# GitLab GitLab is a platform for planning, source control, CI/CD, and software delivery. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Rate limits on GitLab.com are changing DevFeed: [Rate limits on GitLab.com are changing]() Original publisher: [Read original article]() Author: Sam Wiskow Published: 2026-09-17T00:00:00Z Content type: release Language: en Sources: [GitLab]() Topics: [GitLab](), [Automation](), [Users](), [account]() Tags: [2026](), [automation](), [credentials](), [gitlab](), [limits](), [platform](), [product](), [user](), [users]() ### AI overview GitLab.com will align rate limits with subscription tiers beginning October 19, 2026. Free accounts and unauthenticated requests change first, while Premium and Ultimate limits change in January 2027. Unauthenticated requests are limited to 60 requests per hour per IP address, with preview windows scheduled for October 7 and 14. ### Source excerpt GitLab.com hosts millions of projects for teams of every size that need a platform they can rely on. Demand is climbing quickly, and we expect platform load to grow several times over this year. Predictable limits are what keep GitLab.com fast for everyone on it, including the automation and agent workloads teams are building on the platform. To hold that as we scale, we're updating how rate limits work. Starting October 19, 2026, rate limits on GitLab.com will align with your subscription tier. Free accounts and unauthenticated requests happen first, on October 19. Premium and Ultimate move in January 2027. What is changing Limits align with your subscription. Free, Premium, and Ultimate subscription plans get their own limits, applied per user and per top-level group. Free takes effect October 19; Premium and Ultimate in January 2027. Signing in gets you the full limit. An authenticated request is governed by your subscription plan below. A request that arrives with no credentials gets 60 requests per hour per IP address. The per-plan limits are published in the rate limits documentation. What happens on October 19 There will be two preview windows for Free and unauthenticated traffic, on October 7 and October 14 from 15:00 to 19:00 UTC. Signed-in Premium and Ultimate requests are not affected, since those limits do not change until January. Unauthenticated requests are capped no matter where they come from, including automation running against a paid account without credentials. A preview window (engineers call these brownouts) is a short, planned window where we switch the new limits on and then switch them back off. Nothing else about the service changes while it runs. The point is to give you a real look at how your own workloads behave under the new limits, weeks before they apply for good. On October 19 the new limits take effect. We set these limits by looking at how GitLab.com is actually used. Almost all users are already inside the new limits and won't n ## Grab's LLM-Kit Framework Standardizes More Than 500 Internal Agent Services DevFeed: [Grab's LLM-Kit Framework Standardizes More Than 500 Internal Agent Services]() Original publisher: [Read original article]() Author: Hien Luu Published: 2026-09-15T09:00:00Z Content type: news Language: en Sources: [InfoQ]() Topics: [Framework](), [AI Agent](), [Deployment](), [Model Context Protocol](), [agent observability](), [FastAPI](), [OpenTelemetry](), [GitLab]() Tags: [agent](), [agents](), [ai](), [ai-agent](), [ai-ml-data-engineering](), [deployment](), [fastapi](), [framework](), [gitlab](), [grab-agent-platform](), [ml-data-engineering](), [model-context-protocol](), [news](), [opentelemetry](), [vault]() ### AI overview Grab's internal LLM-Kit framework standardizes more than 500 agent services by providing shared scaffolding for evaluation, tracing, secret handling, service discovery, and tool-server connections. The article reports that deploying a new agent service now takes about one hour instead of two weeks or more. ### Source excerpt Grab has implemented LLM-Kit, a framework that standardizes over 500 internal agent services. This system enhances service integration, evaluation, and secret handling, reducing the time to deploy new AI agents from two weeks to one hour. It centralizes infrastructure management, allowing runtime tool discovery and flexible model integration, while maintaining operational control. By Hien Luu ## Perfect-10 GitLab bug under attack days after patch lands DevFeed: [Perfect-10 GitLab bug under attack days after patch lands]() Original publisher: [Read original article]() Author: Carly Page Published: 2026-09-14T14:30:00Z Content type: news Language: en Sources: [www.theregister.com - Articles]() Topics: [GitLab](), [bug](), [Cybersecurity](), [Internet](), [servers]() Tags: [bug](), [cisa](), [cybersecurity](), [cybersecurity-and-infrastructure-security-agency](), [exploit](), [gitlab](), [internet](), [security](), [servers]() ### AI overview CISA confirms active exploitation of a critical GitLab vulnerability shortly after a patch was released. Security researchers observed attackers probing internet-facing servers. ### Source excerpt CISA confirms active exploitation as watchTowr spots miscreants probing internet-facing servers ## GitLab Dedicated: Compliance for a new regulatory era DevFeed: [GitLab Dedicated: Compliance for a new regulatory era]() Original publisher: [Read original article]() Author: Aathira Nair Published: 2026-09-14T00:00:00Z Content type: article Language: en Sources: [GitLab]() Topics: [GitLab](), [Software as a service](), [Amazon Web Services](), [Cybersecurity](), [Security](), [Resilience](), [Deployment](), [Testing](), [Multitenancy]() Tags: [amazon-web-services-aws](), [aws](), [compliance](), [deployment](), [gdpr](), [gitlab](), [infrastructure-as-code](), [nis2](), [product](), [regulatory](), [resilience](), [saas](), [security](), [testing]() ### AI overview The article presents GitLab Dedicated as a fully isolated, single-tenant SaaS platform hosted and managed by GitLab in a preferred Amazon Web Services region. It explains how the service is intended to help European enterprises address compliance, data sovereignty, audit readiness, security, resilience, and operational responsibilities related to DORA, NIS2, and GDPR. ### Source excerpt Enforcements such as NIS2 are no longer a future planning consideration. The European Union Agency for