deliver 'Intelligent Orchestration' across the enterprise SDLC. It introduces the GitLab Duo Agent Platform as a key component for enabling AI agents to collaborate with developers on tasks like coding, reviews, testing, security, and CI/CD. The post emphasizes the shift from DevSecOps to Intelligent Orchestration, where AI agents work within GitLab's unified data model, creating merge requests, improving code, and supporting compliance. It highlights the role of platform engineering in creating an Internal Developer Platform (IDP) with self-service golden paths, where GitLab acts as the control plane and TCS industrializes adoption. The reference architecture diagram illustrates the integration of experience layer, platform control plane, guardrails, infrastructure, and runtime.
  66. Agentic AI, enterprise control: Self-hosted Duo Agent Platform and BYOMIntroduces self-hosted GitLab Duo Agent Platform for online cloud licenses with usage-based billing via GitLab Credits, enabling data residency and control. Also introduces 'Bring Your Own Model' (BYOM) functionality, allowing connection of third-party or self-hosted models via the GitLab AI Gateway for integrated governance and granular mapping to agent flows.
  67. Track vulnerability remediation with the updated GitLab Security DashboardThe updated GitLab Security Dashboard now includes trend tracking, vulnerability age distribution, and risk scoring by project. New filters and charts in the 18.9 release allow users to slice data by severity, status, scanner, or project. The risk score calculation incorporates vulnerability age, EPSS, and KEV scores. The dashboard aims to help teams track program effectiveness, focus on targeted remediation, identify areas for training, and reduce manual reporting.
  68. Claude Opus 4.6 now available in GitLab Duo Agent PlatformThis post introduces the availability of Claude Opus 4.6 within the GitLab Duo Agent Platform. It highlights the model's advanced agentic capabilities, its 1 million token context window for processing large codebases and documentation, and its integration with GitLab's DevSecOps data. The post details how Claude Opus 4.6 can be used for agentic development and agentic chat, and explains its credit usage multipliers. It also notes that while available in the Duo Agent Platform, it is not yet available for GitLab Duo Classic features or supported IDEs, with those integrations coming soon.
  69. Announcing general availability for GitLab Duo Agent PlatformThis post announces the general availability of the GitLab Duo Agent Platform, a significant expansion of AI capabilities within GitLab. It introduces agentic AI automation across the software development lifecycle, addressing the 'AI paradox' by moving beyond code authoring to automate reviews, security checks, compliance, and bug fixes. Key new components include Agentic Chat for multi-step reasoning and autonomous actions, foundational agents (Planner, Security Analyst), the AI Catalog for custom agent creation, and integration with external agents (Anthropic Claude, OpenAI Codex). It also details 'Flows' for automating complex tasks (e.g., Issue to MR, CI/CD conversion/fixing, Code Review) and the MCP Client for connecting IDEs to external tools like Jira and Slack. The platform offers flexible model selection (OpenAI, Mistral, Llama, Claude) and deployment options (GitLab.com, Self-Managed, Dedicated).
  70. Introducing GitLab CreditsIntroduced GitLab Credits as a new virtual currency for usage-based pricing, specifically for GitLab Duo Agent Platform. This model replaces seat-based pricing for AI, allowing pooled credits across an organization for agentic AI usage. It supports foundational agents, external agents, custom flows, and agentic chat. Usage is drawn down from these credits, with consumption rates varying by LLM. The post details cost governance features including sizing calculators, usage visibility dashboards, usage controls, and automated notifications. Existing Premium and Ultimate customers receive promotional included credits. It also outlines the competitive advantages of this model over traditional seat-based pricing.
  71. AI Catalog: Discover, create, and share agents and flowsThis post introduces the AI Catalog, a new feature within the GitLab Duo Agent Platform. It details how users can discover, enable, create, share, and manage visibility for AI agents and flows. The post explains the different types of catalog items (Agents, Flows, MCP servers), how to access the catalog, and the process of creating custom agents and flows with specific prompts and tool access. It also covers versioning for custom agents and flows, emphasizing immutability and manual opt-in for updates, and outlines best practices for sharing and naming these AI components.
  72. Getting started with GitLab Duo Agentic ChatThis post introduces GitLab Duo Agentic Chat as a primary interface for interacting with AI agents, enabling autonomous actions like code modification, issue triaging, and workflow execution within the SDLC. It details access methods across Web UI, IDEs (VS Code, JetBrains, Visual Studio), and CLI, along with model and agent selection (GitLab Duo, Planner, Security Analyst, Data Analyst, CI Expert, Custom Agents). Common use cases are elaborated with example prompts for issue management, vulnerability analysis, code understanding, project onboarding, debugging, code review, feature implementation, and refactoring. Troubleshooting tips for chat visibility and model selection unavailability are also provided.
  73. Introduction to GitLab Duo Agent PlatformThis post introduces the GitLab Duo Agent Platform, an AI orchestration layer designed to integrate specialized AI agents into the full SDLC. It addresses the 'AI Paradox' by providing enterprise governance and security alongside developer experience. Key components include Duo Agentic Chat, Duo CLI, Custom Flows, Foundational Flows (e.g., Software Development, Fix CI/CD Pipeline, Code Review, SAST Vulnerability Resolution), and External Agents (e.g., Claude, OpenAI Codex). Agents are specialized with prompts and tools, accessing project context like code, issues, and security scans. Flows are multi-step, asynchronous workflows executed via runners. The AI Catalog serves as a hub for discovering, creating, and sharing agents and flows.
  74. Monitor, manage, and orchestrate AI workflowsThis post details the user interface and functionality for managing AI agents and flows within GitLab projects. It introduces the AI menu with sections for Agents, Flows, Triggers, Sessions, and MCP Servers. It explains how to view, enable, and manage agents and flows, and how to set up event-driven triggers based on GitLab SDLC events (Mention, Assign, Assign Reviewer). It also describes the Sessions view for monitoring agent and flow execution, including status, reasoning, and tool usage. The post links to documentation for creating custom agents and flows, and for triggers and sessions.
  75. Understanding agents: Foundational, custom, and externalThis post introduces and categorizes different types of AI agents within the GitLab Duo Agent Platform: foundational (GitLab Duo Chat, Planner, Security Analyst, Data Analyst, CI Expert), custom (user-defined for team-specific workflows), and external (integrating with specialized AI providers like Anthropic Claude, OpenAI Codex, Amazon Q, and Gemini). It details the use cases, configuration methods (especially system prompts for custom agents), and best practices for each type. It also explains how external agents are triggered and interact with GitLab, including the use of GitLab-managed credentials and user-provided credentials for different providers. The post emphasizes the role of these agents in enhancing development tasks, planning, security analysis, data insights, and CI/CD optimization.
  76. Understanding flows: Multi-agent workflowsThis post introduces the concept of 'flows' within the GitLab Duo Agent Platform, defining them as orchestrated multi-agent workflows executed on GitLab's compute infrastructure. It details the characteristics of flows (multi-agent orchestration, built-in execution, event-driven, asynchronous, complete workflows) and contrasts them with interactive agents. The post categorizes flows into 'Foundational' (maintained by GitLab for common development tasks like code review, vulnerability resolution, and CI/CD fixes) and 'Custom' (user-created for specific organizational needs like compliance checking, documentation generation, and dependency management). It outlines various triggering mechanisms for custom flows, including mentions, assignments, reviewer assignments, and pipeline events. A YAML example demonstrates the structure of a custom flow for feature implementation, specifying components, prompts, toolsets, and execution logic.
  77. AI-powered vulnerability triaging with GitLab Duo Security AgentIntroduces the GitLab Duo Security Analyst Agent, a foundational agent for automating vulnerability analysis and triaging. Details how to enable integrated security scanners (SAST, Dependency Scanning, Container Scanning, DAST, Secret Detection, IaC Scanning, API Security Testing, API Fuzzing) and use the Vulnerability Report. Explains the agent's capabilities in evaluating exploitability, reachability, risk prioritization, and recommending remediation steps. Outlines prerequisites (Ultimate subscription, Duo Agent Platform enabled, scanners configured) and how to access the agent via the AI Catalog.
  78. Building trust in agentic tools: What we learned from our usersThis post details research findings on building user trust in AI agents, identifying four key pillars: safeguarding actions (confirmation dialogs, rollback, secure boundaries), providing transparency (progress updates, action explanations, clear error handling), remembering context (preference retention, context awareness, adaptive learning), and anticipating needs (pattern recognition, intelligent agent selection, environment analysis). It suggests practical implementations like starting with low-risk environments, designing for continuous orchestration with intervention, maintaining audit trails, and personalizing experiences. The research highlights that trust accumulates through 'micro-inflection points' rather than single 'aha' moments, which is critical for enterprise adoption of agentic tools in DevSecOps.
  79. GitLab 18.7: Advancing AI automation and developer experienceThe 18.7 release introduces several key advancements for the GitLab Duo Agent Platform and DevSecOps workflows. Custom Flows allow for YAML-defined, event-triggered automation of multi-step tasks like pipeline diagnosis and dependency updates. The SAST False Positive Detection Flow uses AI to identify and dismiss false positives, improving triage efficiency and reducing noise. Custom Agent Versioning provides granular control over agent and flow updates, preventing breaking changes and enabling staged rollouts. Foundational Agents can now be enabled/disabled by admins at instance/group levels. The Data Analyst Agent allows natural language querying of GitLab data via GLQL. Core DevOps sees Dynamic Input Selection for pipelines, enabling context-aware cascading dropdowns, and CI/CD Catalog Publication Guardrails for administrators to control component publishing. Platform Security introduces Warn Mode for MR Approval Policies, allowing policy violations without blocking merges and auditing actions.
  80. Automate embedded systems compliance with GitLab and CodeSonarThis post introduces the integration of GitLab with CodeSonar for automated compliance in embedded systems. It details how CodeSonar, a static analysis tool, can be integrated into GitLab CI/CD pipelines to scan C/C++ code for vulnerabilities and compliance with standards like MISRA C/C++ and ISO 26262. The integration surfaces SAST findings in merge requests and leverages GitLab Duo AI for vulnerability explanation and remediation recommendations. The workflow demonstrates continuous verification from commit to merge, with automated policy enforcement and evidence collection for audit trails.
  81. GitLab 18.6: From configuration to controlIntroduces default availability of GitLab Duo Planner and Security Analyst agents, group-level awareness for Planner, and support for the gpt-oss-120b open-source model in self-hosted environments. Enables end-user model selection for cloud-connected self-managed instances and Web IDE support for air-gapped deployments. Adds custom business context labels for project/group security attributes for risk-based filtering of scan results.
  82. GitLab engineer: How I improved my onboarding experience with AIThis post details an engineer's practical application of GitLab Duo for onboarding, code exploration, review, and debugging. It highlights specific prompts and use cases for searching documentation across multiple sources, identifying edge cases and dependencies for issues, understanding reviewer comments, and debugging pipeline failures using Agentic Chat. The post emphasizes how AI assistance accelerates learning, improves code quality, and enhances efficiency in the software development lifecycle.
  83. Ace your planning without the context-switchingThis post introduces GitLab Duo Planner, a new AI agent built on the GitLab Duo Agent Platform. It focuses on automating and streamlining product planning workflows for product managers and engineering managers. The agent leverages GitLab's work item structure (epics, issues, tasks) and understands Agile frameworks like RICE and MoSCoW to assist with prioritization, work breakdown, dependency analysis, sprint planning, status reporting, and backlog management. It operates within the GitLab platform, reducing context-switching and providing context-aware insights.
