CI/CD Minute Quotas and Abuse Prevention

6 posts · Mar 2020 – Nov 2021

What this trail covers

GitLab.com is extending CI/CD minute usage quotas to public projects not part of GitLab open source programs to prevent abuse, such as cryptocurrency mining, which negatively impacts performance and availability of shared runners. This change aims to ensure reliable service for all users by limiting excessive consumption of free pipeline minutes. Users will be notified upon reaching their quota and can upgrade their plan or purchase additional minutes. Self-managed users and members of GitLab's open source programs are unaffected.

All GitLab trails

Nov 2021Changes to GitLab.com public project CI/CD minute quotasThis post announces the extension of CI/CD minute quotas to public projects on GitLab.com to prevent cryptocurrency mining abuse, which was negatively impacting shared runner performance and availability. Previously, public projects had high minute allocations for open-source contributions, which were exploited. The change introduces limits to prevent excessive consumption. Self-managed users and members of the GitLab open source program are exempt. Users will be notified upon reaching their quota and can upgrade their plan or purchase additional minutes. Future changes to quotas and project types accumulating minutes are planned.
May 2021How to prevent crypto mining abuse on GitLab.com SaaSThis post details the implementation of requiring credit/debit cards for new free users created on or after May 17, 2021, to use shared runners on GitLab.com. It outlines a gradual rollout strategy and lists previous improvements made to mitigate pipeline abuse, including failing jobs when quotas are exceeded, restricting namespace creation via API, and enhancing external pipeline validation. It also announces that as of July 17, 2021, public projects in newly created namespaces will be included in CI pipeline minute usage quotas.
Dec 2020Automation check-in and rate limit changes on GitLab.comIntroduced new rate limits on GitLab.com activity effective January 18, 2021: 500 requests/min for unauthenticated traffic per IP, 2,000 requests/min for authenticated API traffic per user, 1,000 requests/min for other authenticated HTTP traffic per user, and 2,000 requests/min for all traffic per IP when not otherwise covered. Documented these limits and advised users to handle 429 responses with the `Retry-After` header. The goal is to improve stability and availability.
Sep 2020Upcoming changes to CI/CD minutes for free tier users on GitLab.comThis post announces a reduction in CI/CD minutes for the free tier on GitLab.com from an unspecified previous limit to 400 minutes per top-level group/personal namespace per month, effective October 1, 2020. It also clarifies that limits remain unchanged for Open Source, Education, and Startups programs, matching the Gold tier. Options to increase minutes include purchasing additional minutes, upgrading to a paid tier, or using self-hosted runners.
Mar 2020Changes to CI pipeline minutes for new free usersThis post announces a change to CI pipeline minutes for new free users on GitLab.com, setting a limit of 2000 minutes per group per month. It explains that existing free users are unaffected and that users can purchase additional minutes or bring their own runners. It also mentions upcoming CI improvements like dynamic child pipeline creation, autoscaling on AWS Fargate, and pipeline failure notifications.
Advertisement