►
From YouTube: Gitlab 14 Community Meetup: favorite features review
Description
To celebrate the release of GitLab 14 https://about.gitlab.com/gitlab-14/, members of the Developer Evangelism team and wider GitLab community share some of their favorite features that have been released since our last major milestone.
Learn about some of the most beloved features in GitLab from some of our most passionate and active users. 5 minute video: https://www.youtube.com/watch?v=3KdONZj8kG4
The speakers and topic include:
00:54 John Coghlan - Intro to GitLab 14
05:30 Michael Friedrich - CI/CD Pipeline Editing on Steroids with the new editor
17:44 Alejandro Medina - SSH key expiration enforced by default AND Pronouns box for GitLab profiles
24:09 Michael Aigner - GitLab VS Code extension including the new code review feature from 14
37:58 Brendan O'Leary - SAST and the new Semgraph integration for SAST
57:00 Q&A
Slides & insights:
- CI/CD Pipeline Editing on Steroids with the new editor: https://docs.google.com/presentation/d/1239kdKB1QiOzRTT8klSOwbsYzqBTJHvW0PoclOlNHfU/edit
- SSH key expiration enforced by default AND Pronouns box for GitLab profiles: https://docs.google.com/presentation/d/1Whd_ESUykde1uMcWWtfsq_612tQSZ_nsAdKaEwmZQxY/edit
- GitLab VS Code extension including the new code review feature from 14: https://www.youtube.com/watch?v=F5ypjlOZ4-0
- SAST and the new Semgraph integration for SAST https://docs.google.com/presentation/d/1wRs-BECUQvyUeL0O95FCbR9NWs4CQkbJP6cRQlBRhcs/edit
Feature requests discussed in the meetup:
- VS Code Extension: Pipelines progress and logs views https://gitlab.com/gitlab-org/gitlab-vscode-extension/-/issues/423
A
A
I
always
like
to
start
by
reminding
folks
at
the
beginning
of
our
meetups
at
gitlab.
One
of
our
values
is
diversity,
inclusion
and
belonging,
and
we
like
to
make
sure
our
community
is
welcoming
and
inclusive.
So
everyone
please
abide
by
our
community
code
of
conduct,
I'm
going
to
drop
a
link
to
that
in
the
chat.
A
A
So
with
that,
thanks
for
joining
us
really
excited
to
be
here
today
we're
talking
about
get
lab
14.
This
is
a
huge
kind
of
moment
for
us
at
get
lab.
We
dropped
our
dot
o
from
our
release.
Naming
for
this
one,
because
it's
such
a
big
deal
and
yeah,
I
just
wanted
to
spend
a
few
minutes
kind
of
introducing
gitlab
14
and
why
we're
so
excited
about
it.
So
gitlab
14
is
you
know
our
latest
kind
of
release.
We
release
a
new
version
of
git
lab
every
month
on
the
22nd.
A
We've
been
doing
that
for
117
consecutive
months,
and
so
you
know
with
that
kind
of
history.
It
can
be
easy
to.
You
know,
overlook
a
release.
It
can
start
to
feel
a
little
bit
routine,
and
so
we
love
these
round
number
releases
because
they
give
us
a
chance
to
step
back
and
reflect
on
all
of
the
hard
work
and
all
the
progress
that
we've
made
to
get
where
we
are
today
and
when
I
say
we
I'm
talking
about
the
wider
get
lab
community.
A
Over
the
past
five
years,
we've
had
10
000
community
contributions
from
thousands
of
community
members
and
that's
all
part
of
this
gitlab
14
release.
So
thank
you
to
everyone.
Who's
contributed
and
we're
really
excited
about
the
release.
This
release,
we
think,
is
like
where
we're
kind
of
able
to
bring
modern
devops
to
everyone,
and
so
you
know
it's.
It's
really
just
like
a
new
kind
of
era
that
we're
entering
now.
You
know
traditionally,
devops
has
been
you
know
like
a
tool
chain.
That's
built
and
managed
by
you
know
a
team
that
pieces.
A
A
A
We've
got
great
built-in
security
tools
and
we're
constantly
providing
new
insights
into
where
you
are
in
your
devops
journey,
so
that
you
can
understand
where
the
gaps
are
begin
to
adopt.