  84. Modernize Java applications quickly with GitLab Duo with Amazon QThis post details the integration of GitLab Duo with Amazon Q to automate Java application modernization. It describes the workflow of creating an issue, using the `/q transform` command to trigger an automated analysis of the codebase, and generating a merge request with code and build configuration updates for Java 17. The post highlights the benefits of time reduction, minimized risk, and a complete audit trail.
  85. Delivering faster and smarter scans with Advanced SASTIntroduced performance enhancements to Advanced SAST, including multi-core scanning (up to 50% reduction in scan time), diff-based scanning (under 10 minutes for large repos in MRs), and algorithmic optimizations (up to 71% reduction on large codebases). Added the ability for users to define custom, pattern-based detection rules using TOML files to catch organization-specific issues, complementing the built-in ruleset.
  86. GitLab 18.5: Intelligence that moves software development forwardIntroduces the Security Analyst Agent for automated vulnerability triage, the Duo Planner for backlog management, and integrates external AI tools (Claude, OpenAI Codex, Gemini CLI, Amazon Q Developer, OpenCode) into the AI Catalog as native GitLab agents. Moves self-hosted Duo Agent Platform to beta. Adds Static Reachability Analysis for Java to identify exploitable vulnerabilities in dependencies. Introduces Secret Validity Checks to distinguish active from expired GitLab-issued security tokens. Adds Custom Rules for Advanced SAST and C/C++ language support for Advanced SAST.
  87. Claude Haiku 4.5 now available in GitLab Duo Agentic ChatThis post introduces the availability of Claude Haiku 4.5 within the GitLab Duo Agent Platform Agentic Chat. It highlights the model's speed and coding performance, and its role in multi-agent orchestration for efficient agentic workflows. It also details where users can access this model and its key capabilities.
  88. Greater AI choice in GitLab Duo: Claude Sonnet 4.5 arrivesThis post announces the integration of Claude Sonnet 4.5 into the GitLab Duo Agent Platform, offering users a new model choice for AI-assisted development. It highlights the model's capabilities in coding, cybersecurity, finance, and research, and its availability within the Agentic Chat feature on GitLab.com. The post emphasizes how the GitLab Duo Agent Platform orchestrates agents and integrates them into the software lifecycle, providing platform-wide context and security.
  89. Agentic AI guides and resourcesThis post introduces and elaborates on agentic AI, defining it as AI that can take independent action and execute multi-step plans. It highlights various GitLab blog posts and resources related to agentic AI, including the GitLab Duo Agent Platform, GitLab Duo with Amazon Q, and best practices for implementing AI agents. Specific technical advancements mentioned include custom agents, knowledge graph context, pipeline auto-fixing, AI-powered test generation, code review acceleration, and automated implementation of code review feedback.
  90. Model Context Protocol integrationThis post introduces the Model Context Protocol (MCP) integration into the GitLab Duo Agent Platform. It details how GitLab acts as both an MCP client (connecting Duo Agentic Chat to external tools like Jira, Slack, Grafana) and an MCP server (allowing external AI tools like Claude Desktop and Cursor to securely access GitLab data for issues, merge requests, pipelines, and search). It outlines the setup for MCP clients, including feature preview enablement, group settings, `mcp.json` configuration for various server types (stdio, http, sse), and IDE integration. It also provides an example project demonstrating an incident response scenario with mock data and discusses the security considerations for AWS integration. The MCP server capabilities are detailed, listing supported operations for issues, merge requests, pipelines, work item notes, search, and server info.
  91. GitLab 18.4: AI-native development with automation and insightGitLab 18.4 introduces the AI Catalog for creating and sharing custom agents, Agentic Chat with improved session management and user-level model selection, and the GitLab Knowledge Graph for code navigation. It also adds the Fix Failed Pipelines Flow for business-aware pipeline maintenance and GitLab Duo Context Exclusion for granular data protection. New MCP tools are also added to extend agent capabilities.
  92. GitLab named a Leader in the 2025 Gartner Magic Quadrant for AI Code AssistantsThis post announces GitLab's recognition as a Leader in the Gartner Magic Quadrant for AI Code Assistants. It details the evolution from GitLab Duo's generative AI code assistance to the GitLab Duo Agent Platform, which introduces agentic AI natively into the DevSecOps platform. Key advancements include specialized agents for tasks like code generation and security analysis, a Knowledge Graph for unified context, human-agent collaboration via chat, and interoperability with external tools. The platform emphasizes security and compliance with agents running within the DevSecOps environment and human oversight. It aims to enhance developer productivity, provide visibility for engineering leaders, and maintain control for IT organizations through governance features.
  93. Vibe coding with GitLab Duo Agent Platform: 'Issue to MR' FlowIntroduces the 'Issue to MR' flow within the GitLab Duo Agent Platform, which automates the process of converting a well-scoped issue into a draft merge request. This flow analyzes issue descriptions, creates a development plan, proposes code implementations, and links the MR to the issue. It details the prerequisites, steps for using the flow, and highlights benefits such as reduced development overhead, automated file location, and streamlined review processes. The post also elaborates on the broader benefits of the GitLab Duo Agent Platform, including its agentic orchestration capabilities, unified data model, built-in security, interoperability, and scalability.
  94. Why enterprise independence matters more than ever in DevSecOpsThis post elaborates on the GitLab Duo Agent Platform's general availability, focusing on enterprise independence, transparency, and data governance in AI-driven DevSecOps. It highlights the AI Transparency Center for clear data governance practices and privacy protections, emphasizing that customer data is not used for AI training. The post details model flexibility and vendor independence, contrasting GitLab's multi-model support with vendor lock-in. It introduces an AI continuity plan for rapid model switching and discusses deployment choices (on-premises, multi-tenant SaaS, GitLab Dedicated) and cloud neutrality. Security and compliance are emphasized as built-in features, not afterthoughts, with mention of custom compliance frameworks, DAST, and API fuzz testing. The post also touches on community engagement through the Co-Create program and the open issue tracker, reinforcing the commitment to transparency and customer control over data.
  95. GitLab 18.3: Expanding AI orchestration in software engineeringThis post details the expansion of GitLab's AI orchestration capabilities, focusing on integrating AI natively across its platform. Key technical contributions include the development of a Knowledge Graph for indexing and stitching code with unstructured data, an Orchestration Layer with event subscriptions, an orchestration engine for multi-agent flows, and exposure of GitLab tools via MCP and standard protocols. New integrations include an MCP server for universal AI integration (with Cursor and Amazon Q mentioned), CLI agent support for Claude Code, Codex, Amazon Q, Google Gemini, and opencode (BYOK), and agentic chat support for Visual Studio IDE. New automated development flows are introduced: 'Issue to MR Flow' for automated code generation from issues to MRs, and 'Convert CI File Flow' for migrating CI/CD configurations (initially supporting Jenkins). The Knowledge Graph is enhanced for real-time code indexing and faster code searches.
  96. Custom rules in GitLab Duo Agentic Chat for greater developer efficiencyThis post introduces and details the implementation of custom rules for GitLab Duo Agentic Chat. It explains how to create and apply these rules using Markdown in `.gitlab/duo/chat-rules.md` to enforce specific development standards, such as language versions (Java 8, C++ multi-platform), style guides (VueJS, C goto anti-patterns, Ansible linters), and DevSecOps workflows (CI/CD configuration, security scanning, documentation standards). It provides concrete examples, links to demo projects, and guidelines for developing and distributing these custom rules, enabling developers to personalize AI assistants for greater efficiency and adherence to team-specific requirements.
  97. Get started with GitLab Duo Agentic Chat in the web UIThis post introduces the integration of GitLab Duo Agentic Chat directly into the GitLab UI, enabling users to interact with GitLab APIs and perform actions. It details how to access Agentic Chat, its capabilities in issue management (finding, summarizing, updating issues with specific criteria and bulk operations), and CI/CD support (analyzing pipeline failures, suggesting fixes, and applying them via merge requests). It also provides guidance on building complex prompts and tips for effective prompting, emphasizing action-oriented verbs and clear criteria for bulk operations. The post highlights the ability to chain requests and leverage the agent's context maintenance for iterative refinement.
  98. Own your AI: Self-Hosted GitLab Duo models with AWS BedrockThis post details the implementation of self-hosted GitLab Duo models using AWS Bedrock. It outlines the architecture involving the AI Gateway and AWS Bedrock as the LLM backend, including prerequisites and step-by-step instructions for installing the AI Gateway (Docker/Helm), configuring GitLab to connect to it, requesting access to AWS Bedrock models, configuring specific Bedrock models within GitLab, and assigning these models to GitLab Duo features. Verification steps include running a health check, testing Duo features (Chat, Code Suggestions), and checking AI Gateway logs. It also provides guidance on selecting appropriate models for different use cases and mentions alternative deployment options like vLLM and Azure OpenAI Service.
  99. Software supply chain security guide: Why organizations struggleThis post details how AI is changing the software supply chain security landscape by introducing new attack vectors and amplifying existing ones. It highlights AI-powered attacks that are more sophisticated and scalable, and the new risks introduced by the AI development supply chain, including model supply chain attacks, insecure AI-generated code, compromised AI toolchains, automated reconnaissance, and shadow AI. The post also discusses why organizations struggle with supply chain security due to misconceptions, skills shortages, misaligned incentives, and tool complexity, and outlines the true price of supply chain insecurity in terms of time, reputation, regulatory compliance, and operational disruption. It critiques current approaches that focus on massive scanning over effective protection and highlight collaboration breakdowns, proposing a path forward through integrated DevSecOps platforms and developer-native solutions.
  100. Bridging the visibility gap in software supply chain securityGitLab 18.2 introduces two new capabilities: Security Inventory and Dependency Path visualization. Security Inventory provides a centralized, portfolio-wide view of risk and scan coverage across GitLab groups and projects, helping identify blind spots and prioritize mitigation. Dependency Path visualization displays the full route from a top-level package to a vulnerable component following an SCA scan, clarifying how open source vulnerabilities are introduced through the dependency chain and aiding developers in pinpointing fixes.
  101. GitLab Duo Agent Platform goes public betaThis post announces the public beta of the GitLab Duo Agent Platform, introducing the concept of AI agents and agent Flows for orchestrating complex tasks within the DevSecOps lifecycle. It details the vision for asynchronous collaboration between developers and AI agents, highlighting the unique advantage of GitLab's unified platform context. Specific agents (Chat, Software Developer, Product Planning, Software Test Engineer, Code Reviewer, Platform Engineer, Security Analyst, Deployment Engineer, Deep Research) and Flows (Software Development, Issue-to-MR, Convert CI File, Search and Replace, Incident Response & Root Cause Analysis) are described, emphasizing their ability to interact with GitLab artifacts and leverage the GitLab Knowledge Graph. The post also outlines the strategic evolution from AI features to agent orchestration and the roadmap towards general availability.
