This document explains the workflow for anyone working with issues in GitLab Inc. For the workflow that applies to everyone please see PROCESS.md.
Products at GitLab are built using the GitLab Flow.
We have specific rules around code review.
If you notice that pipelines for the master branch of GitLab CE or EE are failing (red) or broken (green as a false positive), fixing this takes priority over everything else development related, since everything we do while tests are broken may break existing functionality, or introduce new bugs and security issues.
An issue that is labelled as ~"master:broken" will be assigned the highest priority and severity ~P1 ~S1.
All tests (unit, integration, and E2E QA) that fail on master are treated as ~"master:broken".
Any test failures or flakiness (either false positive or false negative) causes productivity impediments for all of engineering and our release processes. If a change causes new test failures, the fix to the test should be made in the same Merge Request. If the change causes new QA test failures, in addition to fixing the QA tests, the package-and-qa or review-qa-all job must be run to validate the fix before the Merge Request can be merged.
The cost to fix test failures increases exponentially as time passes. Our aim should be to keep master free from failures, not to fix master only after it breaks.
Issues labeled with ~"master:broken" need to have a short lifespan. If the problem described by an issue is not addressed within one working day, the issue labels need to be changed:
master build was failing and the underlying problem was quarantined / reverted / temporary workaround created but the root cause still needs to be discovered: apply a label ~"master:needs-investigation" and remove ~"master:broken"master build had a flaky failure that cannot be reliably reproduced: apply ~"master:flaky" and remove ~"master:broken" labelEveryone who is a member of the project should triage the issues with the ~"master:broken" label.
#development so that other developers are aware of the problem and can help#development by mentioning the issue#development, #backend and #frontend if someone can assign the issue to themselves@mention the relevant Engineering Leads and CTO in the issue and on Slack, so that resources can be assigned to fix it as quickly as possible.It's ok to merge a merge request with a failing pipeline if the following conditions are met:
master, and the failing specs are not directly related to functionality touched by the merge requestBefore merging, it's a good practice to mention that the failure happens in master, and to post a reference to the issue. For instance:
Failure in <JOB_URL> happens in `master` and is being worked on in #XYZ, merging.
Security issues are managed and prioritized by the security team. If you are assigned to work on a security issue in a milestone, you need to follow these steps:
security-23-5 branch as the target for your merge request.If no security branch exists, create one from the latest stable branch. For the previous example, you can run (assuming dev is the remote):
git checkout -b security-23-5 origin/23-5-stable
git push -u dev HEAD
security-23-4 and security-23-3. master using a patch set from the most recent stable branch. After the merge requests for the stable branches have been merged, the release manager will ping you if the changes don't apply cleanly to master or pass all tests.If you find a security issue in GitLab, create a confidential issue mentioning the relevant security and engineering managers, and post about it in #security.
If you accidentally push security commits to GitLab.com, we recommend that you:
#releases. It may be possible to execute a garbage collection (via the Housekeeping task in the repository settings) to remove the commits.For more information on how the entire process works for security releases, see the documentation on security releases.
Be sure to read general guidelines about issues and merge requests.
For larger issues or issues that contain many different moving parts, you'll be likely working in a team. This team will typically consist of a backend engineer, a frontend engineer, a Product Designer and a product manager.
Avoid adding configuration values in the application settings or in gitlab.yml. Only add configuration if it is absolutely necessary. If you find yourself adding parameters to tune specific features, stop and consider how this can be avoided. Are they values really necessary? Could constants be used that work across the board? Could values be determined automatically? See Convention over Configuration for more discussion.
Start working on things with the highest priority in the current milestone. The priority of items are defined under labels in the repository, but you are able to sort by priority.
After sorting by priority, choose something that you’re able to tackle and falls under your responsibility. That means that if you’re a frontend developer, you work on something with the label frontend.
To filter very precisely, you could filter all issues for:
CI/CD, Discussion, Quality, frontend, or PlatformUse this link to quickly set the above parameters. You'll still need to filter by the label for your own team.
If you’re in doubt about what to work on, ask your lead. They will be able to tell you.
It's every developers' responsibilities to triage and review code contributed by the rest of the community, and work with them to get it ready for production.
Merge requests from the rest of the community should be labeled with the Community Contribution label.
When evaluating a merge request from the community, please ensure that a relevant PM is aware of the pending MR by mentioning them.
This should be to be part of your daily routine. For instance, every morning you could triage new merge requests from the rest of the community that are not yet labeled Community Contribution and either review them or ask a relevant person to review it.
Make sure to follow our Code Review Guidelines.
Labels are described in our Contribution guide.
GitLab.com is a very large instance of GitLab Enterprise Edition. It runs release candidates for new releases, and sees a lot of issues because of the amount of traffic it gets. There are several internal tools available for developers at GitLab to get data about what's happening in the production system:
There is extensive monitoring publicly available for GitLab.com. For more on this and related tools, see the monitoring handbook.
More details on GitLab Profiler are also found in the monitoring performance handbook.
If you've built feature flags into your code, be sure to read about how to use the feature flag to test a feature on GitLab.com.
GitLab Inc has to be selective in working on particular issues. We have a limited capacity to work on new things. Therefore, we have to schedule issues carefully.
Product Managers are responsible for scheduling all issues in their respective product areas, including features, bugs, and tech debt. Product managers alone determine the prioritization. The UX Lead and Engineering Leads are responsible for allocating people making sure things are done on time. Product Managers are not responsible for these activities, they are not project managers.
Direction issues are the big, prioritized new features for each release. They are limited to a small number per release so that we have plenty of capacity to work on other important issues, bug fixes, etc.
