GitLab 11.1 released with security dashboards and enhanced code search

https://about.gitlab.com/2018/07/22/gitlab-11-1-released/

by jfreax • 8 years ago

136 119 8 years ago

about.gitlab.com

The most innovative source control product in the market just got even better. :)

stefan_• 8 years ago

I just do not understand what they spend their time on. No ones giving out points for more checkmarks in a feature list, folks.

spydum• 8 years ago

Have you ever old software to an enterprise customer? Making your product look special by offering a bazillion features they will never use is surprisingly successful.

jsgo• 8 years ago

In our environment, a vendor would probably be better served to offer a no frills basics thing and then just sell customization support (or painless customization). You could probably check off every bulletpoint imaginable and then we would still have things that need customizing.

simonturvey3• 8 years ago

Only if you actually then invest some time in selling it. I've had radio silence from their sales team when requesting to purchase an self-hosted licence. The one thing I know about Microsoft (GitHub) - they _get_ enterprise sales.

1123581321• 8 years ago

It seems like an even mix of new features, enhancements to existing features, and maintenance.

WhatsName• 8 years ago

Same issue, it seems to have become an "eierlegende Wollmilchsau" (German for Swiss Army knife, but with a negative conotation).

I recently move to gittea[1] for the very reason that I dont need 90%+ of Gitlabs features. Also Gitlab chews up RAM and IO, while gittea is barely noticeable even on a low end server. [1] https://gitea.io/

sytse24• 8 years ago

I agree that GitLab is using too much RAM. Stan Hu, all time MVP record holder, will start working to reduce this. Options are removing Ruby code in Gitaly 1.1 and using multi threading in the application server.

CodingDutchy3• 8 years ago

I have to agree a bit on the "Eierlegende Wollmilchsau". Features are not everything, regressions and degraded core functionality impact current users, which will impact whether you are getting new users in the long run.

For example, recently the number of characters before line-wraps in the MR diff view changed. Not sure if this was intentional or accidental. I know two companies using Gitlab, both based the max-line length in their style-guide on what fit the diff-viewer. I guess Gitlab became a worse tool for code-reviews for them with that change.

"You need to optimize for the people not using your product yet because it is missing features." doesn't sound very fair to current users, and I don't think that will work long term.

elgenie• 8 years ago

The direct translation, "egg-laying wool-milk-sow", gets the point across fairly well.

tinus_hn• 8 years ago

No ones giving money for bugfixes, folks. People who pay money choose the product they are going to buy according to feature lists. Good enough quality is good enough.

JosephRedfern• 8 years ago

Perhaps not, but they stop paying money because of bugs.

merb3• 8 years ago

some of their features are also pretty half-ass baked. like time tracking.

victorwu7• 8 years ago

Is there any particular time tracking feature you are interested in?

williamchia4• 8 years ago

As a transparent company, our roadmap (what we spend time on) along with our strategy (why we spend it there) is public. https://about.gitlab.com/direction/ https://about.gitlab.com/strategy/ The "breadth over depth" section might help to shed some understanding.

sytse24• 8 years ago

The biggest picture thing we're spending our time on is creating a single application for the whole DevOps lifecycle. See https://about.gitlab.com/2017/10/11/from-dev-to-devops/ for more context.

ModernMech2• 8 years ago

Does anyone find it annoying that both Github and Gitlab have their own flavor of markdown which they both call GFM?

simonturvey3• 8 years ago

I guess you didn't read the 11.1 release notes where they stated they were standardising on http://commonmark.org/ right?

ModernMech2• 8 years ago

Yeah, but they're still calling it "Gitlab Flavored Markdown". The release was just about how they're changing the renderer. This does nothing to reduce the confusion with the fact that there are still two "flavors" of Markdown called different things but referred to with the same acronym, but I guess now both rendered by the same backend? This makes no sense to me.

aw3c22• 8 years ago

A month of nothing but performance tweaks and bugfixes would be great though.

ggregoire• 8 years ago

They introduced "squash" and "modify commit message" on the last release. It worked 1 time on the 4 times I tried.

victorwu7• 8 years ago

If you could log a bug here with any details that would be great! https://gitlab.com/gitlab-org/gitlab-ce

Thanks!