Cybersecurity's (ENISA) NIS360 report confirms that supervisory authorities are actively assessing cybersecurity maturity across critical sectors. The agency is moving from guidance and consultation into active oversight, scrutiny, and accountability. This is the regulatory environment European enterprises now operate in. Multi-tenant cloud platforms remove operational overhead but place source code and pipelines on shared infrastructure regulators now scrutinize. Self-managed solutions provide isolation but transfer responsibility for upgrade cycles, security patches, and disaster recovery (DR) tests to an already stretched platform team. Both deployment options leave gaps in risk management, data sovereignty, and furnishing audit evidence. In this article, you'll discover how GitLab Dedicated, a fully isolated, single-tenant SaaS solution deployed in your preferred Amazon Web Services (AWS) region and hosted and managed by GitLab, addresses these challenges and helps you keep pace with evolving compliance requirements. "NatWest Group is adopting GitLab Dedicated SaaS to enable our engineers to use a common cloud engineering platform; delivering new customer and colleague outcomes rapidly, frequently, and securely with high quality, automated testing, on-demand infrastructure, and straight-through deployment." -- Adam Leggett, Platform Lead for Engineering Platforms, NatWest Group Regulations are driving change In the European Union, key regulations are driving the need for a different platform approach. These regulations converge on a decision most enterprises made before they existed: a platform their developers build on. That decision now carries audit consequences it didn't before. Digital Operational Resilience Act (DORA), which came into force across EU financial services in January 2025, requires financial institutions to keep critical technology resilient, ## GitLab Critical Patch Release: 19.3.2, 19.2.6, 19.1.8 DevFeed: [GitLab Critical Patch Release: 19.3.2, 19.2.6, 19.1.8]() Original publisher: [Read original article]() Author: Katherine Wu Published: 2026-09-11T00:00:00Z Content type: release Language: en Sources: [GitLab]() Topics: [GitLab](), [releases](), [Vulnerabilities](), [Deployment](), [Bug Bounty]() Tags: [api](), [release](), [security](), [vulnerabilities]() ### AI overview GitLab released critical patches 19.3.2, 19.2.6, and 19.1.8 with bug and security fixes. Self-managed installations should upgrade promptly. ### Source excerpt Learn more about GitLab Critical Patch Release: 19.3.2, 19.2.6, 19.1.8 for GitLab Community Edition (CE) and Enterprise Edition (EE). ## Co-Create: Building GitLab with our users DevFeed: [Co-Create: Building GitLab with our users]() Original publisher: [Read original article]() Author: Isa Huerga Published: 2026-09-10T00:00:00Z Content type: article Language: en Sources: [GitLab]() Topics: [GitLab](), [CI/CD](), [Scala](), [Claude](), [Application Security](), [Cloud APIs]() Tags: [api](), [ci-cd](), [co-created](), [community](), [contributors](), [duo](), [engineering](), [open-source](), [rest-api](), [scala](), [security]() ### AI overview GitLab users collaborated through the Co-Create program on product improvements delivered in the first half of 2026, including API extensions, CI/CD capabilities, Scala support for AI-powered code understanding, security controls, and integration flexibility. ### Source excerpt GitLab users bring firsthand experience of the workflows they want to improve. Through our Co-Create program, they collaborate directly with us to design, build, and deliver product improvements that benefit more teams. In the first half of 2026, our users helped us extend APIs, add CI/CD capabilities, expand language support for AI-powered code understanding, strengthen security controls, increase the flexibility of integrations, and make GitLab easier to use and understand. Co-Create gives customers a direct path from a real-world challenge to a product improvement. Customers collaborate with us on the problem and solution, and help deliver the change. Unlike a feedback-only model, this puts real workflow context into the product development process. It creates a shorter path from need to value while helping us validate improvements in real conditions and extend their benefits to more GitLab users. "Over ten years ago, we set out to build code.siemens.com, our internal coding platform based on GitLab, which today serves close to 100,000 people. We've run and scaled the platform with a tiny team, guided by a 'for developers, from developers' philosophy. We co-created hundreds of features such as x509/gpg signed commits, protected container/packages, and project and social features such as follow users, allowing us to strengthen the security and collaboration culture at the scale of Siemens." -- Roger Meier, Distinguished Engineer, Siemens From a specific need to a shared improvement Some of the best product improvements start with a specific, real-world need. GitLab contributors helped us address the following needs: Making Scala codebases understandable to Orbit and GitLab Duo Giving security administrators a way to enforce Secret Push Protection across an entire instance Letting high-throughput teams configure merge train pipeline limits Showing the platforms supported by multi-architecture images Providing screen reader users with more context on documentation pa ## OpenNMC is an open replacement for expensive APC management cards DevFeed: [OpenNMC is an open replacement for expensive APC management cards]() Original publisher: [Read original article]() Author: jeff@jeffgeerling.com (Jeff Geerling) Published: 2026-09-08T16:00:00Z Content type: article Language: en Sources: [Jeff Geerling]() Topics: [Opennmc](), [Homelab](), [Hardware](), [Open Source](), [GitLab](), [Ethernet](), [USB](), [Crowd Supply](), [Reddit]() Tags: [apc](), [ethernet](), [firmware](), [gitlab](), [hardware](), [homelab](), [open-source](), [opennmc](), [sponsored](), [ups](), [usb]() ### AI overview The article tests OpenNMC, an open-source replacement for proprietary APC UPS management cards. It describes hot-pluggable installation, built-in NUT server support, Ethernet and wireless connectivity, and an initial USB-C serial setup. ### Source excerpt UPSes are typically the most boring part of your homelab, but they're important. One of their