  102. 3 best practices for building software in the era of LLMsThis post introduces three best practices for building software in the era of LLMs: 1. Never trust, always verify AI-generated code, treating it like input from a junior developer requiring review. It highlights GitLab Duo Code Review as a tool to enhance human judgment. 2. Prompt for secure patterns by including security requirements (input validation, rate limiting, phishing-resistant auth) in LLM prompts, referencing OWASP best practices. 3. Scan everything without exceptions, emphasizing the critical role of SAST, SCA, and Secret Detection in mitigating risks from increased code volume and AI-generated code. It positions GitLab's integrated security features as essential for maintaining speed and security.
  103. Accelerate learning with GitLab Duo Agent PlatformThis post demonstrates the use of the GitLab Duo Agent Platform to automate the generation of documentation for a Golang project's gRPC communication flow. It highlights the agent's ability to analyze code, identify relevant files, understand gRPC implementations, and generate a Mermaid diagram with detailed payload structures. The process involves user interaction for collaborative refinement, leading to a significant reduction in manual code analysis time.
  104. Fast and secure AI agent deployment to Google Cloud with GitLabThis post details the technical steps for deploying an AI agent to Google Cloud Run using GitLab CI/CD. It covers setting up Workload Identity Federation for secure, keyless authentication between GitLab and Google Cloud, configuring integration with Google Artifact Registry for container image storage, and creating a CI/CD pipeline using GitLab CI/CD components. The pipeline includes stages for building Docker containers, running security scans (dependency, SAST, secret detection), uploading to Artifact Registry, and deploying to Cloud Run. It also outlines the necessary IAM roles for Cloud Run deployment and provides a concrete example of a multi-agent application (Canada City Advisor).
  105. Enhance application quality with AI-powered test generationIntroduces AI-powered unit test generation for Java code within GitLab merge requests using GitLab Duo with Amazon Q. The process involves selecting a Java class in a merge request, invoking Amazon Q via the `/q test` command in an issue comment, and the AI analyzing the code to generate comprehensive unit tests. The generated tests cover happy paths, edge cases, and error conditions, adhering to project conventions. This feature aims to reduce manual test writing time, ensure broad test coverage, maintain consistent quality, and accelerate the overall development velocity.
  106. GitLab catches MongoDB Go module supply chain attackThis post details the development and application of an automated detection system for software supply chain attacks. The system combines automated typosquatting detection, semantic code analysis, and AI-assisted initial screening to proactively identify malicious dependencies. It was used to detect a typosquatting attack on a MongoDB Go module, including the technical details of the multi-layered malicious payload and the rapid redeployment of a second malicious module. The post also outlines GitLab's approach to proactive dependency monitoring and provides recommendations for staying ahead of supply chain threats, including indicators of compromise.
  107. Speed meets governance: Model Selection comes to GitLab DuoIntroduces GitLab Duo Model Selection, a new capability allowing namespace owners to configure which LLMs are used for GitLab Duo features. This provides governance and compliance control by enabling selection from pre-approved vendor lists or the GitLab default model. The feature is available in private beta for Duo Enterprise customers on GitLab.com.
  108. GitLab Duo Agent Platform: What’s next for intelligent DevSecOpsIntroduces the GitLab Duo Agent Platform, a new capability enabling many-to-many collaboration between engineers and AI agents across the full software development lifecycle. Highlights include parallel task delegation to specialized agents, integration with various developer tools and models (including self-hosted), deep project context awareness for agents, an agent approval workflow for controlled autonomy, and a framework for community-built agents. Beta waitlist is open, with GA expected winter.
  109. Accelerate code reviews with GitLab Duo and Amazon QIntroduces the integration of GitLab Duo with Amazon Q Service for agentic AI-powered code reviews. Users can trigger reviews via the '/q review' command in merge requests. Amazon Q Service analyzes code changes for bugs, readability, syntax, and coding standards, providing actionable feedback and suggestions for fixes. This feature aims to accelerate code reviews, improve code quality, and reduce deployment times.
  110. Why are organizations moving to a unified DevSecOps platform?This post details the integration of AI-powered development tools into GitLab's DevSecOps platform. It highlights the capabilities of GitLab Duo, including SAST false positive detection, agentic SAST vulnerability resolution, and general AI assistance across the development lifecycle (task generation, summarization, code review, test generation, security vulnerability detection, and CI failure analysis). It also introduces GitLab Duo Self-Hosted for organizations requiring on-premises AI model deployment to ensure data privacy, compliance, and security.
  111. GitLab Duo Chat gets agentic AI makeoverIntroduces GitLab Duo Agentic Chat, an evolution of GitLab Duo Chat that transforms conversational AI into an AI that takes action on behalf of the developer. Agentic Chat can autonomously determine information needs, execute operations, formulate comprehensive responses, and create/modify files. It is built on the Duo Workflow architecture and is currently in experimental release in VS Code. The post details a four-step workflow demonstration: understanding the project, understanding the assigned task, implementing the solution by making edits, and verifying completion by analyzing the merge request against the issue. Known limitations include slower response times, keyword-based search, and limited support for new local folders or non-GitLab projects. Future plans include improving response times, adding capabilities like self-hosted models, supporting JetBrains and Visual Studio, bringing Agentic Chat to the GitLab web application, and adding functionality like editing GitLab artifacts and running commands in the terminal.
  112. What is a large language model (LLM)?This post introduces the fundamental concepts of Large Language Models (LLMs), explaining their training processes (supervised and unsupervised learning), neural network architectures (transformers), and predictive text generation capabilities. It then details their applications within a DevSecOps context, covering code generation, documentation, incident management, CI/CD pipelines, and security/compliance. The benefits of LLMs such as increased productivity, improved code quality and security, and accelerated development lifecycles are also discussed.
  113. Refactoring JavaScript to TypeScript with GitLab Duo WorkflowThis post details the technical process of refactoring a JavaScript file to TypeScript using GitLab Duo Workflow. It outlines the challenge of manual JS-to-TS migration, highlighting the need for type analysis, edge case handling, consistency management, dependency handling, and runtime validation. The post explains how Duo Workflow analyzes code contextually (identifying Pinia store, GraphQL imports, and dependencies), plans a multi-step execution (creating new TS file, defining interfaces, copying and annotating code, updating imports), and executes these steps with human approval. It emphasizes the task-oriented nature of Duo Workflow, its contextual understanding of the codebase, and its step-by-step execution with visibility, contrasting it with suggestion-only AI assistants.
  114. Unlocking AI for every GitLab Premium and Ultimate customerThis post announces the inclusion of GitLab Duo Code Suggestions and Chat in GitLab Premium and Ultimate tiers at no additional cost, starting with GitLab 18.0. It also details the availability of Duo Enterprise for purchase by GitLab Premium customers. The post reiterates the core functionalities of Duo Code Suggestions (generating code, intelligent completions) and Duo Chat (explaining code, refactoring, generating tests, fixing issues), and mentions other Duo Enterprise features like Root Cause Analysis, Code Review, Advanced Chat, and Self-Hosted options. It also briefly mentions recent improvements to Premium features like the CI/CD Catalog, artifact registry, and remote development.
  115. Automate tedious coding tasks with GitLab Duo WorkflowThis post introduces GitLab Duo Workflow, a new agentic AI solution integrated into VS Code. It demonstrates how Duo Workflow can automate complex coding tasks, specifically the implementation of a new lint rule and subsequent file updates across a codebase. The workflow involves reading issue details, analyzing project structure, planning changes, drafting new rules, making consistent code modifications, and staging changes for review. The key technical contribution is showcasing the agentic capability to understand project context and make coordinated, multi-file changes, moving beyond simple text replacements.
  116. GitLab Duo + Amazon Q: Transform ideas into code in minutesThis post details the integration of GitLab Duo with Amazon Q, enabling developers to generate code directly from issue descriptions. The workflow involves creating a GitLab issue with requirements, using a quick action '/q dev' to invoke Amazon Q, which then autonomously generates code, commits it in a merge request, and allows for review and testing. This significantly accelerates the development process by automating the translation of requirements into working code.
  117. Solving complex challenges with GitLab Duo WorkflowThis post details the use of GitLab Duo Workflow by a Customer Success Manager to implement a dynamic Helm chart limit configuration in the GitLab package registry. The solution involved modifying application settings via the Admin UI, updating a JSONB column, and altering backend logic in `app/finders/packages/helm/packages_finder.rb`. The prompt provided to Duo Workflow outlined specific frontend and backend changes, demonstrating agentic AI's capability to assist in code modification and problem-solving for complex technical issues.
  118. GitLab Duo with Amazon Q: Agentic AI optimized for AWS generally availableThis post announces the general availability of GitLab Duo with Amazon Q, integrating Amazon Q's agents into GitLab's DevSecOps platform for AWS customers. It highlights unified developer experience, end-to-end security with enterprise-grade guardrails, and specific use cases like feature development acceleration, legacy application modernization, quality assurance enhancement, code review optimization, and vulnerability remediation. The integration leverages AWS-specific patterns and practices, and a common data store across the SDLC for context.
  119. Use GitLab Duo Workflow to improve application quality assuranceThis post details the practical application of GitLab Duo Workflow for automated unit test generation in a Java project. It demonstrates the process of prompting the AI to create tests for a specific class, reviewing the generated plan, and approving its execution. It further illustrates how to address errors in the generated code by initiating a new workflow to fix dependency issues, specifically by updating the `pom.xml` file to include the correct JUnit dependency. The post highlights the agentic nature of the workflow in understanding project context and making code modifications.
  120. Enhance application security with GitLab + HackerOneThis post details the technical implementation and benefits of the HackerOne-GitLab integration. It explains how vulnerabilities found on HackerOne are automatically converted into GitLab issues, with bi-directional syncing of comments, state changes, and other relevant data. It also outlines the configuration steps, including OAuth 2.0 setup and field mapping. Additionally, it highlights GitLab's native security scanning capabilities (SAST, DAST, etc.) and how they integrate into the CI/CD pipeline to further secure applications.
  121. Strengthen data security with custom PII detection rulesetsThis post introduces the ability to create custom PII detection rulesets for GitLab Secret Detection by extending the default ruleset with custom TOML files. It details the steps to configure Secret Detection in CI/CD, create a custom ruleset file with regex patterns for PII (passport numbers, phone numbers, email addresses), and extend the default configuration. It also demonstrates how to test these custom rules with a sample data file and highlights the use of GitLab Duo Chat for generating regex patterns, with examples for Canadian Zip Codes. Best practices for PII detection and future enhancements like GitLab Duo Workflow are also mentioned.
  122. Vulnerability risk prioritization made simple with GitLabThis post introduces the integration of CVSS, KEV, and EPSS frameworks into GitLab's vulnerability management system. It details how these frameworks are displayed in the vulnerability report and insights pages, and how users can leverage them to prioritize remediation efforts. The post also provides instructions on adding security scanners (SAST, DAST, Dependency Scanning, Container Scanning, etc.) to CI/CD pipelines and managing vulnerability statuses with dismissal reasons.
  123. The GitLab AI Security Framework for security leadersThis post introduces the GitLab AI Security Framework, a new capability for security leaders to navigate the challenges of AI adoption. It details the genesis of AI security challenges, including responsibility and control uncertainty, risk assessment evolution, data protection complexities, and compliance navigation. The framework provides guidance on how GitLab and customers enable secure AI-powered development using GitLab Duo, including a responsibility matrix and highlights of how GitLab capabilities like prompt guardrails can help mitigate AI-specific security risks.