Edit: I wanted to clarify that if you’ve observed any undesirable behavior, we welcome you to log it and we will address it as soon as we can. I see how my original comment made it seem like we ship untested code. That’s not the case as Sid mentioned below. That being said, there might be specific edge cases or scenarios we have not captured in our tests. So problems do appear from time to time. So I wanted to invite anybody to log any problem so that we can reproduce it as soon as we can and get it fixed.

Also as Sid mentioned, this feature was recently brought to Core so that more users now have access to it.

apple4ever5• 8 years ago

Fixing merge conflicts is completely broken for me ever since they introduced it.

sytse24• 8 years ago

We have to balance shipping new features https://about.gitlab.com/handbook/ceo/#how-do-we-keep-shippi... with performance tweaks and bugfixes.

If we would not have shipped new features and still did just just version control GitLab the company would not be viable. We're committed to shipping a single application for the whole DevOps lifecycle this year https://about.gitlab.com/2017/10/11/from-dev-to-devops/

But there are multiple performance tweaks en bugfixes going out every month, including this one.

The big performance tweak in this release is the merge request view refactor https://about.gitlab.com/2018/07/22/gitlab-11-1-released/#me... which makes loading merge requests much faster but there are 35 other performance improvements https://gitlab.com/groups/gitlab-org/-/merge_requests?scope=...

There were 141 bugs closed in this release https://gitlab.com/groups/gitlab-org/-/issues?scope=all&utf8...

aw3c22• 8 years ago

Thank you for this nice reply (and all the great work of course)!

heroprotagonist• 8 years ago

Well, there's definitely a difference between periodically slowing down the new features for a month of additional focus on stability/performance improvements and 'just doing version control forever'.

Keep your fingers on the pulse of your customers. If the top comments in posts about your releases say "I wish they'd focus on quality more" even in a place where 'move fast and break things' is considered sage advice, then think of this as an indicator. If the performance improvements that have been going out every month are sufficient, the discussion would not focus on them as much.

mbesto• 8 years ago

Please take my comment as playing devil's advocate, and not a negative "what do you think you're doing" question.

If we would not have shipped new features and still did just just version control GitLab the company would not be viable.

Says who? I can name hundreds of enterprise software companies that don't ship new features on a regular basis and are still commercially very viable. In other words, what evidence do you have that if you spent 3 months just shipping performance improvements that it would slow your growth?

ComputerGuru2• 8 years ago

Are you not accruing technical debt to ship these features, then? That’s not sustainable.

mrmondo• 8 years ago

Shout out to you Sid for remaining so engaged in the community in a constructive, science backed and transparent manor as the company has grown.

Promarged• 8 years ago

Or cleaning up their work-in-progress, currently there are around 11307 issues open: https://gitlab.com/gitlab-org/gitlab-ce/issues

sytse24• 8 years ago

Among other things we use the issue tracker for feature proposals. So it is not a good proxy of work in progress.

DanielDent2• 8 years ago

It really really would.

And it's a very good thing that their product allows you to self-host, because I have zero-confidence in their ability to properly operate infrastructure.

But the attention to detail/quality on the product itself is lacking too. Don't get me wrong, I love gitlab as a product, but they really don't seem to care about working on anything that doesn't let them check another box on a marketing feature sheet.

A selection of some issue I've filed...

Only took around a year to fix: https://gitlab.com/gitlab-org/gitlab-ce/issues/25388

Then this issue lingered for about a year before being closed because a customer filed a similar issue a couple months after I did... that other issue is still open though, so maybe they'll get around to it eventually: https://gitlab.com/gitlab-org/gitlab-ce/issues/25535

Here's one from two years ago that's still open: https://gitlab.com/gitlab-org/gitlab-ce/issues/19846

It's possible that issue is actually fixed now. I don't know and I don't care anymore.