main jobs is to give servers time to shut down safely if the power goes out. Another job is to condition your power so your servers can run smoothly. To do both of those things well, you need a smart interface. And at least with APC, there are tons of older UPSes that use Network Management Cards. The one pictured below is the NMC 2, and I pulled out of my old APC Smart-UPS 2200 XL (pictured above). ## GPT-6 Astra on GitLab: Faster runs, fewer tokens used DevFeed: [GPT-6 Astra on GitLab: Faster runs, fewer tokens used]() Original publisher: [Read original article]() Author: Brittany Lutz Published: 2026-09-08T00:00:00Z Content type: news Language: en Sources: [GitLab]() Topics: [GitLab]() Tags: [agent](), [agentic](), [ai](), [benchmark](), [evaluation](), [features](), [frontier-model](), [gpt](), [model](), [openai](), [platform](), [product](), [review](), [testing](), [updates]() ### AI overview GitLab Duo Agent Platform adds GPT-6 Astra. GitLab reports faster typical and slow-tail runs plus lower token use than GPT-5.6 Sol, while noting Sol had a higher benchmark task-resolution rate. ### Source excerpt OpenAI's newest frontier model GPT-6 Astra is now on GitLab Duo Agent Platform, delivering faster runs and lower token usage. In GitLab's internal evaluation, GPT-6 Astra finished a typical run 43.4% faster than GPT-5.6 Sol and used 42.7% fewer tokens per run, while completing every task in the benchmark. For your team, that means agentic tasks such as dependency updates, build fixes, and small multi-file changes come back faster, and stretch your token budget across more of your team's backlog. Faster agentic work, even on your slowest runs Wait time factors into how your team uses an agent. A run that comes back in a few minutes is one you stay engaged with. A longer run is one you let work in the background while you move to another task. When it finishes, you switch context from the work you're in, reread what you asked the agent for, and review a diff you last thought about 30 minutes ago. The longer runs that result in context switching are the ones GPT-6 Astra shortened most in GitLab's internal testing. At the 95th percentile, the slower tail of its runs, GPT-6 Astra finished 49.2% faster than GPT-5.6 Sol, and 43.4% faster on a typical run. Astra's slowest runs finish in roughly the time Sol needed for an average one. With GPT-6 Astra, your team waits less on high volume, routine work. Every task finished, at a lower token usage per run In GitLab's internal testing, GPT-6 Astra completed 100% of benchmark tasks. No run stalled, timed out, or came back empty, so your team isn't left waiting on runs that finish with nothing to review. Astra resolved 63.3% of those tasks, returning a change that passed the benchmark's tests, compared to a 76.7% resolution rate for GPT-5.6 Sol. Misses return as patches to correct rather than runs that produced nothing. Astra reached its completion rate using 42.7% fewer tokens per run than Sol, measured across the same set of tasks. That savings compounds across a backlog, so your token budget covers more of the work your team d ## Announcing GitLab support for Appwrite Sites and Functions DevFeed: [Announcing GitLab support for Appwrite Sites and Functions]() Original publisher: [Read original article]() Author: Matej Bačo Published: 2026-09-03T00:00:00Z Content type: release Language: en Sources: [Appwrite Blog]() Topics: [Appwrite](), [GitLab](), [Deployment]() Tags: [announcements](), [cli](), [code](), [collaboration](), [deployment](), [git](), [gitlab](), [gitlab-ci](), [qr-code]() ### AI overview Appwrite announces GitLab support for Sites and Functions, allowing users to connect GitLab repositories and deploy directly, including repositories in GitLab groups. ### Source excerpt Connect a GitLab account to Appwrite and deploy Sites and Functions directly from your GitLab repositories, including projects that live inside GitLab groups. ## GitLab's internal playbook to foster AI-fluent technical teams DevFeed: [GitLab's internal playbook to foster AI-fluent technical teams]() Original publisher: [Read original article]() Author: Rob Allen Published: 2026-09-02T00:00:00Z Content type: article Language: en Sources: [GitLab]() Topics: [AI Strategy](), [GitLab]() Tags: [ai](), [ai-adoption](), [ai-strategy](), [collaboration](), [compliance](), [enablement](), [engineering](), [workflows]() ### AI overview GitLab shares an internal playbook for building AI fluency in technical teams. It describes a federated governance model that centrally manages foundational AI tools while allowing local experimentation and functional strategy. ### Source excerpt Give two engineering teams the same AI tool and you can end up with two very different outcomes. One team ships faster with fewer bugs, while the other gets burned by an agent that confidently generates the wrong output. At GitLab, our team had AI tools at their fingertips and some found real value fast, working faster and catching issues earlier. Meanwhile, others hadn't quite found an entry point yet to develop effective AI-native workflows. We learned that building AI fluency -- how our team members know what to delegate to AI, how to build the right AI-native processes, and how to judge what comes back -- was just as important as AI tool adoption and access. Building that fluency across GitLab was both an operational and technical challenge requiring close partnership between our Enterprise Technology and Talent Development teams. We're sharing our internal playbook so other technical leaders gain another perspective on how to encourage the right kinds of AI adoption across their own organizations. An AI strategy built for the pace of our work Part of building the right paths for our technical teams was predicated on establishing smart foundational infrastructure. Enterprise Technology considered a few different structures to our governance. The first was a fully centralized team, but we worried that with the speed of AI technology, shipping approvals from one group could end up as a bottleneck. As a result, team members could become impatient and try to circumvent governance infrastructure to experiment with AI. The second was a fully decentralized approach, but that could fragment efforts across the company, which adds complexity and makes guardrail consistency challenging. We landed on a hybrid