You
know
kind
of
new
stages
of
the
devops
life
cycle
that
maybe
you're
not
putting
to
to
full
use
and
that'll
help
filter
back
to
that
velocity
bit.
A
B
A
Each
kind
of
speaker
will
present
about
their
favorite
feature
that
was
released
between
13
and
13.014.00
and
then
we'll
have
time
for
a
quick
q
a
after
each
of
those
talks
and
yeah
I'd
love
for
everybody
to
use
the
chat
as
much
as
you'd
like
to
ask
questions
you
can
cheer
on
our
speakers.
You
can
boo
them
if
they
make
bad
jokes
but
yeah.
A
Let's
try
to
make
it
interactive
and
fun,
and
so
with
that
I'd
love
for
everyone
to
to
start
that
engagement
by
just
sharing
who
you
are
who
who
you
are
where
you're
joining
from
and
if
you
have
a
gitlab
feature
that
you'd
like
to
you
know
share.
Please
do
that.
It
doesn't
have
to
be
a
recent
feature.
It
could
be
something
that
you
know
has
been
around
for
a
long
time
like
atlabci,
but
yeah,
please,
you
know
just
introduce
yourself
in
the
chat.
A
C
Yeah
10
minutes.
That's
the
problem.
Let's
share
my
screen
and
this
is
like
the
spoiler
already.
What
I
want
to
talk
about
in
the
next
10
minutes
is
basically
I
found
myself
on
a
journey
around
the
icd
pipeline.
Editing
and
seeing
things
like
the
first
steps
with
gi
cd
are
like
sometimes
overly
complicated,
and
it's
a
little
bit
a
little
bit
about
like
building
lego
bricks
together
and
finding
the
right
way.
So
I
think
potentially
you
have
been
there.
C
If
you
started
early
with
the
icd,
you
add
something
to
the
yaml
configuration,
it
doesn't
work,
you
try
again,
you
commit
you
push,
you
wait
and
it's
just
it's
not
funny.
It's
lots
of
trial
and
error.
So
well,
then
I
was
thinking.
Do
I
need
to
be
a
younger
expert
to
add
ci
cd
config,
because
everyone
should
be
able
to
contribute
so
everyone
can
contribute.
We
want
to
have
fast
feedback
and
we
have
want
to
have
easy,
ci
cd,
meaning
to
say
we
can
actually
focus
on
efficient
workflows.
C
We
can
focus
on
development
and
the
things
which
are
fun.
So
I
was
amazed
seeing
the
pipeline
editor
and
in
order
to
try
that
out,
I
want
to
encourage
you
to.
Oh,
I
didn't
share
the
slides
yet
to
create
a
new
project.
I
did
it
already
so
we
have
prepared.
The
thing
is
when
I
want
to
have
fast
feedback
with
the
pipeline
editor.
We
just
want
to
try
it
out,
so
we
can
actually
navigate
in
a
project
into
the
editor
and
just
go
ahead
and
do
that.
So
it's
in
ci,
cd,
editor.
C
And
it
asks
me,
I
don't
have
a
ci
cd
or
gitlab
cr
gamma.
Yet
please
create
one
okay.
Then,
let's
click
on
that
and
I
don't
I'm
not
only
getting
an
editor
which
allows
me
to
input
my
yammer,
but
I
also
get
a
pre-filled
template
which
is
super
nice
and,
on
the
right
hand,
side.
I
also
get
a
pain
of
saying,
hey.
You
are
just
getting
started
with
ci
cd
run
your
first
pipeline,
some
additional
tips
and
tricks,
and
so
on.
So
it's
really
helpful.
C
I
could
also
use
like
browse
templates
and
other
things,
but
in
this
example
I
just
want
to
show
you
what's
actually
possible,
so
I'm
just
removing
that
and
start
typing
and
saying
hey.
I
want
to
just
like
use
the
alpine
image
to
run
a
check,
and
I
want
to
just
use
the
latest
talk
the
latest
tag
and
it
says:
well,
you
made
a
mistake.
I
get
immediate
feedback
which
I
didn't
have
before.
C
So
it
tells
me
something
something
is
not
right
yet
so
maybe
let's,
let's
create
a
test
job
and
I
press
enter,
and
it
automatically
does
the
indent
for
me
and
I
want
to
run
x
script
which
is
exit
exit.