Here another issue from 2 years ago: https://gitlab.com/gitlab-org/gitlab-ce/issues/19656

I filed that issue after a Gitlab person here on hacker news specifically invited feedback on UX/UI issues, and I had just spent a frustrating time trying to track down a runner.

At some point I just stopped filing issues & started ignoring the issues I'd already filed. The times they decided to close issues because they'd been open a long time certainly didn't inspire me to waste any more time trying to help them improve the product.

Closing & re-opening and re-tagging and doing everything but actually fixing the issue is not confidence inspiring.

Gitlab is still a great product, but now when I run into things that might warrant opening an issue, I just find ways of dealing with them on my own.

sytse24• 8 years ago

I wanted to give some context issue by issue.

1. We consider stopping an environment https://gitlab.com/gitlab-org/gitlab-ce/issues/25388 a new feature, not a bug.

2. Relative submodule links are planned for 11.3 https://gitlab.com/gitlab-org/gitlab-ce/issues/37356

3. Not showing a retry option to logged out users https://gitlab.com/gitlab-org/gitlab-ce/issues/19846 is a good improvement but since very few logged out users will see this message we don't consider it a bug.

4. Showing the original project next to the runner IDs makes a lot of sense. As you can see in the issue we are no longer closing feature proposals due to inactivity.

If you find ways of dealing with above things on your own that involve modifying GitLab please consider contributing them back.

jramsay2• 8 years ago

Thanks Daniel. I'm a Product Manger at GitLab. The relative submodule fix is scheduled as a Deliverable for 11.3 https://gitlab.com/gitlab-org/gitlab-ce/issues/25535 – sorry it's taken so long.

Normally new duplicate issues are consolidated into the oldest issue, but since both issues had been open a while ago I kept the issue that had the most participants and discussion open.

apple4ever5• 8 years ago

Ugh I hear you. I have been following this issue for nearly a year: https://gitlab.com/gitlab-org/gitlab-ce/issues/39056

I cannot believe its not fixed it. They made the MR file view completely useless for us. It was a new "feature" that actually made things worse.

ksec• 8 years ago

Does anyone know if Gitlab is now on a monthly release schedule?

Today is exactly one month after Gitlab 11.0 release.

It seems Gitlab is finally on Rails 5.0, hopefully they move to Rails 5.2 soon. It seems the whole Rails Ecosystem, Shopify, Zendesk, Gitlab, AirBnb, Discourse is now catching up to the latest release.

foepys• 8 years ago

They have been releasing new updates on the 22th of every month for over two years now.

chriscool• 8 years ago

Yeah, GitLab has been on a monthly release schedule since October 2011: https://about.gitlab.com/2015/12/17/gitlab-release-process/

victorwu7• 8 years ago

Yep, GitLab releases on the 22nd of everyone month. Here’s a list of releases.

https://about.gitlab.com/releases/

blackst0ne2• 8 years ago

GitLab is not on rails 5.0 yet. But it's on its way.

enjeru• 8 years ago

Anyone using their OIDC integration should carefully read the release notes. Some form of migration action will be required.

sytse24• 8 years ago

This is about OpenID Connect, see https://about.gitlab.com/2018/07/22/gitlab-11-1-released/#st...

MurrayHill1980• 8 years ago

It would help if gitlab's web interface could make it possible to renew letsencrypt security certificates more easily than running local commands and cutting and pasting the certbot handshake string, then the SSL public and private keys. I have to do this every 3 months for the website for an open source project. Or if gitlab could sell ssh access to a VM host (for this purpose, not to use do any other significant computing) at reasonable cost.

sytse24• 8 years ago

GitLab now uses Let's Encrypt for self-hosted installations. We plan to start using it for GitLab pages sites with custom domains and applications deployed with Auto DevOps. The issue for the latter is at https://gitlab.com/gitlab-org/gitlab-ce/issues/41355

transitivebs• 8 years ago

My biggest issue with GitLab is that it's core 95% use case UX is just significantly weaker than GitHub's.