model, building governance and enablement into a model that used the best aspects of centralized and decentralized strategies: Enterprise AI acts as a central governance and technology hub: Based out of our Enterprise Technology team, Enterprise AI operates as the platfo ## Mintlify introduces instant rollbacks for Enterprise deployments DevFeed: [Mintlify introduces instant rollbacks for Enterprise deployments]() Original publisher: [Read original article]() Author: David Isquick Published: 2026-08-31T00:00:00Z Content type: release Language: en Sources: [Mintlify Blog]() Topics: [Deployment](), [audit](), [Pull Request](), [GitHub](), [GitLab](), [bitbucket]() Tags: [access-control](), [announcements](), [audit](), [configuration](), [deployment](), [pull-request](), [rollback]() ### AI overview Mintlify has introduced instant rollbacks for Enterprise customers, allowing them to restore one of their last 10 successful builds from the dashboard in seconds. Rollbacks are recorded in audit logs and currently support non-authenticated pages. ### Source excerpt Instant rollbacks are now live for Mintlify Enterprise customers. You can roll back to a known good deployment in seconds, without waiting on a full rebuild. ## Publishing Playwright HTML reports on GitLab Pages DevFeed: [Publishing Playwright HTML reports on GitLab Pages]() Original publisher: [Read original article]() Author: T.J. Maher (noreply@blogger.com) Published: 2026-08-29T23:56:10Z Content type: tutorial Language: en Sources: [T.J. Maher]() Topics: [GitLab](), [Playwright](), [CI/CD](), [CI/CD Pipeline](), [Publishing]() Tags: [bun-create-playwright](), [ci-cd](), [ci-cd-pipeline](), [github-pages](), [gitlab](), [gitlab-ci](), [playwright]() ### AI overview This tutorial explains how to add a deploy stage to a GitLab CI/CD pipeline for a Bun-based Playwright project. The stage publishes generated Playwright HTML reports, including screenshots and videos, to GitLab Pages so they can be viewed online. ### Source excerpt We've added a lot to our demo project, bun--create-playwright. We've explored setting up a Playwright framework using bun, a new package manager bundled into Claude Code. We've added typechecking, and formatting and linting. We've set up a CI/ CD pipeline for our tests using GitLab, one with three stages: Quality: We check that the formatting, linting and typechecking is correct for any changes we attempt to push to the code base. Test: We run the smoke and then the regression tests to make sure that everything still works. Report: We bundle an archive of the Playwright generated HTML report, with screenshots and videos if things fail. For this post, we will add a new stage to this GitLab pipeline: Deploy: Where we will deploy the HTML report to GitLab Pages, so we can view it online. What is GitLab Pages? GitLab Pages is a built-in feature of GitLab that allows you to publish static websites directly from a repository in GitLab. Similar to GitHub Pages, it is commonly used to host project documentation, personal blogs, portfolios, or corporate landing pages for free. From the GitLab Docs / Pages: "To use GitLab Pages, you must create a project in GitLab to upload your website's files to. These projects can be either public, internal, or private. "By default, GitLab deploys your website from a specific folder called public in your repository. You can also set a custom folder to be deployed with Pages. When you create a new project in GitLab, a repository becomes available automatically. "To deploy your site, GitLab uses its built-in tool called GitLab CI/CD to build your site and publish it to the GitLab Pages server. The sequence of scripts that GitLab CI/CD runs to accomplish this task is created from a file named .gitlab-ci.yml, which you can create and modify. A user-defined job with pages: true property in the configuration file makes GitLab aware that you're deploying a GitLab Pages website. "You can either use the GitLab default domain for GitLab Pages websit ## Examining the artifacts job of a Playwright GitLab CI / CD pipeline DevFeed: [Examining the artifacts job of a Playwright GitLab CI / CD pipeline]() Original publisher: [Read original article]() Author: T.J. Maher (noreply@blogger.com) Published: 2026-08-29T23:19:22Z Content type: tutorial Language: en Sources: [T.J. Maher]() Topics: [Playwright](), [GitLab](), [CI/CD Pipeline](), [CI/CD](), [test]() Tags: [bun-create-playwright](), [ci-cd](), [ci-cd-pipeline](), [gitlab](), [playwright](), [screenshots](), [test](), [trace](), [videos]() ### AI overview This tutorial examines how a Playwright GitLab CI/CD pipeline stores and exposes test artifacts. It explains the playwright-report, test-results, and reports/junit folders and describes generated HTML and JUnit reports, screenshots, videos, and trace reports. ### Source excerpt You may have noticed that in the GitLab CI / CD Pipeline for our Playwright project, in the .gitlab-ci.yml file, after our scripts has run, in the Test stage, there is a subsection called "artifacts" with certain paths to something called "playwright-report", "test-results", and "reports". The Playwright -> Artifacts -> Reports stage playwright: extends: .bun_playwright stage: test timeout: 30 minutes ... ... artifacts: when: always paths: - playwright-report/ - test-results/ - reports/ reports: junit: reports/junit/results.xml expire_in: 30 days https://gitlab.com/tjmaher/bun-create-playwright/-/blob/main/.gitlab-ci.yml Every time Playwright tests run, it generates proof of the test execution: screenshots capturing the state of the UI when a test failed, video recordings of an entire browser session, HTML and JUnit XML test reports, trace reports showing action logs, network requests. These artifacts, when the tests run locally, are placed by the Playwright Test runner in generated folders, playwright-report and test-results, along with a folder called reports/junit. With this post, we will be examining how this artifacts stage of the GitLab CI/ CD pipeline produces downloadable artifacts we can examine. Playwright-Report: A Playwright Test folderThe Playwright Test runner creates a folder called "playwright-report", if it doesn't already exist, and an HTML file called index.html documenting the completed test run. From Playwright.dev / Test Reporters: "Playwright Test comes with a few built-in reporters for different