One
exit,
one
is
an
arrow
now
it
says
it's,
oh,
it
doesn't
detect
this
one,
this
error,
but
in.
If
I
make
a
mistake
like
this,
it
will
detect
it
immediately.
C
C
C
It
tells
me
the
test
stage
and
the
two
jobs
being
created.
The
linting
job
actually
produces
the
output,
but
it's
there,
but
I'm
essentially
interested
in
what
is
the
merged
configuration,
the
merged
jammer,
which
is
actually
then
executed
by
the
runner
or
by
the
gitlab
cr
runner,
and
I
can
from
there
I
can
see
the
differences,
so
it
will
be
the
testing
sense
for
production
we'll
be
using
the
build
type
release.
The
other
one
is
debug
from
the
template
and
yeah.
C
The
emojis
are
utf-8
unique,
uni,
encoded,
unicode,
not
readable
yet,
but
still
in
the
end,
they
will
be
so.
This
is
another
great
example
that
you
can
immediately
fetch
the
merged
camera
and
see
what
it
actually
does.
You
don't
need
to
wait
for
the
build
pipeline
to
complete
yeah
and
another
cool
example
is
that
we
can
do
even
more
with
that.
C
So,
for
example,
if
you
have
been
using
gitlab,
14
or
the
way
to
gitlab
14
in
the
past
year,
you
potentially
have
seen
the
matrix
builds,
which
are
parallel,
builds
in
ci
cd,
and
this
also
works
with
parent
child
pipelines
and
lots
of
lots
of
other
things.
The
great
stuff
is,
this
also
works
with
the
pipeline.
Editor
just
copy
paste
in
this
example,
and.
C
C
I
don't
need
to
reuse
that
I
can
just
extend
it
and
have
built
test
and
deploy,
and
when
I
click
on
lint,
I
can
actually
see
what
is
being
generated
from
that.
So
I
will
have
a
multitude
of
jobs
being
generated
from
the
parallel
metrics.
I
can
verify
that
I
don't
need
to
wait
for
any
commit
commit
push
run.
I
execute
something
and
five
minutes
later
I
get
the
result
in
in
the
worst
case,
but
instead
I
can
keep
working
on
here
and
I
can
also
see
what
is
being
merged
inside
and
yeah.
C
This
is
the
this
is
basically
what
you
can
do
with
the
pipeline
editor
on
the
ui
at
the
moment-
and
this
is
for
me-
it's
a
huge
lifetime
improvement.
I
don't
need
to
do
any
test
test
weight
and,
and
so
on
and
yeah-
that's
that's
about
it.
We
could
also
use.
We
can
also
browse
templates
just
to
integrate
them
better.
I'm
sure
this
will
be
integrated
even
better
in
the
in
future
releases.
C
But
you
can
also
automate
everything,
and
this
is
one
of
the
additional
features
the
pipeline
editor
added
to
gitlab.
As
a
all-in-one
devops
platform,
you
can
use
the
rest
api,
so
the
api
endpoint,
slash,
ci,
slash,
lint,
is
avoidable
and
you
can
consume
it
by
rest.
Api
clients
by
your
own
scripts
by
git
bucket,
commit
talks
and,
and
even
more
especially
since
you
can
use
jq.
This
is
a
json
cli
tool.
I
wrote
a
blog
post
a
while
ago
about
it.
C
You
can
use
it
to
pass
the
yammer
configuration,
send
it
as
a
body
to
the
rest
api
and
then
get
the
feedback.
Oh,
this
is
like
it
works,
so
the
linting
is
fine
or
it's
it's
broken
and
you
can
even
get
fetched
the
merged
yammer,
which
I
did
show
you
in
the
ui.
Currently
you
can
receive
that
on
the
cli.
You
can
integrate
it
somewhere
and
actually
gets
get
the
whole
output.
This
is
described
in
this
relatively
long
blog
post,
around
jq
and
json
and
the
api.
C
A
Awesome,
thank
you
michael,
and
you
were
right
on
time
so
great
job
with
the
time
in
there
I'm
seeing
a
couple
questions
in
the
chat
sanjay
asking
if
we're
going
to
receive
these
slides
in
the
video.