  124. GitLab Duo Self-Hosted: Enterprise AI built for data privacyThis post announces the general availability of GitLab Duo Self-Hosted for Code Suggestions and Chat. It details deployment flexibility across on-premises infrastructure, private clouds, AWS Bedrock, and Azure OpenAI. It highlights supported LLMs (Mistral, Anthropic Claude 3.5 Sonnet, OpenAI GPT models) and deployment options (vLLM serving platform). The post emphasizes maintaining control over sensitive data and intellectual property by isolating the GitLab instance, AI gateway, and LLMs within the customer's environment, supporting air-gapped deployments and offering granular control over data locality. It also mentions an AI abstraction layer that simplifies LLM integration.
  125. GitLab Duo Workflow: Enterprise visibility and control for agentic AIThis post announces the private beta waitlist for GitLab Duo Workflow, an agentic AI built on the GitLab DevSecOps platform. It details how Duo Workflow will automate project bootstrapping, code modernization, contextual task resolution, documentation generation, and test coverage enhancement. The core value proposition is leveraging GitLab's unified data store and DevSecOps platform to provide AI agents with comprehensive context, enabling them to act as development partners while maintaining enterprise-grade security and control. The post emphasizes the challenge of managing AI agents and the need for platform-integrated solutions over add-on tools.
  126. Certificate-based Kubernetes integration sunsetting on GitLab.comThis post announces the sunsetting of the certificate-based Kubernetes integration on GitLab.com in May 2026, extending the timeline from a previous announcement. It details the recommended alternative, the GitLab Agent for Kubernetes, highlighting its enhanced security, reliability, and advanced features. The post provides a comprehensive guide for users to assess their impact, migrate their CI/CD integrations, Auto DevOps configurations, and GitLab-managed clusters to the agent-based approach. It also explains how to manage cloud provider clusters directly after the deprecation and offers a phased migration strategy.
  127. How GitLab uses prompt guardrails to help protect customersThis post details GitLab's implementation of prompt guardrails for its AI features, specifically GitLab Duo. It explains the rationale behind prompt guardrails, focusing on mitigating risks like sensitive data exposure and malicious prompts. The technical implementation involves structured prompts with context boundaries (e.g., `<selected_code>`, `<log>`), filtering tools like Gitleaks for secrets scanning, and instruction tuning to guide AI behavior. It also discusses different approaches to guardrails (system-level filters, instruction tuning, sidecar/gateway solutions) and GitLab's hybrid strategy. Key lessons learned include balancing restrictiveness, the need for continuous updates, and the ongoing nature of security.
  128. Improve AI security in GitLab with composite identitiesIntroduces the concept of 'composite identities' for AI agents, linking them with human user principals to enhance security and auditability for resource access. This new paradigm protects confidential GitLab resources by requiring both the AI agent and the instructing human user to have access before granting resource access, preventing privilege escalation and ensuring clear audit trails. This is integrated with GitLab Duo with Amazon Q.
  129. Improve security auditing with GitLab Operational Container ScanningIntroduces and demonstrates GitLab's Operational Container Scanning feature, which scans running containers in Kubernetes environments. It details the prerequisites (GitLab Ultimate, Kubernetes cluster, kubectl, helm), the deployment of a sample application, and the connection of a Kubernetes cluster via the GitLab Agent for Kubernetes. The configuration of scanning cadence and target namespaces is explained using the agent's `config.yaml`. The post highlights how scan results, generated by Trivy, are reported back to GitLab's Vulnerability Report for auditing and tracking.
  130. Secure, compliant, and AI-powered: Get to know 3 new GitLab featuresThis post introduces three new AI-powered features: GitLab Duo Vulnerability Resolution, Model Registry, and Secret Push Protection. Vulnerability Resolution automatically creates merge requests to fix detected vulnerabilities, streamlining remediation. Model Registry, integrated with MLflow, provides a central hub for data scientists and developers to manage and deploy AI models, supporting versioning, artifact storage, and CI/CD integration. Secret Push Protection proactively blocks code pushes containing secrets using customizable rules, enhancing security.
  131. DevSecOps + Agentic AI: Now on GitLab Self-Managed Ultimate on AWSThis post announces the availability of GitLab Duo with Amazon Q for GitLab Self-Managed Ultimate users on AWS. It details the three key AI experiences: AI-powered feature development (`/q dev`), automated code reviews (`/q review`), and Java modernization (`/q transform`). It also outlines the setup process, including prerequisites like upgrading to GitLab 17.8, having an Ultimate subscription, hosting on AWS, enabling Duo settings, configuring AWS IAM and the AI gateway, and adding the Amazon Q user to projects. The post encourages feedback during the preview period.
  132. Reduce supply chain risk with smarter vulnerability prioritizationIntroduced Static Reachability Analysis to identify exploitable vulnerabilities in open source components, a Known Exploited Vulnerabilities (KEV) Indicator to highlight actively exploited vulnerabilities, and the Exploit Prediction Scoring System (EPSS) to predict the likelihood of exploitation. These enhancements aim to reduce triage times and accelerate remediation cycles for AppSec teams. Future work includes integrating Rezilion's technology for automated fix merge requests, enriching package metadata with OpenSSF scorecard ratings, and improving license detection.
  133. Automating with GitLab Duo, Part 3: Validating testingThis post details a validation test where all previously written tests were removed, and GitLab Duo was used to regenerate tests and increase test coverage. The team achieved 84% test coverage, a significant improvement from the prior 74%, in approximately two days by one engineer, compared to the approximately four weeks across multiple engineers for the previous coverage. Coverage has since increased to 89%. The post highlights that GitLab Duo enabled developers with lower context around existing code to write valuable tests quickly, increasing confidence in developing new features without introducing errors.
  134. Modernizing a simple C++ application to Java with GitLab DuoThis post details the process of modernizing a simple C++ application to Java using GitLab Duo's AI capabilities. It demonstrates using GitLab Duo Chat for code explanation and refactoring, including generating the necessary `pom.xml` and directory structure for the Java application. The post also covers building and running the refactored Java application, highlighting the time and effort saved through AI-assisted migration.
  135. Automating with GitLab Duo, Part 2: Complex testingThis post details lessons learned from using GitLab Duo for complex test generation. It describes strategies for updating existing tests (e.g., refactoring from pytest to unittest), creating tests for legacy code by providing error snippets, handling complex/abstracted code by matching styles and mirroring structures, ensuring generated code follows standards through specific prompts, and leveraging Duo to address uncovered edge cases. Key takeaways include the importance of prompt engineering, understanding underlying code, providing context for desired outcomes, and the necessity of human oversight.
  136. Streamline DevSecOps engineering workflows with GitLab DuoThis post details how GitLab Duo's AI capabilities are integrated into the DevSecOps workflow to streamline engineering tasks. It highlights specific features like Merge Request Summary, Discussion Summary, Code Review Summary for collaboration. For infrastructure management, it showcases Code Explanation and Code Suggestions for IaC (Terraform, AWS CloudFormation, Ansible) and configuration management. It also emphasizes AI-assisted test generation and CI/CD pipeline troubleshooting with Root Cause Analysis. For security, Vulnerability Explanation and Vulnerability Resolution are detailed, with the latter automatically creating merge requests for fixes. The post emphasizes the efficiency gains and skill enhancement for DevOps engineers.
  137. GitLab Duo with Amazon Q: DevSecOps meets agentic AIThis post announces the integration of GitLab Duo with Amazon Q's autonomous AI agents. Key technical contributions include the introduction of quick actions like `/q dev` to convert issue descriptions into merge-ready code, `/q transform` for automating Java modernization, `/q review` for instant code quality and security feedback in merge requests, and `/q test` for generating unit tests. The integration leverages GitLab project context for multi-file changes and updates issues/creates merge requests with scoped permissions. It emphasizes enterprise-grade security, compliance, and privacy guardrails.
  138. How to leverage GitLab Duo for enhanced security reportingThis post details how the GitLab Security division is using GitLab Duo to enhance security reporting. It outlines practical use cases for generating incident reports, performing root cause analysis, and providing on-demand updates to leadership. Specific prompts and Duo's outputs are provided as examples. The post also lists several GitLab Duo features relevant to security reporting: Root Cause Analysis, Vulnerability Explanation, Vulnerability Resolution, Code Explanation, Test Generation, Refactor Code, and Fix Code.
  139. Quickly resolve broken CI/CD pipelines with AIThis post introduces and details GitLab Duo's Root Cause Analysis (RCA) feature for CI/CD pipeline failures. It explains common causes of pipeline failures (syntax errors, failed tests, misconfigurations, IaC issues, Kubernetes/GitOps challenges, long stack traces) and the stress of manual troubleshooting. The RCA feature is presented as an AI-powered solution that analyzes logs and stack traces to pinpoint failure causes, suggest fixes, and even provide code suggestions. It highlights the ability to ask follow-up questions and reference other files/issues within the repository, emphasizing privacy by keeping data within GitLab.
  140. Automating with GitLab Duo, Part 1: Generating testsThis post details the process of using GitLab Duo Chat within VS Code, via the GitLab Workflow extension, to generate unit tests for a custom Python module ('gitlab-helper'). It outlines the prerequisites (GitLab Duo-enabled account), the steps to install and enable the extension, and the workflow for selecting code and invoking the 'Generate tests' command. It notes that generated tests may require finetuning and suggests a naming convention for generated test files. The post highlights the efficiency gains in test writing and code coverage achieved by using AI assistance.
  141. Chat about your merge request with GitLab DuoIntroduces GitLab Duo Chat, a new capability that allows users to converse with an AI assistant directly within a merge request context. This feature provides answers to questions about code changes, potential risks (e.g., privacy concerns, network failure points), trade-offs, and error handling. It leverages the MR description, discussions, code diff, and metadata to provide context-aware responses, aiming to accelerate MR onboarding and review.
  142. 3 GitLab features to level up DevSecOps workflowsThis post introduces three new features that enhance DevSecOps workflows: GitLab Duo Root Cause Analysis for diagnosing broken CI/CD pipelines by analyzing log files and suggesting fixes; GitLab Duo Vulnerability Explanation for providing developers with detailed descriptions of vulnerabilities, exploitation examples, and remediation suggestions; and Advanced SAST, a new security scanner with a proprietary detection engine that aims to reduce false positives and improve triage time. These features are presented as recent innovations to accelerate software development and improve application security.
  143. 5 things to know from our LinkedIn Live Security Deep DiveThis post details the introduction of secret push protection, AI-powered Quick Chat for contextual security insights within the editor, and static reachability analysis for Python/Java to reduce security noise. It also highlights advancements in Advanced SAST with cross-file/function scanning and taint analysis.
  144. Quick vulnerability remediation with GitLab Advanced SAST + Duo AIThis post introduces the general availability of GitLab Advanced SAST, a static application security testing scanner that performs cross-function and cross-file taint analysis. It details how to enable and configure Advanced SAST within CI/CD pipelines. The post also highlights the integration of GitLab Duo Vulnerability Explanation to provide AI-powered insights into vulnerability exploitation and remediation, aiming to reduce MTTR. A concrete example using OWASP Juice Shop demonstrates the workflow from vulnerability detection to remediation.
  145. Use GitLab Duo to build and deploy a simple Quarkus-native projectThis post details the practical application of GitLab Duo to generate the necessary files (Java source, Dockerfile.native, pom.xml, test files) for a Quarkus-native application. It demonstrates the iterative prompting process with GitLab Duo Chat within VS Code to create a 'Hello World' Quarkus application, its native compilation Dockerfile, Maven project configuration, and associated tests. The post also outlines the project directory structure and prerequisites for deploying to Kubernetes.