needs and ability to provide custom reporters. [...] All built-in reporters show detailed information about failures, and mostly differ in verbosity for successful runs. [...] HTML reporter produces a self-contained folder that contains report for the test run that can be served as a web page". The HTML Report is the one that automatically opens after you run your tests locally, or if you are using the node package manager: npx playwright show-report ## How Developers Can Test Their Feature Branch Against Various Playwright Configurations Before Creating a Merge Request in GitLab CI/CD DevFeed: [How Developers Can Test Their Feature Branch Against Various Playwright Configurations Before Creating a Merge Request in GitLab CI/CD]() Original publisher: [Read original article]() Author: T.J. Maher (noreply@blogger.com) Published: 2026-08-28T20:18:08Z Content type: tutorial Language: en Sources: [T.J. Maher]() Topics: [GitLab](), [CI/CD](), [Playwright](), [YAML](), [Development]() Tags: [bun-create-playwright](), [chromium](), [ci-cd](), [firefox](), [gitlab](), [gitlab-ci](), [playwright](), [tests](), [yaml]() ### AI overview This tutorial shows how to configure a GitLab CI/CD pipeline so developers can test a feature branch before creating a merge request. It uses spec inputs in a YAML configuration to let users choose the branch, Playwright test suite, and browser, including Chromium, Firefox, WebKit, or all browsers. ### Source excerpt Developers need the option to test out their feature branch before merging it into main. In the last section, we set up a GitLab CI/CD Pipeline in our bun-create-playwright project to check every GitLab Merge Request. Now, we will be giving developers option to create a new pipeline where they can choose: Which feature branch to test against. Which test suite to execute (LoginPage tests? Secure Area? Or all of them?) Which Playwright browser to use: Chromium, Firefox, WebKit, or all. All these features can be set up using our .gitlab-ci.yaml file! Go to to bun-create-playwright, view the Pipelines section, and select the New Pipeline button. Run a New Bun-Create-Playwright Pipeline If you go to the Run new pipeline page at https://gitlab.com/tjmaher/bun-create-playwright/-/pipelines/new you can see the following default values I've set: https://gitlab.com/tjmaher/bun-create-playwright/-/pipelines/new By default: Branch name is "main", TEST_SUITE is "all", BROWSER is "all". ... But all these values can be set, with the developer choosing the options laid out in the .gitlab-ci.yaml file. Collect User Data With Spec Inputs We are going to be adding to the GitLab Pipeline we built in our last post Setting up a CI/ CD pipeline with GitLab: Quality, Test and Report. First, we are going to add a "spec" section to the header of the YAML file to define the behavior of a pipeline, and within that spec header, we will ask the person who triggered a new pipeline to set user defined inputs for the pipeline. spec: inputs: browser: description: "Browser project to run against." default: "all" options: ["all", "chromium", "firefox", "webkit"] suite: description: "Select full regression suite, or a single spec" default: "all" options: ["all", "login.spec.ts", "secure-area.spec.ts"] This is where we declare the "browser" and "suite" variables that appear when a user creates a new pipeline. We've given them a choice to run their feature branch code against: Browser: All, Chromium, Fir ## GitLab compliance frameworks: Adhere to SOC 2 in minutes DevFeed: [GitLab compliance frameworks: Adhere to SOC 2 in minutes]() Original publisher: [Read original article]() Author: Fernando Diaz Published: 2026-08-27T00:00:00Z Content type: article Language: en Sources: [GitLab]() Topics: [GitLab](), [Template](), [configuration](), [Security](), [Software]() Tags: [application-security](), [article](), [compliance](), [devsecops](), [framework](), [how-to](), [platform](), [security](), [soc](), [software](), [software-delivery](), [tutorial]() ### AI overview This article explains how GitLab custom compliance framework templates help teams define controls, continuously monitor adherence, and prepare for audits. It uses SOC 2 as a central example and covers templates, policies, compliance requirements, and automated checks across GitLab deployment options. ### Source excerpt Compliance is the part of software delivery that everyone agrees is important, yet nobody enjoys. It often lives in spreadsheets, screenshots, and the quiet dread of an upcoming audit. GitLab's custom compliance frameworks work differently. Instead of documenting what should be true about your projects, you define the controls once and let the platform continuously verify what is true. In this article, you'll learn why compliance adherence matters, how to stand up a SOC 2 framework in minutes using a template, how to monitor adherence on an ongoing basis, how to enforce compliance with policies, and which standards already ship as ready-to-use templates. You'll also get a look at where AI-specific compliance templates are heading. You can watch the video below to see it in action: Tier note: Compliance frameworks are available in Premium and Ultimate. Framework requirements and controls, the checks that power adherence reporting and the compliance status report, require Ultimate. Everything here applies to GitLab.com, GitLab Self-Managed, and GitLab Dedicated. Why compliance adherence matters and how custom frameworks help Regulatory and contractual obligations like SOC 2, ISO 27001, PCI DSS, and FedRAMP exist because customers, partners, and regulators need assurance that your software is built and shipped responsibly. Falling short isn't just a paperwork problem. It can block deals, trigger fines, delay product launches, and erode trust. Compliance also isn't a one-time event. A project that was compliant at audit time can drift the moment someone disables a scanner, removes branch protection, or merges without the required approvals. Custom compliance frameworks are designed to close that gap. A compliance framework in GitLab is a label you create on a top-level group to identify projects that carry specific compliance obligations or need extra oversight. On its own that label provides organization and visibility. In Ultimate, a framework can also carry requireme ## How to recognize your team with GitLab Achievements