Yes,
we'll
be
posting
the
video
on
get
lab
unfiltered
on
youtube
and
we'll
try
to
yeah
share
the
slides,
if
possible,
I'll
just
need
to
check
with
the
presenters,
because
we
haven't
discussed
that
yet.
C
C
There
are
ideas
or
discussions
around
like
not
doing
the
commit,
but
I
think
it's
the
current
ways
to
you
have
have
a
feature
branch.
You
have
a
test
branch
in
a
merge
request,
which
is
a
draft
and
you
actually
commit
it.
It
gets
sent
to
the
runners
and
then
you
continue
receiving
the
artifacts
and
can
work
with
everything.
C
A
Else
all
right,
great
and
sanjay
and
jeff
I've
noted
your
questions
and
we'll
circle
back
to
those
at
the
at
the
end.
There's
the
ones
regarding
cicd
versus
waypoint
and
secret
management.
Kubernetes
we'll
try
to
get
to
those
at
the
end.
For
now,
we'll
just
keep
the
q
a
yeah
the
like,
in
between
talks
to
relevant
to
the
feature
you
know
that's
being
presented
so
with
that
I'm
going
to
bring
up
our
next
speaker,
alejandro
alejandro,
is
one
of
our
most
active
community
members.
A
You,
if
you're
a
member
of
like
a
spanish
speaking
community,
you
might
have
attended
one
of
the
many
latin
focus
meetups
that
he's
organized
for
us
recently
and
also
just
a
really
active
participant
in
the
gitlab
community.
So,
thanks
for
being
here
alejandro
and
excited
to
hear
about
your
favorite
feature,
take
it
away.
D
D
So,
let's
begin
first,
one
of
the
features
that
I
found
the
most
useful
is
the
ssh
key
expiration
force
by
default
for
those
who
don't
know
while
there,
the
ssh
protocol
is
I'm
going
to
like
a
brief
explanation.
Ssh
is
like
a
cryptographic
network
protocol
that
operates
and
using
encryption
keys.
So
you
generate
these
keys
on
your,
for
example,
on
your
local
machine,
and
you
will
have
like
a
private
kit
and
a
public
key
with
your
public
key
you
are
going
to
provide
to.
D
In
the
case
of
gitlab,
we
use
the
ssh
protocol
for
communicating
with
the
key
with
our
given
repository
in
a
way
that
is
secure
because
the
the
alternative
that
we
can
use
it
could
be
like
the
http
protocol,
but
this
implies
using
another
protocol
that
is
not
so
secure
like
a
secure
shell
and
also
it
has
another
disadvantage
that
you
every
time
like.
For
example,
you
do
a
push.
D
So
why
is
this
feature
important?
A
living
in
sshk
valley?
Definitely
post
significant
security
risks.
So
now,
with
the
last
major
release
of
gitlab,
14
ssh
key
expiration
is
now
enforced
by
default.
An
inspire
kick
and
continue
to
be
used
so
when,
when
we
are
providing
our
public
key
to
the
settings
in
gitlab,
for
example,
here
I
have
like
a
when
I,
when
you
are
adding
the
your
public
key,
we
are
providing
like
the
public
and
the
title
of
the
that
key
and
the
expiration
date.
D
So,
for
example,
tomorrow
29
of
june
and
the
key
will
be
deleted,
and
this
is
important,
because
ssh
management
is
only
good
as
good
as
the
policy
you
have
in
place
and
then
they
are
forced.
So
a
good
practice
is
that
remember
to
invalidate
your
ssh
keys
after
a
certain
period
of
time
and
also
rotate
your
keys
regularly.
D
D
You
can
see
like
here,
for
example-
and
I
show
you
my
dealer
profile
with
my
name
next
to
it.
I
have
my
pronouns,
so
you're
in
the
pronouns
are
words
that
people
used
to
refer
to
us,
where
using
their
names
and
using
a
person
to
correct
pronouns,
foster
and
inclusive
environment
and
are
friends
of
persons
your
identity.
D
A
No
question
from
me,
but
just
a
comment:
thank
you
for
pointing
out
the
pronouns.
I
know
a
lot
of
our
team
members
were
really
excited
about
that
and
the
fact
that
it
was
released
during
pride
month.
I
think,
made
it
even
more
significant,
so
yeah
thanks
for
for
shouting
that
out
and
that's
definitely
something
a
lot
of
us
were
excited.