  146. GitLab Duo Chat: Get to know productivity-boosting AI enhancementsThis post details the upgrade of GitLab Duo Chat's LLM from Claude 3 Sonnet to Claude 3.5 Sonnet, improving response accuracy and efficiency. It introduces the Slash Command Picker UI for easier discovery of commands within the GitLab UI. A new Root Cause Analysis integration allows users to troubleshoot failed CI/CD jobs directly within Chat. The ability to fix selected code in the IDE using commands like `/fix` is now available. The 'Explain Vulnerability' feature, previously a standalone capability, is now integrated into Duo Chat for SAST vulnerabilities. Future work includes expanding contextual scope to commits, pipeline jobs, and merge requests, introducing a `/help` command, and broader IDE support.
  147. Mastering GitLab admin tasks with GitLab Duo ChatThis post details how GitLab Duo Chat can be used by administrators to solve complex problems, such as updating group memberships across 50,000 groups using a Rails console script. It highlights the iterative refinement process with Chat, providing examples of non-deterministic responses for CI/CD performance improvement, error interpretation for Git errors, and code optimization for Gitaly configuration. Best practices for clear query formulation and incremental refinement are also discussed.
  148. Use GitLab AI features out-of-the-box in a GitLab WorkspaceThis post details the integration of GitLab Duo Chat and Code Suggestions within GitLab Workspaces, leveraging the GitLab workflow extension for VS Code. It explains how to set up a remote development environment that combines these features for an AI-assisted coding experience. The post highlights the benefits of an isolated workspace for AI tool usage, including reduced local dependency installation, enhanced security and privacy, and improved context awareness for AI assistants. It provides steps for creating a workspace, validating the workflow extension, and utilizing Duo Chat and Code Suggestions for tasks like generating code and unit tests.
  149. Developing GitLab Duo: Use AI to remediate security vulnerabilitiesThis post details the practical application of GitLab Duo for security vulnerability remediation. It showcases how Duo Chat can be used to analyze vulnerabilities, explain their impact and exploitation vectors, and suggest fixes. The post highlights workflows for generating alternative fixes, adding tests for vulnerabilities, and refactoring code within the IDE. It also demonstrates AI-assisted vulnerability resolution by generating proposed fixes in merge requests for common vulnerabilities like weak hash functions and timing attacks. The contribution focuses on the practical integration of AI into the DevSecOps lifecycle for faster and more informed vulnerability management.
  150. Developing GitLab Duo: A roundup of recent Chat enhancementsThis post details the integration of GitLab Duo Vulnerability Explanation into Chat, led by teams outside the AI group. It highlights improvements in Chat's context awareness, including understanding of epics, issues, and code files within the GitLab UI and IDEs. Prompt cancellation functionality has been rolled out on GitLab.com. Architectural improvements include the adoption of the Language Server Protocol (LSP) for better IDE integration. Future work includes migrating to Claude 3.5 Sonnet, supporting custom self-hosted models, synchronizing messages across clients, and migrating the 'Summarize Comments' feature.
  151. Prevent secret leaks in source code with GitLab Secret Push ProtectionIntroduces Secret Push Protection as a generally available feature for GitLab Ultimate and GitLab Dedicated customers. This feature blocks commits containing high-confidence secrets before they are pushed to GitLab, complementing existing Pipeline Secret Detection. It details the risks of leaked secrets, how the feature works by checking commit content, and recommends a layered approach. Configuration steps for enabling the feature per project are provided, along with options to skip push protection and add exclusions. Audit events for various actions related to Secret Push Protection and exclusions are also introduced.
  152. Top tips for efficient AI-powered Code Suggestions with GitLab DuoThis post provides practical tips and best practices for using GitLab Duo Code Suggestions, including prompt engineering techniques, specific use cases for fixing dependencies, generating boilerplate code, and creating regular expressions. It also details how to re-trigger suggestions, differentiate between suggestions and generation, and combine Code Suggestions with GitLab Duo Chat for enhanced workflows like generating build configurations and explaining vulnerabilities. The post emphasizes learning and practice to maximize developer efficiency.
  153. GitLab Duo: AI-powered CI/CD pipeline root cause analysisThis post introduces and details the functionality of GitLab Duo Root Cause Analysis, an AI-powered feature designed to diagnose and suggest fixes for CI/CD pipeline failures. It explains how the feature works by sending CI/CD job logs to the GitLab AI Gateway for analysis by an LLM, providing example fixes. The post includes two detailed scenarios: one demonstrating the analysis of a Python dependency error and the subsequent need to start a Redis service, and another illustrating the diagnosis of a missing Go runtime in a container image. It also provides practice scenarios and outlines future development plans for the feature, such as integrating with GitLab Duo Chat for more interactive problem-solving.
  154. Secure by Design principles meet DevSecOps innovation in GitLab 17GitLab 17 introduces enhanced SAST analyzer coverage for more languages, improved API Security Testing, advanced vulnerability tracking for Secret Detection, and Dependency Scanning support for Android. The acquisition of Oxeye is highlighted for improving SAST accuracy. GitLab Duo's AI capabilities are expanded to assist with memory-safe code conversions, code explanation/suggestions, and vulnerability resolution, with new AI Impact Analytics to measure ROI. Enhanced governance controls and permissions customizations for custom roles are introduced to reinforce the principle of least privilege.
  155. Developing GitLab Duo seriesThis series introduces multiple posts detailing the development and application of GitLab Duo's AI features. Key technical contributions include: - **Model Validation and Testing:** Behind-the-scenes look at evaluating LLMs, matching them to use cases, and fine-tuning them for better user responses. - **AI Impact Analytics:** A new feature providing metrics like Code Suggestions Usage Rate to measure AI effectiveness. - **Dogfooding AI:** Real-world examples of integrating AI throughout the SDLC and using metrics to gauge success. - **Securing AI-Generated Code:** Step-by-step guidance on enhancing reliability and security using GitLab Duo and GitLab Pages, including code samples and prompts. - **AI for CI/CD RCA:** Infusion of AI into Root Cause Analysis for fixing broken CI/CD pipelines, with example scenarios and exercises. - **Duo Chat Enhancements:** Latest improvements to GitLab Duo Chat, including prompt cancellation and architectural upgrades. - **AI for Vulnerability Remediation:** Tutorials on using GitLab Duo Vulnerability Explanation and Resolution to address vulnerabilities quickly.
  156. Inside look: How GitLab's Test Platform team validates AI featuresThis post details the development of an AI continuous analysis tool for testing GitLab Duo features. It describes automating data collection in VS Code using WebdriverIO and GitLab CI/CD, measuring suggestion latency, and analyzing code quality/security of suggestions. It also outlines performance validation strategies using mocked AI Gateway responses and multi-regional latency tests (TTFB) with the GitLab Environment Toolkit and GitLab Performance Tool. Unit, integration, and end-to-end tests (with real and mock AI responses) are used for functional validation, with a focus on loose assertions for non-deterministic AI outputs. Exploratory testing and dogfooding are also mentioned.
  157. Developing GitLab Duo: Secure and thoroughly test AI-generated codeThis post details the integration of GitLab Duo's code generation and testing capabilities with GitLab Pages for deploying test reports. It provides a step-by-step guide on using Duo to generate Flask web server code, automatically create unit tests, identify security vulnerabilities via Duo Chat, and generate test reports. The post also demonstrates how to configure `.gitlab-ci.yml` to deploy these reports using GitLab Pages and integrate SAST scanning to detect vulnerabilities in AI-generated code.
  158. GitLab Duo Chat 101: Get more done on GitLab with our AI assistantThis post introduces GitLab Duo Chat, a generally available AI assistant within the DevSecOps platform. It details its capabilities for summarizing comment threads, explaining code, refactoring code, and writing tests. The post emphasizes prompt engineering techniques, including context, simplicity, and follow-up questions, to maximize the effectiveness of the AI assistant. Use cases are provided for product managers, developers, QA engineers, and new employees. The post also highlights integration with IDEs and the WebIDE.
  159. 7 steps to enhance application security without slowing developer velocityThis post details a 7-step process for enhancing application security without slowing developer velocity. It outlines how to assess the current state of development, enable security scans (starting with secrets detection and dependency scanning), evaluate scan results for false positives and noise, adjust scan analyzers and rules (e.g., customizing SAST and secret detection rulesets), prioritize initial vulnerabilities for remediation, enable scans in development pipelines (running scans in parallel with CI jobs and using scheduled scans for slower ones like DAST), and provide developer visibility through the merge request widget and security training integrations. The process emphasizes an iterative approach, starting with pilot teams and expanding gradually, while fostering collaboration between development, security, and operations.
  160. Developing GitLab Duo: How we are dogfooding our AI featuresThis post details how internal GitLab teams are dogfooding various GitLab Duo AI features, including Code Suggestions and Chat. Specific use cases highlighted include streamlining code reviews by summarizing merge requests and answering coding questions, condensing comment threads, creating new documentation, crafting release notes, optimizing docs site navigation, drafting and refining OKRs, streamlining hiring communication, summarizing production incidents, creating boilerplate `.gitlab-ci.yml` files, full-stack development with JavaScript and Ruby code suggestions, generating Python scripts for non-GitLab tasks, generating test source code, streamlining research tasks by using Chat instead of browser tabs, testing new features like Markdown support in Code Suggestions, and using the `/explain` feature to understand external codebases. The post emphasizes the benefits of automation, time savings, improved code quality, faster debugging, and streamlined administrative tasks.
  161. Developing GitLab Duo: AI Impact analytics dashboard measures the ROI of AIIntroduces the AI Impact analytics dashboard in GitLab 17.0 to measure the ROI of GitLab Duo. The dashboard provides usage metrics for Code Suggestions, correlation analysis with SDLC performance and quality/security metrics (Cycle Time, Lead Time, Deployment Frequency, Change Failure Rate, Critical Vulnerabilities), and comparison views between teams using AI and those not. It defines 'Code Suggestions Usage Rate' as the independent variable and lists dependent variables. Future plans include additional visualizations and integration with Contribution analytics.
  162. Migration guide: GitHub Advanced Security to GitLab UltimateThis post details the migration of GitHub Advanced Security features to GitLab Ultimate, focusing on SAST and Secret Scanning. It provides a feature-by-feature comparison and migration steps, including adding SAST and Secret Detection templates to `.gitlab-ci.yml` and customizing SAST scanners and rulesets. It highlights GitLab Ultimate's broader security capabilities beyond GitHub Advanced Security.
  163. How to successfully deliver your software development roadmapThis post discusses the impact of AI across the SDLC, highlighting GitLab Duo's capabilities beyond code creation, such as vulnerability remediation and root cause analysis. It also addresses common blockers to DevSecOps adoption, including the perceived limitations of AI, resistance to toolchain consolidation, and regulatory concerns with multi-tenancy. The post promotes GitLab Dedicated as a single-tenant SaaS solution for regulated industries and emphasizes the benefits of a DevSecOps platform approach for cost reduction, centralization, and improved collaboration.