DevFeed: [How to recognize your team with GitLab Achievements]() Original publisher: [Read original article]() Author: Lee Tickett Published: 2026-08-27T00:00:00Z Content type: tutorial Language: en Sources: [GitLab]() Topics: [GitLab](), [Open Source](), [Template](), [Markdown]() Tags: [collaboration](), [community](), [company](), [feature](), [how-to](), [markdown](), [open-source](), [product](), [profile](), [retention]() ### AI overview GitLab Achievements lets teams create reusable custom badges and award them for contributions, milestones, certifications, or other behaviors. Awards appear on recipients' profiles after they accept them, and optional personal messages support GitLab Flavored Markdown. The feature is presented as a way to reinforce recognition, retention, motivation, and belonging across companies, open source projects, and communities. ### Source excerpt Every team runs on people who go above and beyond. The engineer who fixes the flaky test nobody else will touch. The reviewer who turns your merge request around in an hour. The teammate who finishes their certification. Or the community member who shows up release after release. Whether your team is a company, an open source project, or a community, GitLab had no built-in way to say "we see you." GitLab Achievements changes that. What are GitLab Achievements? An achievement is a custom badge you create once and award to people for their behavior. That might be a contribution, a milestone, or simply getting the most out of GitLab. Each one has a name, a description, and an avatar. Think "First merged MR", "Certified", or "Contributor of the month". Awarded achievements appear on the recipient's profile, alongside their contribution history. There are two halves to the achievement. The achievement itself is a reusable template you define at the group level. Awarding that achievement to someone is a separate action, and it can carry an optional personal message. That message supports GitLab Flavored Markdown, so you can link straight to the merge request, issue, or event that earned it. The same "Contributor of the month" badge can then tell a different story every time you award it. Recipients stay in control. An award doesn't appear on anyone's profile until they accept it using a link from an email notification. Recognition is offered, never forced onto someone's profile. Achievements are generally available as of GitLab 19.2, across Free, Premium, and Ultimate, on GitLab.com, GitLab Self-Managed, and GitLab Dedicated. Why recognition matters Recognition is one of the least expensive, most effective tools you have for retention, motivation, and belonging. A visible badge on a profile costs you a minute to award and gives the recipient something lasting. And "team" is broad: It might be your company, your open source project, or your wider community. The value depen ## Setting up a CI/ CD pipeline with GitLab: Quality, Test and Report DevFeed: [Setting up a CI/ CD pipeline with GitLab: Quality, Test and Report]() Original publisher: [Read original article]() Author: T.J. Maher (noreply@blogger.com) Published: 2026-08-25T02:28:52Z Content type: tutorial Language: en Sources: [T.J. Maher]() Topics: [CI/CD Pipeline](), [GitLab](), [Testing](), [Playwright](), [pull-requests](), [TypeScript]() Tags: [bun-create-playwright](), [ci-cd](), [ci-cd-pipeline](), [code-reviews](), [gitlab](), [playwright](), [test](), [testing](), [typescript](), [workflows]() ### AI overview A tutorial on setting up a three-stage GitLab CI/CD pipeline for merge requests. The pipeline runs code-quality checks, smoke and regression tests, and produces a downloadable report, with stages executed sequentially and jobs within each stage running in parallel. ### Source excerpt So far, we have reviewed how to review code with ES Lint + Prettier and Typecheck, how to set up and run smoke tests, how to run all Playwright + TypeScript tests, and reviewed the HTML report of results. In this post, we are going to set up a three stage GitLab CI/ CD pipeline that will run against every merge request: Quality (lint, typecheck, prettier) --> Test ( smoke + regression ) --> Report ( Downloadable ) I haven't used GitLab since when I worked at ThreatStack back in 2020. ( See my blog entry Getting to Know GitLab and How They Test the UI ) GitLab reads .gitlab-ci.yml from the repository root and turns it into a pipeline, a set of jobs, grouped into stages, running whenever you push a change to a repository. Stages run one after another, and jobs within a stage run in parallel. If one stage fails, the stages after it are skipped. This begs the question: What is GitLab? What is CI/ CD? Or a pipeline? Or a merge request? What is GitLab? GitLab began in 2011 as a side project by Ukrainian programmer Dmytro Zaporozhets, built to help developers work together on code more easily. Over time, it grew into a large open-source DevOps platform. More than just storing code, it handles code reviews, CI/CD (continuous integration and continuous delivery), and package registries. A company called GitLab Inc. was eventually created to turn the project into a commercial product. What makes GitLab different from tools that only host Git repositories (like a basic Git server) is that it bundles the entire software delivery process into one application. This includes: Merge requests - GitLab's term for proposing and reviewing code changes before they're merged into the main codebase (similar to a "pull request" in GitHub) Issue tracking - a built-in system for logging bugs, tasks, and feature requests Pipelines - automated workflows that build, test, and deploy code whenever changes are pushed So instead of stitching together separate tools for version control, testing, an ## Scale software delivery pipelines in isolation without owning the runner fleet DevFeed: [Scale software delivery pipelines in isolation without owning the runner fleet]() Original publisher: [Read original article]() Author: Kyurim Rhee Published: 2026-08-25T00:00:00Z Content type: article Language: en Sources: [GitLab]() Topics: [ci](), [GitLab](), [Software as a service](), [Security](), [cloud-infrastructure](), [Provisioning]() Tags: [agentic](), [ci](), [compliance](), [cost](), [developers](), [devsecops-platform](), [infrastructure](), [operations](), [platform](), [product](), [saas](), [scale](), [security](), [software-delivery](), [workflows]() ### AI