A
A
E
E
E
E
Many
14
features
is
the
gitlab
vs
code
extension
because
I
personally
use
gitlab
gitlab
a
lot,
and
I
also
use
vs
code
a
lot
and
I
was
happy
when
the
announcement
last
year
came
out
that
gitlab
workflow
is
now
taken
away
by
gitlab
itself
and
since
then
there
are
more
and
more
features
are
coming
to
the
us
code,
extension
and
yeah.
So
what
what
is
it
and
what's
the
benefit
so
get?
The
little
workflow
makes
it
possible
that
you
can
have
less
context
switches.
E
So
you
don't
have
to
switch
always
to
the
website
or
something
else.
You
can
stay
in
vs
code
and
that's
the
possibility
to
use
the
normal
command
palette
to
to
get
to
your
features
or
issues.
So
your
merge
requests
or
whatnot,
and
it's
pretty
awesome
when
you
have
big
merch
requests,
because
it
has
a
file
by
file
living
system
and
so
it's
a
great
extension
to
get
better
with
every
release
and
it's
one
of
my
favorite
features
in
gitlab.
Besides
many
others,
so
I've
not
prepared
some
slides.
E
I
want
to
show
you
a
live
demo,
how
you
can
use
your
vs
code
and
digital
app
extension
to
get
to
your
projects,
so
everyone
normally
starts
with
a
bit
clone.
So
there's
a
built-in
vs
vs
code,
git
clone
feature,
and
when
you
have
the
extension
installed,
you
will
see
your
gitlab
instance,
so
it
can
handle
multiple
of
them.
So,
for
example,
you
can
in
my
case
you
can
use
gitlab.com,
but
of
course
you
can
use
your
private
instance
one
two
three.
E
E
Then
it
asks
me
where
I
want
to
put
my
repository
and
the
cool
thing
now.
Is
it
now
fetches
my
repository
into
this
code
and
sometimes
yeah
the
first
thing
which
the
extension
will
ask
me
if
I
want
to
open
this
in
the
existing
editor
or
if
I
want
to
open
a
new
window.
In
my
case,
I
just
want
to
open
it
in
the
existing
window,
and
here,
as
you
can
see,
my
repository
is
not
cloned
and
I
can
start
working.
E
E
You
can
create
snippets
where
you
can
open
the
active
file
on
gitlab.com
itself
to
open
it
up.
One
of
the
really
nice
features
I
personally
like
a
lot,
as
michael
already
mentioned,
with
people
fci
and
the
whole
editor
stuff.
When
you
have
your
yaml
file
where
it's
a
yaml
file
and
you
want
to
validate
if
you
have
correct
content
into
it
before
I
always
have
to
copy
this
text
go
to
the
later
stage
on
the
website
and
then
press
link
button
to
see
every
detail
if
it
works.
E
E
E
You
can
see
all
the
labels
always
familiar
things
from
the
gita
platform
and
the
nice
thing
is.
I
now
can
make
merch
of
this
video
inside
of
vs
code
itself.
Without
switching
anything,
I
don't
have
to
check
out
the
branch
locally
and
I
can
use
my
familiar
diffu
from
vs
code.
So
this
is
same
with
you
as
you
hitting
the
viewer
or
the
typical
vs
code
workflow,
and
it's
pretty
awesome
and
one
of
the
newest
features
in
gitlab,
14
and
extension.
E
Is
that
when
I
have
a
review,
for
example,
I
can
say
hey
which,
which
merch
request
I
should
review,
and
the
nice
thing
in
the
new
edition
is
that
I
now
can
enter
some
comments
and
say:
oh
this.
This
url
is
not
correct,
just
pressing
it
at
the
comment
and
automatically
go
to
the
website
and
with
the
api
and
add
the
comments
to
exactly
the
thing,
and
it
looks
it
feels
exactly
the
same
as
you
would
add.
E
And
I
really
like
the
speech
a
lot.
Some
things
are
left
and
you
can
explore
yourself
but,
for
example,
in
the
status
bar,
you
have
the
possibility
to
see
your
running
pipeline.
So
if
it's
running
it
will
show
that
it's
running,
if
it
fails,
it
will
show
you
that
and
you
can
click
on
it
and
switch.
So
please
show
me
the
latest
pipeline
and
of
course,
you
can
also
see
for
the
current
branch,
some
kind
of
history,
for
whatever
happened.
