Best Practices
Guidance for software delivery with GitLab.
Six pillars help you improve how software moves from an idea to the people who use it. Start with the area you want to improve, consider the choices, and decide what fits your team. Use the linked recommendations and GitLab Docs when you're ready to put a decision into practice.
- Structure
- Each pillar brings together design principles, recommendations, and a checklist
- Checklists
- Questions grounded in real examples, without a score
- How this fits
- Use this site to decide how to work in GitLab. Use GitLab Docs for product setup and reference.
How to use Best Practices
Within each pillar
Choose the area you want to improve, then use the guidance that helps with your question.
The six pillars
Choose the area you are working on
These areas follow the work rather than GitLab menu names. You may need guidance from more than one pillar. Together, they support a governed software factory: people, automation, and agents working with clear responsibility, current context, independent checks, and a way to recover. The guidance applies whether your next improvement involves AI or not.
- Platform governance and operating modelGitLab has clear owners, a group structure that matches access needs, limited inherited access, rules teams understand, and a managed way to make changes.Groups aligned with access, ownership, and shared rules · Limited inherited access · Clear standards and required rules · Clear ownership for rules, exceptions, and platform changesExplore pillar
- Source and collaborationTeams can find work, see who owns it, review changes independently, and follow shared contribution steps without gaining more access than they need.Related work and ownership in one project · Independent reviews and change history · Safe self-service with supported defaults · Easy-to-find work and consistent contribution stepsExplore pillar
- CI/CD and releaseTeams can make delivery more predictable, keep untrusted work away from protected systems, and prepare to recover when a release goes wrong.Maintained, versioned pipeline components · Separation between untrusted jobs and protected resources · Short-lived job credentials with limited access · Controlled deployments and tested recoveryExplore pillar
- Secure software delivery and complianceTeams get security feedback they can act on during delivery while security and compliance owners keep clear control of policy and risk decisions.More than one line of defense · Early developer feedback with central oversight · Separation between security policy and application delivery · Vulnerability tracking from discovery through closureExplore pillar
- Measurement and continuous improvementTeams use trustworthy data and developer feedback to remove bottlenecks, improve quality and safety, and make GitLab easier to use without ranking individual performance.Fewer delays and less friction for developers · Conclusions based on trustworthy data · Results and bottlenecks, not activity counts · Different measures for availability, readiness, use, and results · An owner and follow-up for every improvementExplore pillar
- AI-assisted and agentic deliveryPeople and agents carry work from intent to production with clear responsibility, dependable checks, recovery, and an understanding of the results and costs.Intent and decisions that remain clear as work evolves · Connected context that people and agents can rely on · Coordinated delivery across people, agents, and systems · Quality and control throughout execution · Capabilities and knowledge the organization can carry forward · Business improvement beyond AI activityExplore pillar
Your team's context
Choose how to put the guidance into practice
Start with the outcome you need, then choose an approach that fits your responsibilities and available features.
Recommendations explain when particular approaches fit. The linked product documentation covers availability and setup.