overview GitLab presents Hosted Runners for GitLab Dedicated, a fully managed CI execution SaaS offering with isolated runner infrastructure. Each job runs in a newly provisioned VM that is deleted after completion, helping enterprises address security, compliance, scalability, reliability, and runner-operations demands without owning the runner fleet. ### Source excerpt Many enterprises choose GitLab Dedicated for a clear reason: a secure and compliant, single-tenant GitLab instance, managed by GitLab. As agentic workflows drive more pipeline volume, full data isolation and runner infrastructure operational burden become a challenge. This leads to the question, "Does owning the runner fleet still make sense?" With GitLab Dedicated, there is no more need to provision, patch, build, and scale your own runner fleet. Hosted Runners for GitLab Dedicated handles the heavy lifting and delivers a seamless experience across the entire software development lifecycle so your team can focus on shipping. Hosted Runners for GitLab Dedicated provides a runner fleet isolated from other customers. To support job-level security, each job runs in a newly provisioned, isolated VM that is deleted after the job completes. We provide a scalable and highly reliable runner fleet to support your bursty CI demands and resiliency needs. Creating and managing runners is self-serviceable through Switchboard (GitLab Dedicated management console). The runner ownership trade-off: Cost vs. user experience Pipeline load can be unpredictable. To account for this, runner infrastructure can be over-provisioned to give developers the best experience and maintain low wait times. But this drives up the infrastructure cost. Conversely, under-provisioning can save on infrastructure cost, but your developers will waste time waiting for their CI jobs to be picked up. Efforts to fine-tune this balance can monopolize your platform team's time. Shift runner operations to GitLab while maintaining control Hosted Runners for GitLab Dedicated is a fully managed CI execution SaaS offering. It's backed by a high-performing and reliable runner infrastructure. Key benefits include: Supports compliance: Full isolation/single-tenant runners with same data residency as GitLab Dedicated. Job level security: "One runner for one job" -- hosted runners run every job in a standalone, short-lived ## When code is abundant DevFeed: [When code is abundant]() Original publisher: [Read original article]() Author: Bill Staples Published: 2026-08-24T00:00:00Z Content type: opinion Language: en Sources: [GitLab]() Topics: [AI Development](), [Vibe coding](), [Software Engineering](), [GitLab](), [sdlc](), [anthropic](), [Concurrency](), [Graphs]() Tags: [ai](), [ai-agents](), [architecture](), [code](), [concurrency](), [devsecops-platform](), [enterprise](), [news](), [policy](), [software-development](), [workflow]() ### AI overview This opinion argues that AI agents and large language models are making code production cheaper and faster, shifting the main challenge for enterprise software development toward context, verification, governance, identity, policy, approval, and audit. It discusses how the software development lifecycle and its underlying architecture must adapt to machine-scale concurrency and automated workflows. ### Source excerpt I returned from the holiday break in January convinced that something fundamental had changed. Large language models had reached the point where they could produce useful code reliably enough, and cheaply enough, to change the economics of software development. Engineers everywhere seemed to be experimenting with the same thing: not just asking an AI assistant for suggestions, but giving agents real work and seeing how far they could take it. I started thinking about what happens if that continues. What changes when producing code is no longer the primary constraint in building software? I wrote those thoughts down in a board memo in January. In May, I published part of that thesis in GitLab's Act 2: the cost and time of producing software was collapsing, machines would increasingly build software under human direction, and the architecture underneath software development would have to change with it. In June, at GitLab Transcend, we showed the first pieces of that architecture: source control rebuilt for machine-scale concurrency, GitLab Orbit as a context graph spanning the software lifecycle, and governance around agent identity, policy, approval and audit. Then, on August 21, Anthropic published The AI-Native SDLC Playbook. It opens with a simple statement: "Code is no longer the bottleneck." I agree. Anthropic's playbook is a practical description of how the development lifecycle changes when agents can move implementation dramatically faster: planning becomes machine-readable, handoffs become automated, verification moves into the loop, and human judgment concentrates at the gates. What interests me is what happens one level beyond the workflow. If code is no longer the primary constraint, what becomes scarce? What architecture does an enterprise need when people, agents and multiple models are all acting across the software lifecycle at machine speed? And where does durable value move when generating the code itself becomes increasingly abundant? Over the pas ## GitLab 19.3 released DevFeed: [GitLab 19.3 released]() Original publisher: [Read original article]() Author: GitLab Published: 2026-08-20T00:00:00Z Content type: release Language: en Sources: [GitLab]() Topics: [GitLab](), [Release notes](), [Artificial Intelligence](), [CI/CD](), [YAML](), [audit trail](), [Authorization](), [Command-line interface]() Tags: [agent](), [ai](), [audit-trail](), [ci-cd](), [command-line](), [release](), [release-notes](), [secrets]() ### AI overview GitLab 19.3 release notes describe the Flow Creator foundational agent, which generates runnable flow YAML through plain-language conversation and can help debug flows and explain framework concepts. The release also introduces GitLab Secrets Manager in Limited Availability on GitLab.com, with scoped credentials, existing permission integration, and audit-trail logging. ### Source excerpt GitLab 19.3 released with Flow Creator foundational agent ## When your backlog outgrows your team, GitLab scales remediation