  164. 10 best practices for using AI-powered GitLab Duo ChatThis post introduces 10 best practices for using GitLab Duo Chat, focusing on effective prompt engineering and conversational interaction. It details strategies such as initiating conversations, refining prompts for efficiency by providing context, following prompt patterns (problem statement, ask for help, additional requests), using low-context communication, repeating and refining questions, and utilizing slash commands within IDEs. Examples are provided for C# development, Kubernetes deployments, and compliance requirements.
  165. Simplify your cloud account management for Kubernetes accessThis post introduces and details the 'user_access' feature of the GitLab agent for Kubernetes. It explains how the agent can impersonate GitLab users and map their group and project roles to Kubernetes RBAC, enabling simplified and secure access management for Kubernetes clusters. The post provides example configurations for both development and production environments, demonstrating how to restrict access based on user roles within GitLab groups.
  166. How-to: Detecting secrets in video contentThis post details the development of a custom video scanner for detecting secrets in video content. The scanner splits videos into frames, uses OCR (Google Cloud Video Intelligence API) to extract text, and then employs approximate regular expression matching to identify secrets, accounting for OCR inaccuracies. The implementation of approximate regular expression matching was significantly aided by GitLab Duo Chat, which helped in generating C++ Node.js addons for the TRE library. The scanner is open-sourced under the MIT license.
  167. Measuring AI effectiveness beyond developer productivity metricsThis post introduces a new approach to measuring AI effectiveness beyond simplistic developer productivity metrics. It argues for focusing on business outcomes like lead time, cycle time, production defects, and user satisfaction, rather than lines of code or acceptance rates. It highlights the challenges of quantifying indirect impacts and the need to balance speed and quality. The post introduces the concept of the 'AI Impact' dashboard, which will leverage Value Stream Analytics, DORA metrics, and GitLab Duo usage data to provide a comprehensive view of AI's impact on the SDLC.
  168. New report on AI-assisted tools points to rising stakes for DevSecOpsThis post discusses the increasing importance of AI-assisted tools in DevSecOps, citing an Omdia report and the GitLab 2023 Global DevSecOps Report. It highlights that enterprises not using AI will be at a disadvantage and that AI has reached a level of proficiency making it a permanent part of the landscape. The post emphasizes the need for "layers" of safety and enhancement safeguards on top of foundational models to manage training data licensing, output quality, and prevention of insecure code. It positions GitLab Duo as an enterprise-grade solution that integrates AI throughout the SDLC, respecting user privacy by not retaining user data or using client code for training. It also mentions the use of Google and Anthropic models and features like Duo Explanation. The post reiterates that GitLab Duo offers strong controls for DevSecOps teams, ensuring efficiency and security without compromising privacy, and that security guardrails are consistently applied.
  169. AI-powered growth: Transform every stage of software deliveryThis post announces the general availability of GitLab Duo Pro, an add-on package for Ultimate and Premium customers that bundles Code Suggestions, GitLab Duo Chat (Beta), and organizational control capabilities. It highlights enhancements to Code Suggestions, such as Code Generation and Repository X-ray, and emphasizes the broader suite of 15 AI-assisted features within GitLab Duo that cover the entire SDLC, including Vulnerability Explanation and Merge Request Summary. The post also reiterates GitLab's commitment to privacy, stating that customer code is not used for training.
  170. GitLab Duo Pro combines Code Suggestions, Chat, and organizational controlsThis post announces GitLab Duo Pro, an add-on package that bundles existing Code Suggestions with a new Beta feature, GitLab Duo Chat. It also highlights organizational controls for AI usage. The primary technical contribution is the integration of these components into a single offering and the introduction of Chat as a new capability for real-time coding guidance, refactoring, and test generation.
  171. GitLab uses Anthropic for smart, safe AI-assisted code generationThis post details the integration of Anthropic's Claude generative AI model into GitLab Duo Code Suggestions for AI-assisted code generation. It showcases examples of generating a Levenshtein distance function in JavaScript and a Tornado Web Server in Python from natural language prompts. The post emphasizes Claude's strengths in accurate and safe code generation, mitigating hallucination and deviation, and aligning with GitLab's principles of transparency and privacy.
  172. GitLab Duo Code Suggestions is generally availableThis post announces the general availability of GitLab Duo Code Suggestions with GitLab 16.7. It details the capabilities of Code Suggestions, including code generation from comments and code completion from typed characters, and lists supported languages and IDEs. It also highlights the privacy-first approach of not using customer code for training AI models and mentions other AI-assisted features within GitLab Duo like Vulnerability Resolution and Discussion Summary.
  173. Tips to configure browser-based DAST scansThis post introduces and details the configuration of GitLab's browser-based DAST analyzer, which is designed for scanning JavaScript-heavy applications like single-page web applications. It covers general considerations such as using test environments, managing job timeouts, and specific configuration options for websites requiring authentication. This includes setting environment variables for website URLs, authentication credentials, login page URLs, and field selectors for username, password, and submit buttons. It also highlights troubleshooting tools like the authentication report and analyzer logs.
  174. Learning Python with a little help from AIThis post introduces a tutorial on learning Python using GitLab Duo Code Suggestions. It details the setup of VS Code with the GitLab Workflow extension, enabling Code Suggestions, and provides practical examples for writing Python code, including 'Hello, World', variable definition and printing, file I/O, flow control, functions, and parsing log files. It also covers dependency management with pip and pyenv, and configuring a CI/CD pipeline for Python projects. The post emphasizes the use of AI for guided learning and practical application development.
  175. Say hello to GitLab Duo Chat: A new level of AI-assisted productivityIntroduces GitLab Duo Chat, a new AI-powered conversational interface for developers. It provides in-context assistance for code explanations, test generation, code creation, issue summarization, and learning GitLab features. It leverages Anthropic Claude-2 and Vertex AI Codey LLMs, emphasizing data privacy by not using user code for training. Chat will be integrated into the Web IDE and VS Code extension.
  176. GitLab AI, CI/CD and customization for secure scaled growthThis post announces the beta release of GitLab Duo Vulnerability Explanation, which summarizes detected vulnerabilities and provides in-depth solutions and suggested mitigation within the developer's workflow. It also mentions the beta release of GitLab Duo Code Suggestions and the general availability of GitLab Duo Suggested Reviewers. Furthermore, it highlights the extension of GitLab Duo to self-hosted instances, starting with Code Suggestions. The post also introduces the upcoming beta release of the GitLab CI/CD Component Catalog for standardizing pipelines and lists recent expansions to the GitLab Runner ecosystem (macOS, xlarge/2xlarge Linux, GPU-enabled Linux, increased storage). It also notes the ability to import packages from Maven Central or Artifactory into GitLab Packages for Maven, npm, NuGet, and PyPI. Finally, it mentions UI navigation changes, the introduction of a rich text editor in issues, epics, and merge requests, customizable roles, and new velocity metrics and customization options for the Value Streams Dashboard.
  177. Building GitLab with GitLab: Why there is no MLOps without DevSecOpsThis post details how GitLab's Data Science team uses GitLab CI/CD to build standardized JupyterLab container images, store them in the GitLab Container Registry, and automate ML model training using GPU-enabled runners. It explains the configuration of `.gitlab-ci.yml` for building images based on Dockerfile and requirements.txt changes, and for triggering training jobs via commit messages using `papermill` to pass parameters to XGBoost for GPU utilization. It also highlights the use of ML experiment tracking to store metadata and artifacts.
  178. Modern software development problems require modern AI-powered DevSecOpsThis post details the application of AI-powered DevSecOps, specifically GitLab Duo, to automate complex customer-facing tools. It introduces AI-driven text summarization for issue collaboration, AI-generated requirements management, GitLab Duo Code Suggestions for faster development, GitLab Duo Suggested Reviewers for efficient code review, AI-generated test cases, and GitLab Duo Chat for minimizing context switching. These AI touchpoints are integrated within CI/CD pipelines for building, testing, and deploying an AI-powered Q&A system.
  179. Learning Rust with a little help from AIThis post details how to leverage GitLab Duo Code Suggestions for learning the Rust programming language. It covers setting up the development environment (VS Code, Rust toolchain), using Cargo for project structure, configuring a CI/CD pipeline for Rust projects, and provides examples of learning Rust concepts like variables, flow control, functions, and testing with AI assistance. It also highlights the use of GitLab Remote Development workspaces as an alternative to local environments.
  180. Combine GitLab Flow and GitLab Duo for a workflow powerhouseThis post details the integration of GitLab Flow with GitLab Duo's AI capabilities. It specifically highlights how AI features like Issue description generation, Discussion summary, Merge request summary, Code Merge request template population, Code explanation, Suggested reviewers, Code review summary, Test generation, and Chat can be applied to enhance the planning and merge request stages of GitLab Flow. The post explains the technical benefits of each AI feature in improving developer efficiency, code quality, and workflow automation.
  181. GitLab plugins for JetBrains and Neovim now available in BetaThis post announces the beta availability of GitLab plugins for JetBrains IDEs and Neovim, extending GitLab Duo Code Suggestions to these development environments. It details how to install and configure these plugins, provides visual examples of the code suggestion functionality, and directs users to feedback issues for reporting bugs and suggestions. It also mentions ongoing work on a GitLab Language Server for Code Suggestions to standardize IDE extensions and enable wider adoption.
  182. Supercharge productivity with generative AI and GitLab DuoThis post introduces and details several AI-assisted features within GitLab Duo, focusing on enhancing developer productivity and code review processes. It explains the underlying technology of generative AI and LLMs, and then elaborates on specific capabilities: Code Suggestions, Code Explanations, AI-generated tests for code changes, Vulnerability Explanations, and Value Stream Forecasting. For code reviews, it covers Merge Request Change Summaries (using `/summarize_diff`), Issue Comment Summaries, Suggested Reviewers, and Merge Request Review Summaries. It also mentions upcoming experiments like GitLab Duo Chat and AI-generated merge request descriptions.
  183. GPU-enabled runners for ModelOps and HPC workloads in CI/CDThis post introduces and details the usage of GPU-enabled runners on GitLab.com for ModelOps and HPC workloads. It explains how to configure `.gitlab-ci.yml` to use these runners with the `saas-linux-medium-amd64-gpu-standard` tag, select Docker images with NVIDIA CUDA drivers, and verify GPU functionality using `nvidia-smi`. It provides basic examples for Python model training and scientific simulations, and an advanced example demonstrating the creation of a custom Docker image using Kaniko for handwritten digit recognition model training, including stages for building, testing, training, and publishing the model to the GitLab Container Registry. It also mentions the integration of security scanning templates.
  184. GitLab 16: AI and security take center stageThis post announces GitLab 16, highlighting the introduction of GitLab Duo, a suite of enterprise-grade AI capabilities for DevSecOps workflows. It details specific AI features like Code Suggestions, Explain this Code, Explain this Vulnerability, and Summarize Issue Comments. The post also emphasizes the partnership with Google Cloud for private and secure AI, and the enhancements in Value Stream Analytics and Product Analytics for observability and feedback.
  185. GitLab for Visual Studio, including code suggestions, available in BetaThis post announces the beta release of the GitLab for Visual Studio extension, which integrates GitLab Duo code suggestions. It details the setup and usage of the extension, and mentions ongoing development for JetBrains IDEs, Neovim, and a GitLab Language Server to standardize and accelerate IDE extension development. The post reiterates the broader goal of infusing AI/ML capabilities across the DevSecOps lifecycle.