This may seem subjective, and it certainly is to some extent, but I've used both platforms pretty extensively and I find GitHub's UX so much cleaner and more usable every time.

blackst0ne2• 8 years ago

I use both GL and GH every day. And I find GH's UX is much weaker, e.g. it doesn't remember last used sort options on the issues page which is huge annoying.

So this is subjective.

marmaduke• 8 years ago

maybe gitlab’s goal to integrate the whole of the software dev life cycle into a single UI isn’t the UX what you want.

(Personally I find it a lifesaver)

Scarbutt• 8 years ago

I also find github's UI/UX much cleaner and easier to work with, gitlab tries to put too much stuff in one page and they are have low contrast.

apple4ever5• 8 years ago

I actually find the opposite. Besides a self hosted option, the biggest reason I chose GL at work was because I found the UX so much better than GH. Like miles better. (Don't even get me started on the terribly named "Pull Request" which GL properly names as "Merge Request".

Deimorz• 8 years ago

All my issues (on gitlab.com) now have an "Epic" field, but I can't find anywhere to actually create an epic. Am I missing it somewhere?

romanr• 8 years ago

That’s an Enterprise feature, depends on what subscription you have.

williamchia4• 8 years ago

Note, it's only a paid feature for private projects on GitLab.com. Public projects get all features of Gold for free: https://about.gitlab.com/open-source/

victorwu7• 8 years ago

If you have the Gold Plan (for a group) on GitLab.com, you will be able to use the Epics feature for that group. See [1].

If you have any other plan (including Free), you should not see that field (or at most you should see a dismissable upgrade UI). That doesn’t seem to be case currently. I’ve logged an issue to correct this. [2]

[1] https://docs.gitlab.com/ee/user/group/epics/

[2] https://gitlab.com/gitlab-org/gitlab-ce/issues/49484

jerrac2• 8 years ago

My favorite part of GitLab is the .gitlab-ci.yml and gitlab-runner workflow. My least favorite is how much RAM is required to run GitLab. You can't host your own on a $5 DigitalOcean vps. Does anyone know of any work being done on gitea/gogs, or other alternatives, that would support .gitlab-ci.yml and gitlab-runner?

@gitlab It would be awesome if you would split out GitLab-CI into something you can host separately as a direct competitor to Jenkins. Or maybe a stripped down "lite" version that could be hosted on small vps's. I know that doesn't fit your overall vision, or really help your bottom line, but it would help a lot of individuals and small organizations that need to self host for some reason (as in, there's a reason they can't use GitLab.com).

AlphaSite• 8 years ago

isn't `.gitlab-ci.yml` just the same as a jenkins pipeline?

jerrac2• 8 years ago

I haven't looked into Jenkin's in a couple years, so I'm not sure. My experience as the sysadmin of our Jenkin's server was decidedly negative. I was pretty happy when I was able to move to GitLab-CI instead of Jenkin's. It has it's issues, but at least I can upgrade it without breaking the entire instance....

sytse24• 8 years ago

GitLab CI used to be a completely separate application. When we integrated both we learned of the emergent benefits of an integrated application https://about.gitlab.com/handbook/product/single-application... and we want to keep those.

I understand the need to have GitLab use less memory, I commented in https://news.ycombinator.com/item?id=17588073 about our plans.

BTW If you want to use just GitLab CI and are a current GitHub customer you can do that https://about.gitlab.com/features/github/

dirtylowprofile• 8 years ago

I am running GitLab on $5 DigitalOcean droplet but the tradeoff I have to create a Swap file worth 2GB.

igneo676• 8 years ago

I use Gitea and Drone and I love it - the flow is pretty similar

kornish• 8 years ago

How does the code search compare to best-in-class search tools like SourceGraph? Looks like GitLab is still missing a lot of important utilities like informative tooltips, jump-to-definition, etc.

sytse24• 8 years ago

GitLab code search is not on the same level as SourceGraph that has much more language dependent features.

sqs• 8 years ago

Sourcegraph CEO here. :) Sourcegraph works really well with GitLab so you can search and browse code (with IDE-like code intelligence) across all of your GitLab EE/CE/.com repositories efficiently. See https://about.sourcegraph.com/docs/config/repositories#gitla... or just set it up with the one-command installation instructions on the homepage.