DevFeed: [When your backlog outgrows your team, GitLab scales remediation]() Original publisher: [Read original article]() Author: Alisa Ho Published: 2026-08-20T00:00:00Z Content type: article Language: en Sources: [GitLab]() Topics: [GitLab](), [Application Security](), [Vulnerabilities](), [Security](), [Artificial Intelligence]() Tags: [agentic](), [ai](), [application-security](), [developer](), [features](), [product](), [security](), [vulnerabilities]() ### AI overview GitLab 19.3 introduces bulk SAST False Positive Detection and Agentic SAST Vulnerability Resolution for existing production vulnerability backlogs. The features assess findings, identify likely false positives, and generate ready-to-merge fixes for confirmed vulnerabilities, including findings imported from third-party SARIF scanners. ### Source excerpt Security teams have historically struggled to keep up with triage and remediation when development was happening at human speed. Today, that challenge is exacerbated by developers writing and shipping code at machine speed with AI. At the same time, AI is helping attackers find and exploit vulnerabilities faster in production. Verizon's 2026 Data Breach Investigations Report found vulnerability exploitation overtook credential abuse as the top breach entry point. Vulnerability exploitation accounts for 31% of breaches versus just 13% in previous years, and only 26% of known exploited vulnerabilities were remediated this year, down from 38%. That means more breaches are starting with a vulnerability that was already sitting in production, unpatched. In GitLab 19.3, teams can now run Static Application Security Testing (SAST) False Positive Detection and Agentic SAST Vulnerability Resolution, in bulk, on their existing vulnerability backlog. Dismiss false positives and remediate vulnerabilities in bulk Most teams have a known vulnerabilities backlog already running in production, far more than any team has time to open and triage one at a time. That used to be a workload problem. Now it's a timing problem too: The same AI accelerating development is accelerating exploitation, which means findings that sit in the backlog longer carry more risk than they used to. GitLab addresses this with two layers of automated triage and remediation. The first covers active vulnerabilities in production. With GitLab 19.3, teams can bulk-select multiple vulnerabilities to run agentic flows, SAST False Positive Detection and Agentic SAST Vulnerability Resolution, against the vulnerability backlog in production. SAST False Positive Detection analyzes a finding's surrounding code and returns a confidence score and explanation for whether it's a real risk or a false positive. Agentic SAST Vulnerability Resolution takes findings confirmed as real risk and opens a ready-to-merge fix that re ## 20x the CI traffic without getting slower: How we rebuilt Git serving at Datadog DevFeed: [20x the CI traffic without getting slower: How we rebuilt Git serving at Datadog]() Original publisher: [Read original article]() Author: Mike Thompson; Daniel Esponda Published: 2026-08-19T00:00:00Z Content type: article Language: en Sources: [Datadog | The Monitor blog]() Topics: [ci](), [Git](), [GitLab](), [GitHub](), [Latency](), [Replication](), [Architecture & Design](), [AI-assisted coding]() Tags: [backend](), [ci](), [ci-cd](), [deployment](), [git](), [github](), [infrastructure](), [latency](), [mirror](), [replication](), [self-hosted]() ### AI overview Datadog describes gitretriever, a Git mirror built to serve CI workloads at large scale. The system handled 20x traffic growth while keeping median latency near 40 ms and reducing fetch-serving CPU usage on the previous Git backend. ### Source excerpt Learn how Datadog built gitretriever to handle 20x more CI Git traffic while maintaining low latency and reducing backend CPU usage. ## Best CircleCI alternatives in 2026 DevFeed: [Best CircleCI alternatives in 2026]() Original publisher: [Read original article]() Author: Pete Miloravac Published: 2026-07-31T12:11:33Z Content type: comparison Language: en Sources: [Semaphore Engineering]() Topics: [CI/CD](), [GitHub Actions](), [GitLab](), [Development]() Tags: [alternatives](), [ci-cd](), [compare](), [comparison](), [economics](), [platform](), [pricing](), [support]() ### AI overview This guide compares Semaphore, GitHub Actions, GitLab CI/CD, and Buildkite as alternatives to CircleCI in 2026. It evaluates build speed, cost predictability, support, deployment control, source-control integration, and hosting options. ### Source excerpt Teams looking for CircleCI alternatives are rarely replacing a single feature. They are reassessing build speed, unit economics, support coverage, deployment control, and how easily their CI/CD system fits the source-control platform they already use. CircleCI remains a capable hosted CI/CD product, but its credit-based model meters active users, compute by resource class and minute, [...] The post Best CircleCI alternatives in 2026 appeared first on Semaphore. ## Best GitLab Alternatives in 2026 DevFeed: [Best GitLab Alternatives in 2026]() Original publisher: [Read original article]() Author: Pete Miloravac Published: 2026-07-30T12:04:04Z Content type: comparison Language: en Sources: [Semaphore Engineering]() Topics: [GitLab](), [CI/CD](), [DevSecOps](), [GitHub Actions]() Tags: [2026](), [alternatives](), [ci-cd](), [circleci](), [compare](), [cost](), [devsecops](), [enterprise-deployment](), [evaluation](), [github](), [github-actions](), [gitlab](), [gitlab-ci](), [self-hosted]() ### AI overview A comparison of Semaphore, GitHub Actions, CircleCI, and Buildkite as alternatives to GitLab for CI/CD-focused decisions. It examines execution, deployment, pricing, support, and operating models while explaining when retaining GitLab repositories may be more practical than replacing GitLab entirely. ### Source excerpt GitLab is a capable, integrated DevSecOps platform--but it is not the only sensible way to run CI/CD. Teams comparing GitLab alternatives are often trying to improve pipeline execution, simplify operations, get clearer support and cost options, or adopt a CI/CD tool that fits their existing source-control strategy. That does not automatically mean moving repositories out [...] The post Best GitLab Alternatives in 2026 appeared first on Semaphore. [Next page]()