  186. SecureFlag integrated with GitLab for rapid vulnerability remediationThis post details the integration of SecureFlag's vulnerability remediation training into GitLab's DevSecOps platform. When GitLab security scanners detect vulnerabilities, SecureFlag provides a link to a knowledge base article with code examples and hands-on labs for developers to practice remediation skills in a live environment. This integration aims to streamline the vulnerability remediation process, decrease security retests, and improve overall project security by enabling a proactive, developer-led security approach.
  187. Quickstart guide for GitLab Remote Development workspacesThis post introduces and provides a quickstart guide for GitLab Remote Development workspaces, a new beta feature in GitLab 16.0. It details the prerequisites (BYOK8s cluster, GitLab agent for Kubernetes), the use of DevFiles for environment configuration, and the step-by-step process for creating and using a workspace. It covers working within the integrated Web IDE (VS Code), installing dependencies, starting applications, making code changes, and committing them back to the repository. The post also links to further documentation and a demo.
  188. Meet GitLab Duo, the suite of AI capabilities powering your workflowsThis post introduces GitLab Duo, a suite of AI capabilities integrated into the DevSecOps Platform. It details specific features like Code Suggestions, Explain this Code, Explain this Vulnerability, generation of epic/issue/task descriptions, summarization of issue comments, and a chat interface for AI interactions. It emphasizes the customer-centric and privacy-first approach, stating that customer IP is secured and data is not used for training without consent. The post also highlights the goal of achieving 10x workflow efficiency and mentions upcoming capabilities.
  189. Self-managed support for Code Suggestions (Beta)This post announces the beta release of Code Suggestions for self-managed instances, enabling users to receive AI-generated code suggestions within their IDEs (VS Code and GitLab's WebIDE). It details the architecture where context is sent to GitLab's infrastructure for suggestion generation without persisting or training on customer code. It also outlines the enablement process for administrators and the data privacy considerations.
  190. Train and deploy AI models with GitLab and Google Cloud's Vertex AIThis post details a tutorial on using GitLab CI/CD to orchestrate a ModelOps workload for deploying a custom credit card fraud detection model to Google Cloud's Vertex AI. It covers data preprocessing with SMOTE, training a RandomForestClassifier, and deploying the model via a CI/CD pipeline that uploads artifacts to Google Cloud Storage and creates an endpoint in Vertex AI. Prerequisites include a Google Cloud project with specific service account permissions and a GitLab project. The CI/CD pipeline consists of test, train, and deploy stages.
  191. ML experiment: Extending Code Suggestions to more development environmentsThis post details the experimental extension of GitLab Code Suggestions to Visual Studio, JetBrains IDEs, and Neovim. It describes the development of specific extensions and a language server to enable code suggestions in these environments, highlighting the rapid prototyping efforts by engineers Michael Eddington, Dinesh Bolkensteyn, Julian Thome, and Michael Henriksen. It also mentions ongoing iteration and plans to expand support to other IDEs and editors.
  192. How Code Suggestions can supercharge developers' daily productivityThis post details the specific use cases and benefits of GitLab's Code Suggestions feature, including importing packages, completing functions, filling boilerplate code, building data frames, and generating unit tests. It highlights the expansion of language support to 13 languages and the availability of Code Suggestions for free on GitLab.com during beta. It also emphasizes the importance of analyzing AI-generated code with code quality and security scanning tools.
  193. Code Suggestions available to all GitLab tiers while in BetaIntroduces Code Suggestions as a beta feature available to all GitLab.com users for free. Extends language support to 13 languages. Emphasizes privacy by ensuring customer code is not used for training. Details IDE support (VS Code, WebIDE, JetBrains, Visual Studio) and plans for self-managed instances. Highlights beta status, potential limitations, and feedback mechanisms.
  194. Track ML model experiments with new GitLab MLFlow integrationThis post introduces the integration of MLFlow experiment tracking directly into the GitLab DevSecOps platform. It enables users to track ML model experiments by pointing the MLFlow client to their GitLab project, with experiments and runs recorded on GitLab without needing to set up a separate MLFlow server. It highlights features like user access management tied to GitLab projects, managing candidates (MLFlow runs) directly in the GitLab UI, and downloading candidate data as CSV. The post also mentions future plans for managing the entire ML model lifecycle within GitLab and seeks feedback on this experimental feature.
  195. Building GitLab with GitLab: Web API Fuzz TestingThis post details the implementation of Web API Fuzz Testing within GitLab, focusing on the technical challenges and solutions encountered. Key contributions include: auto-generating OpenAPI specifications from Grape annotations by adapting the `grape-swagger` gem to handle edge cases like file parameters (WorkhorseFile) and wildcard segments; performance tuning strategies for large APIs, including using multi-CPU runners, excluding slow operations, splitting tests into multiple jobs, and dynamically generating child pipelines; and the process of triaging fuzzing findings, leveraging Postman collections and the GitLab Development Kit for debugging.
  196. ML experiment: Use a chatbot to answer how-to questionsIntroduced an experimental chatbot feature that answers how-to questions about the GitLab product. The chatbot overlays the GitLab UI, providing immediate answers and links to documentation, aiming to reduce context switching and improve user efficiency.
  197. GitLab details AI-assisted features in the DevSecOps platformThis post introduces several new AI-assisted features within the GitLab DevSecOps platform, including Code Suggestions, Suggested Reviewers, Summarize MR Changes, Summarize My MR Review, Explain This Vulnerability, Generate Tests in MRs, Explain This Code, Issue Comment Summaries, GitLab Chat, and Value Stream Forecasting. It also mentions a generative AI partnership with Google Cloud and the availability of GPU-enabled runners for ModelOps and HPC workloads.
  198. ML experiment: Explain this vulnerabilityThis post introduces an experimental feature for AI-assisted vulnerability explanation and remediation. It leverages large language models to combine vulnerability information with insights from customer code to explain vulnerabilities, demonstrate exploitation, and provide example fixes. The feature was tested with SAST vulnerabilities and is powered by Google AI. It is available on GitLab.com today.
  199. AI/ML in DevSecOps SeriesThis post is an introduction to a series tracking GitLab's journey to build and integrate AI/ML into its DevSecOps platform. It highlights various AI/ML experiments and features being developed, including AI-assisted code suggestions, SQL generation, code explanation, issue comment summarization, merge request change summarization, test generation, vulnerability explanation, chatbot for documentation, MLFlow integration, and code suggestions for various IDEs and self-managed instances. It also mentions the introduction of GPU-enabled runners for ModelOps and HPC workloads and the GitLab Duo suite of AI capabilities.
  200. ML experiment: Summarizing issue commentsThis post details an experiment in using generative AI LLMs to summarize issue comments within GitLab. It describes the technical approach involving prompt engineering to guide LLM output and the engineering challenge of chunking long comment threads for accurate summarization. The post also mentions future iterations to optimize prompts and extend this functionality to epics and merge requests.
  201. ML experiment: Explain this source codeThis post details an experiment with an 'Explain this Code' feature, a rapid prototype developed by engineers. It leverages AI models to provide natural language explanations of source code directly within GitLab's repository source code file viewer. The feature allows users to highlight code selections and receive explanations, aiming to help developers quickly understand new projects, unfamiliar languages, or complex historical code. The post also mentions potential extensions to merge requests and snippets, and reiterates the ongoing effort to infuse AI/ML capabilities across the software development lifecycle.
  202. ML experiment: Writing SQL is about to get a lot easierThis post details an experiment within GitLab's Product Analytics group where AI-generated SQL queries are created from natural language parsing. This aims to simplify the process of populating Product Analytics dashboards with interactive graphs and charts, making data analysis more accessible and efficient for users without deep SQL expertise.
  203. How AI-assisted code suggestions will advance DevSecOpsThis post introduces AI-assisted code suggestions as a new capability within GitLab's DevSecOps platform. It details the benefits of AI-assisted code suggestions, such as decreased errors, increased productivity, improved collaboration, and faster rollout/iteration. It also outlines specific use cases and jobs that GitLab AI Assisted Code Suggestions will address, including code optimization, automatic bug detection and patching, smart debugging, continuous integration and deployment, predictive maintenance, programming in natural language, test case generation and automation, and smart code completion. The post mentions that the feature is available to select Ultimate customers in a closed beta with a wider open beta planned.
  204. What the ML is up with DevSecOps and AI?This post introduces the strategic direction for integrating AI/ML into GitLab's DevSecOps platform, focusing on faster deployments, improved security, enhanced quality assurance, intelligent monitoring, and predictive analytics. It highlights current AI-assisted features like Suggested Reviewers and Code Suggestions, emphasizing data privacy and source code protection. The roadmap includes workflow automation, intelligent code security, generative code suggestions, and integrating ModelOps/DataOps plumbing for building and deploying AI/ML workloads, including better support for Python notebooks and GPU runners.
  205. Machine learning and DevSecOps: Inside the OctoML/GitLab integrationThis post details the integration of OctoML CLI with GitLab CI/CD pipelines to automate the optimization and deployment of machine learning models. It describes how new commits to inference code repositories can trigger OctoML CLI to optimize models for cost and latency, deploy them to a cloud registry, and then to managed Kubernetes services. The post outlines the four required stages for every pipeline (setup, package, deploy, test) and provides an example of the `octoml.yaml` configuration for model acceleration.
  206. Testing ChatGPT: Can it solve a GitLab issue?This post details an experiment by the Developer Relations team using ChatGPT to assist with two specific development tasks within GitLab: refactoring duplicate Vue components into a shared component and refactoring widget state tests using `it.each`. The experiment highlights the capabilities and limitations of current AI tools in assisting with code generation and refactoring, including the need for manual review and testing of AI-generated code.
  207. Put `glab` at your fingertips with the GitLab CLIThis post details the adoption of the open-source `glab` project to form the foundation of GitLab's native CLI experience. It describes how `glab` integrates GitLab functionality into the terminal, allowing developers to perform tasks such as reviewing issues, creating branches and merge requests, checking pipeline status, and approving/merging work without leaving the command line. The post also highlights the integration with 1Password Shell Plugins for secure authentication and discusses the transition process of migrating the project to GitLab's infrastructure, including adapting GitHub Actions to GitLab CI and converting documentation back to Markdown. It also mentions the security review conducted by the application security team and the update of distribution methods to point to the new repository. The post emphasizes community contributions and provides installation instructions for macOS, Windows, and Linux.
  208. How is AI/ML changing DevOps?This post introduces the concept of applying DevOps principles to AI/ML development, emphasizing the need for a unified approach to address challenges like experiment repeatability, tool silos, and collaboration. It outlines a strategic vision for AI/ML programs, including DataOps (data acquisition and transformation) and MLOps (experimentation, training, testing, and deployment of models), and advocates for breaking down silos between data science and software development teams. The post draws parallels between the evolution of DevOps and the current state of AI/ML adoption, suggesting that learning from past DevOps successes can accelerate AI/ML initiatives.
  209. Why AI in DevOps is here to stayThis post highlights the increasing adoption of AI/ML in DevOps practices, citing survey data showing a significant rise in its use for code review, software testing, and ModelOps. It emphasizes the benefits of AI in automating tedious tasks within DevOps, particularly in software testing and code review, and acknowledges the learning curve associated with AI adoption. The post positions AI as a key enabler for streamlining DevOps processes and improving efficiency.