XorNot2• 8 years ago

I'm about to switch my team to Gitlab hosted for one reason: it's the only CI product I can find which has any notion of allowing the feature-branch/shared-repo model to have secrets protected from regular committers during builds.

Now if they could implement branch-specific secrets so I could manage ACLs amongst devs, senior devs, ops etc. then it would be near-perfect.

iamjaredwalters• 8 years ago

Secret variables are NOT output to Gitlab CI job logs... but if someone echos them, they WILL appear in the log. This may be obvious to some, but, I like to point it out nonetheless.

benatkin3• 8 years ago

I think it would be a good feature to hide secrets from the log by searching for them and replacing them with something like [removed]. It would be best if it were done by a component that had the security locked down (maybe a process that you pipe it through) and it wouldn't prevent users from encrypting it to bypass the filter, but it would make it harder for misbehaving users to deny that they circumvented the security. It could also detect JSON stringified or base64'd secrets.

XorNot2• 8 years ago

You've missed the important detail: Protected Variables in Gitlab aren't just hidden, they're not injected into builds which don't happen on Protected Branches.

What this means is that so long as I or another trusted person reviews the PR of a protected branch build, we can have high confidence the code isn't going to disclose secrets unintentionally, and that people aren't going to accidentally modify a build so it deploys outside the process.

This is great! But what I want is for it to go further - in a perfect system, I'd be able to set per-branch variables which are omitted if you're not on the right branch, and have branch protection managed by different sets of users - i.e. developers, lead developers, then testing/QA/UAT and finally production - which could just correspond to branch rules like uat/<whatever> preprod/<whatever> prod/<whatever> and allow PRs with different approvers to control the escalation process.

prepend3• 8 years ago

This is neat, but the pricing tiers are a bit extreme. I’d like to use static code analysis, but this is only available in platinum ($99/month/user [0]) or ultimate (unknown price - call sales).

I currently use Core for free and going from $0 to $100k seems pretty steep for a fairly simple feature that Github has partially implemented in their free tier.

[0] https://about.gitlab.com/pricing/#gitlab-com

sytse24• 8 years ago

Good point. We're thinking about making security open source at the merge request level but charging for project, group, and instance level metrics. What would you think of that?

prepend3• 8 years ago

That’s better. I actually don’t necessarily mind paying or jumping through hoops, but it’s such a massive jump for what I see as a feature that I’ll likely have to buy a 3rd part product for much less than that.

I’d like some way to use it manually as a low cost project and then pay for convenience.

There’s a group in my org looking at MicroFocus at $1200/build seat.

apple4ever5• 8 years ago

Their pricing is a bit extreme, especially when it comes to counting users. Its the biggest reason why we haven't paid for any tier. I'd love to pay for at least the Starter, but we have 20 external developers (but only 2 active ones) and 6 internal developers (all active). It'd be nice if there were different tiers between the users (single repo users are cheaper than multiple repo users, and the admin users doesn't count).

dorian-graph• 8 years ago

external systems can no access all merge requests reliably

Typo? Should it be "now"?

kaushalmodi• 8 years ago

I wished this update came with gitlab.com-wide project search. But looks like the "improved search" still didn't include that.

Github-wide search is great! I wish Gitlab had something like that. That's one of the things that's stopping me from switching 100% to Gitlab.

The site-wide search on GitHub allows me to explore code snippets, learn how someone else uses the "foo" syntax, see the trending repos in a given language, and so much more.

GitLab 11.1 released with security dashboards and enhanced code search

Related Stories