If you want to schedule an Accepting merge requests issue, please remove the label first.
Any scheduled issue should have a team label assigned, and at least one type label.
To request scheduling an issue, ask the responsible product manager
We have many more requests for great features than we have capacity to work on. There is a good chance we’ll not be able to work on something. Make sure the appropriate labels (such as customer) are applied so every issue is given the priority it deserves.
Teams (Product, UX, Engineering) continually work on issues according to their respective workflows. There is no specified process whereby a particular person should be working on a set of issues in a given time period. However, there are specific deadlines that should inform team workflows and prioritization. Suppose we are talking about milestone m that will be shipped in month M (on the 22nd). We have the following deadlines:
M-1, 1st: m.m issues.M-1, 8th (or next business day): Kickoff callM, 7th: Completed m issues with docs have been merged into master. Un-started or unfinished m issues are de-scoped from m, with m being removed from them.M, 15th: team retrospectives should happen so they can inform the public retrospectiveM, 22nd: Release shipped to production. Release post published. M, 23rd: The patch release process for milestone m starts. This includes regular and security patch releases.M+1, 7th: Milestone m is marked as closed. See Milestone Cleanup m issues and merge requests are automatically moved to milestone m+2, with the exception of ~security issues.Refer to release post due dates for additional deadlines.
Note that release timelines are overlapping. For example, when a release is shipped to production on the 22nd, the scope for the following release has already been established earlier in that same month.
Engineers should create and merge in the docs as part of completing an issue by the 7th.
Refer to Feature freeze on the 7th for the release on the 22nd for further timeline details of code releases, including major/minor version releases, as well as patch releases.
Team members use labels to track issues throughout development. This gives visibility to other developers, product managers, and designers, so that they can adjust their plans during a monthly iteration. An issue should follow these stages:
In dev: A developer indicates they are developing an issue by applying the In dev label.In review: A developer indicates the issue is in code review and UX review by removing the In dev label, and applying the In review label.At the beginning of each release, we have a kickoff meeting, publicly livestreamed to YouTube. In the call, the Product Development team (PMs, Product Designers, and Engineers) communicate with the rest of the organization which issues are in scope for the upcoming release. The call is structured by product area with each PM leading their part of the call.
The notes are available in a publicly-accessible Google doc. Refer to the doc for details on viewing the livestream.
After each release, we have a retrospective meeting, publicly livestreamed to YouTube. We discuss what went well, what went wrong, and what we can improve for the next release.
The format for the retrospective is as follows. The notes for the retrospective are kept in a publicly-accessible Google doc. In order to keep the call on time and to make sure we leave ample room to discuss how we can improve, the moderator may move the meeting forward with the timing indicated:
The purpose of the retrospective is to help Engineering at GitLab learn and improve as much as possible from every monthly release. In line with our value of transparency, we livestream the meeting to YouTube and monitor chat for questions from viewers. Please check the retrospective notes for details on joining the livestream.
Engineering Managers are responsible for capacity planning and scheduling for their respective teams with guidance from their counterpart Product Managers.
To ensure hygiene across Engineering, we will close out an expired milestone after the patch release for that milestone has finished. This roughly aligns on the next milestone's kick off date.
When a milestone is closed, automatic grooming of unfinished work (open issues and merge requests) associated with the expired milestone will be move to the milestone after next. This is currently implemented as part of our automated triage operations.
The reason for targeting the next next milestone m+2 is because during this time work on milestone m+1 has already started. It would be more realistic to target the milestone after instead.
Before the meeting starts, remind people who plan to speak to join the Google Hangout earlier, since there is a 50 user limit.
Several minutes before the scheduled meeting time, follow the livestreaming instructions to start a Google Hangout using the Now setting. Paste the Google Hangout invite link in the Google doc.
At the scheduled meeting time, start broadcasting live to YouTube. Begin the meeting.
When working in GitLab (and in particular, the GitLab.org group), use group labels and group milestones as much as you can. It is easier to plan issues and merge requests at the group level, and exposes ideas across projects more naturally. If you have a project label, you can promote it to a group milestone. This will merge all project labels with the same name into the one group label. The same is true for promoting group milestones.
We definitely don't want our technical debt to grow faster than our code base. To prevent this from happening we should consider not only the impact of the technical debt but also a contagion. How big and how fast this problem is going to be over time? Is it likely a bad piece of code will be copy-pasted for a future feature? In the end, the amount of resources available is always less than amount of technical debt to address.
To help with prioritization and decision-making process here, we recommend thinking about contagion as an interest rate of the technical debt. There is a great comment from the internet about it:
You wouldn't pay off your $50k student loan before first paying off your $5k credit card and it's because of the high interest rate. The best debt to pay off first is one that has the highest loan payment to recurring payment reduction ratio, i.e. the one that reduces your overall debt payments the most, and that is usually the loan with the highest interest rate.
Security is our top priority. Our Security Team is raising the bar on security every day to protect users' data and make GitLab a safe place for everyone to contribute. There are many lines of code, and Security Teams need to scale. That means shifting security left in the Software Development LifeCycle (SDLC). Being able to start the security review process earlier in the software development lifecycle means we will catch vulnerabilities earlier, and mitigate identified vulnerabilities before the code is merged. We are fixing the obvious security issues before every merge, and therefore, scaling the security review process. Our workflow includes a check and validation by the reviewers of every merge request, thereby enabling developers to act on identified vulnerabilities before merging. As part of that process, developers are also empowered to reach out to the Security Team to discuss the issue at that stage, rather than later on, when mitigating vulnerabilities becomes more expensive. After all, security is everyone's job. See also our Security Paradigm