  210. GitLab transforms code review with machine learning toolsThis post details the integration of UnReview's machine learning capabilities into GitLab's code review process, focusing on the development of 'Suggested Reviewers'. It highlights the technical challenges and learnings in building an MLOps pipeline within GitLab CI, introducing Python to the tech stack, and addressing biases in recommendation algorithms. The post also outlines future directions for AI-powered features, including Intelligent Code Security.
  211. Learn Python with Pj! Part 5 - Build a hashtag tracker with the Twitter APIThis post details the technical implementation of a real-time hashtag tracker using Python, the Tweepy library, and the Twitter API. It explains API authentication using OAuth1UserHandler, handling of extended tweets via `status.extended_tweet["full_text"]`, and the use of environmental variables with `.env` and `python-dotenv` for secure credential management. The code demonstrates creating a custom stream class (`LogTweets`) inheriting from `tweepy.Stream` and implementing the `on_status` method to process incoming tweets. It also covers filtering tweets by hashtags using `stream.filter(track=hashtags)`.
  212. One DevOps platform can help you achieve DevSecOpsThis post details how GitLab integrates Application Security Testing (AST) into the CI pipeline, providing developers with immediate feedback on vulnerabilities upon committing code. It highlights partnerships with Kontra and Secure Code Warrior for vulnerability education and explains how granular compliance pipeline policies can be enforced.
  213. How We Built a Stack Overflow Community Questions AnalyzerThis post details the creation of an automated system to analyze Stack Overflow questions related to GitLab. The system uses the StackOverflow API to pull questions, preprocesses the text, calculates TF-IDF using scikit-learn, and displays the results in dashboards using Streamlit. The entire process is orchestrated using GitLab CI/CD with multi-project pipelines and deployed on a Kubernetes cluster. This demonstrates the practical application of AI/ML techniques (TF-IDF) and DevOps practices for content creation and community feedback analysis.
  214. Integrating vulnerability education into DevOps workflowsThis post introduces the integration of Kontra Application Security's interactive training modules directly into GitLab's Merge Request and pipeline experiences. This allows developers to access security training relevant to identified vulnerabilities within their existing workflows, providing interactive simulations to understand and fix security issues. The integration dynamically links training content based on vulnerability identifiers and programming languages, making security education more accessible and actionable for developers.
  215. How to get integrated secure coding advice in GitLabThis post details the integration of GitLab's vulnerability scanner results with Secure Code Warrior. When GitLab scanners detect security issues, the vulnerability details are augmented with links to Secure Code Warrior's platform. This provides developers with contextual, bite-sized coding challenges and remediation guidance for specific vulnerabilities, aiming to improve secure coding practices and accelerate vulnerability resolution.
  216. GitLab and Tabnine: AI-powered code completion for GitLab repositoriesThis post introduces the integration of Tabnine's AI-powered code completion technology with GitLab repositories. It outlines the process for Tabnine for Teams users to connect to their GitLab repositories to build, validate, and upload a private team model. This enables personalized code suggestions based on the team's codified best practices, aiming to improve developer productivity, accelerate feature release cadence, and reduce technical debt.
  217. Top 10 ways machine learning may help DevOpsThis post provides a high-level overview of 10 ways machine learning can assist DevOps, including making sense of test data, managing help-desk alerts, enhancing DevSecOps security, gathering user requirements, assisting developers with code suggestions and guardrails, automating testing, improving communication, saving time on manual provisioning, improving software quality through defect prediction, and integrating workflows for continuous improvement. It mentions the importance of AI/ML skills for future careers and references GitLab's 2021 Global DevSecOps Survey.
  218. Adopt ModelOps within DevOps to solve data science challengesThis post introduces the ModelOps stage within GitLab, which aims to integrate data science workloads into the existing DevOps platform. It breaks down ModelOps into three primary groups: DataOps (data fetching, cleaning, processing), MLOps (building, testing, training, and deploying AI/ML models), and AI Assisted (enriching existing GitLab features with ML). It details the user personas and challenges associated with each group, emphasizing the goal of enabling data science workloads and empowering customers to build and integrate them within GitLab applications.
  219. Deep dive: the tech stack behind SpamcheckThis post provides a deep dive into the technical stack and infrastructure choices for Spamcheck, a new anti-spam engine. It details the use of Golang and gRPC for its core services, citing reasons for flexibility, performance, and efficient serialization. The infrastructure relies on Google Kubernetes Engine (GKE) and Knative for stability and scalability, with GitLab CI/CD used for building, storing, tracking, and deploying Docker images. The post also highlights the integration with GCP Cloud Monitoring services and Terraform for infrastructure as code, and discusses early wins in accuracy metrics compared to Akismet. It mentions the integration with Inspector, an in-house ML model, and the use of LabKit for logging, monitoring, metrics, and tracing.
  220. How Comet can streamline machine learning on The GitLab DevOps PlatformThis post demonstrates integrating Comet ML with GitLab CI/CD to streamline the ML development workflow. It outlines a process for separating ML model training and evaluation code from application code into distinct GitLab projects. The CI/CD pipeline automates model training, evaluation, and reporting within merge requests, allowing for collaborative code and model reviews. Upon approval, the model is registered in Comet's Model Registry, and a downstream pipeline is triggered for deploying the ML-powered application's UI. Key technical details include the use of Python scripts for training, DVC for reporting, Comet's Model Registry for versioning, and manual trigger for deployment to Kubernetes.
  221. How to write and continuously test vulnerability detection rules for SASTThis post details the development of a framework for writing and continuously testing vulnerability detection rules for SAST, specifically for migrating from existing SAST tools to Semgrep. The framework addresses rule management by using a central Git repository for rules and test cases, rule testing through automated gap analysis comparing original analyzers with Semgrep rule-sets, and analyzer replacement by ensuring parity between the old and new tools. This enables a more efficient and maintainable SAST process.
  222. Introducing Spamcheck: A data-driven, anti-abuse engineThis post introduces Spamcheck, a new anti-spam engine for GitLab. It details the development process, including the creation of a spam testbed for passive data extraction and analysis, prototyping with a tech stack involving gRPC, Protobuf, and GoLang, and an iterative deployment strategy to production. The engine was initially deployed in monitoring mode and progressively expanded to all public projects on GitLab.com. The post highlights data-driven improvements, including performance comparisons with Akismet, and mentions ongoing work to reduce false positives by improving ML models and automating training processes.
  223. How machine learning ops works with GitLab and continuous machine learningThis post introduces CML (Continuous Machine Learning) as a tool to adapt CI/CD systems like GitLab CI for data science and ML use cases. It details how to automate model training, testing, and reporting within merge requests. The post provides two examples: a basic report with model metrics and a confusion matrix, and a more advanced use case integrating CML with DVC for data version control, including diffing metrics and visualizing loss function changes.
  224. Fuzzit - GitLab journeyThis post details the acquisition of Fuzzit by GitLab and its integration into GitLab's DevSecOps platform. Fuzzit, a fuzzing-as-a-service product, brings continuous coverage-guided fuzzing capabilities to GitLab, aiming to improve software security by lowering the barrier to entry for developers. The post highlights the technological fit and the vision of advancing fuzzing adoption within GitLab's single DevSecOps application.
  225. My experience interning to work with security scanning at GitLabThis post details an internship experience where the author integrated GitLab Secure's security scanning features (SAST) into open-source projects hosted on GitLab.com. The author learned to use the scanners, read their output, and identified a false negative in a SAST report. The experience aimed to improve project security, raise awareness of GitLab's security offerings, and provide feedback for product improvement.
  226. Dotscience announces MLOps integration with GitLabThis post announces a partnership between GitLab and Dotscience to integrate MLOps capabilities into the GitLab DevSecOps platform. It highlights how combining GitLab's source repository, issue tracking, and CI with Dotscience's notebook, data, parameter, and metric management allows for a complete MLOps workflow. Key integration points include applying GitLab's merge request workflow to AI/ML projects and customizing Docker images for ML model deployment. The post also mentions a demo and documentation for getting started.
  227. SAST & DAST: Key security tests for development workflowsThis post explains the concepts of Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) and how they fit into developer workflows. It details how GitLab integrates SAST to automatically generate summaries of fixes and unresolved vulnerabilities after code commits and before merging, and how DAST runs live attacks on review apps during QA. The post emphasizes the importance of using both SAST and DAST together for comprehensive security testing.
  228. Python 3 becomes default for license compliance scanningThe License Compliance feature within the Secure stage will now default to using Python 3 for license scanning, aligning with the end-of-life for Python 2. Users on self-managed instances still using Python 2 can set the `LM_PYTHON_VERSION` CI variable to '2' to maintain compatibility. GitLab.com users will see this change automatically. This change is a proactive measure due to Python 2.7 reaching its end of life in January 2020.
  229. Announcing GitLab for DevSecOpsThis post announces the integration of security features (SAST, DAST, dependency scanning, container scanning) into the CI/CD pipeline, along with Auto Remediation, Security Dashboards, and Security Approvals. It also highlights the expansion of operations capabilities with Feature Flags, Operations Dashboard, and Incident Management. The release of GitLab 12.0 includes Visual Review Tools, project dependency list, and Merge Trains, all contributing to a single application for the DevSecOps lifecycle.
  230. Speed up secure software delivery with DevSecOpsThis post introduces the concept of embedding security into the development workflow to accelerate software delivery. It highlights how Static Application Security Testing (SAST) within GitLab allows developers to review and address vulnerabilities directly in their working environment, reducing friction between development and security teams. The post emphasizes the benefits of this approach, such as faster release times and improved collaboration, by framing security as a critical workflow component rather than a roadblock.
  231. Forrester names GitLab challenger in software compositionThis post details GitLab's inclusion as a challenger in Forrester's Software Composition Analysis report, highlighting its integrated approach to application security testing and software composition analysis, with a focus on remediation, policy management, and reporting. It also mentions updates since the evaluation, including improvements to the security dashboard, additional languages for SAST scanning, and secrets detection, and the ability to automatically create merge requests for vulnerability remediation.
  232. GitLab's security tools and the HIPAA risk analysisThis post details the application of GitLab's existing SAST, DAST, and Container Scanning features for identifying vulnerabilities in source code, running web applications, and Docker images, respectively. It also introduces the upcoming Secret Detection feature for identifying sensitive information leaks. The post outlines future plans for Interactive Application Security Testing (IAST) and fuzzing capabilities, emphasizing their role in enhancing application security and risk assessment, particularly for healthcare applications subject to HIPAA.
  233. Security dashboards secure applications at DevOps speedThis post introduces the Security Dashboard, a new feature shipped in version 11.1, designed to help security professionals view vulnerabilities across a project. It highlights the integration of SAST, DAST, container scanning, dependency scanning, and license management as built-in security products within GitLab, aiming to enable proactive security and reduce context-switching for developers.
  234. What our summit in South Africa taught me about cybersecurityThis post uses an analogy of photography with a dedicated camera versus a smartphone camera to illustrate the integration of application security testing into the developer workflow. It argues that GitLab's integrated approach, where security vulnerabilities are surfaced directly within the developer's merge request and pipeline results, is more effective than traditional, separate security tools. This allows developers to act on vulnerabilities immediately, embodying the "shift left" principle. The post emphasizes that the primary objective of application security should be to get vulnerabilities fixed, which is best achieved through seamless integration into the developer's existing workflow.