This
is
a
has
a
merch
request,
for
example,
or
not
and
yeah.
E
A
Yeah,
that
was
great,
michael,
I'm,
admittedly
also
a
vs
code
user,
but
haven't
used
the
gitla
get
lab
extension
that
extensively,
because
I'm,
I
guess,
I'm
context,
switching
so
often
during
the
day
that
it's
not
that
disruptive
to
my
flow,
but
that
walkter
really
wants
me
to
spend
more
time
getting
familiar
with
it,
because
it
seems
like
there's
a
lot
there.
It
looks
like
sanjay
has
a
question
I'll
verbalize.
It
can.
We
view
pipeline
progress
too,
so.
C
F
E
E
F
G
G
E
Oh
good,
good,
good
question:
I've
filed
a
lot
of
issues
on
the
repository
for
me
personally,
because
I
have
often
have
to
review
big
mess
requests
with
a
lot
of
files
involved.
I
would
love
to
have
a
three
view
options
so
in
the
normal
vs
code
div
for
for
the
git
repo,
you
can
decide
if
you
want
the
flat
list
where
you
see
the
directory
next
to
it,
but
you
can
switch
and
say.
G
Yeah,
I'm
kind
of
in
the
same
boat
as
john.
I
use
vs
code
all
the
time
I
remember
using
the
vs
code
extension
back
before
it
was
even
like
officially
adopted
by
us
and
all
basically
every
feature
you
just
showed
would
have
been
on
my
list
of
things
I
would
have
wanted,
and
so
I
haven't
used
it
since
I
need
to.
I
need
to
give
it
another
try.
So.
A
A
Alright
well,
thank
you
very
much,
michael.
That
was
an
awesome
presentation
and
I
feel
like
we,
I
may
be
coming
to
ask
you
for
like
a
full,
you
know
30
minute
presentation
on
the
vs
code
extension
someday.
I
feel
like.
That
would
be
something
that's
really
interesting
to
folks
that
are
kind
of
in
the
same
boat.
As
you
know,
myself
and
brendan
you
know,
maybe
other
people
here
where
they're
get
lab
power
users
and
use
vs
code,
a
lot
but
haven't
put
the
two
together
yet.
A
All
right
great
well,
that
brings
us
to
our
last
speaker
of
the
day
brendan
o'leary,
who's,
a
developer
of
angela
senior
developer
evangelist
at
get
lab
and
brendan
has
put
a
bit
of
a
spin
on
favorite
feature.
I
think
he's
got
more
than
one
for
us
and
lucky
for
you
we're
running
ahead
of
schedule,
so
you
can
have
a
little
bit
more
than
10
minutes
if
you
need
it,
but.
G
G
Yeah,
it's
kind
of
cherries.
Well,
I
guess
it's
not
a
vs
culture,
it
could
be
anything
but
it
happens
to
be
that's
where
I
started
using
night.
Owl
yeah
and
I've
got
a
bunch
of
features.
I
mean
I
like
kind
of
did
this
little
review
from
13
to
14.
I
went
back
and
read
every
release
post
in
between
gitlab
13.0
gitlab
and
I'm
glad
I
asked
john
if
I
could
go
last
because
I
knew
people
were
going
to
like
want
to
talk
about
features.
G
B
G
You
know
with
autodevops
and
all
that,
but
you
know
we've
since
added
the
ability
to
deploy
like
automatically
or
auto
magically
to
ecs
and
ec2
and
fargate,
and
we
added
all
this
terraform
support
right.
You
can
use
gitlab
as
your
terraform
state
store.
Now
I
love
that
because
I
hate
forgetting
to
set
up
a
state
store
early
in
a
new
terraform
terraform
project.
G
You
can
see
the
plan
in
the
mr
and
that's
all
great,
and
so
a
lot
of
those
things
I
think
make
14
our
best
release
ever
which,
for
those
of
you
that
have
been
around
gitlab
a
long
time,
know
that
our
former
vp
of
project
yob
used
to
say
that
for
every
release-
and
I
would
tell
him
when
I
believed
him
when
I
didn't
back
when
he
worked
as
our
vp
of
product.
So
I
used
to
give
him
a
hard
time.
Sometimes,
when
I,
when
I
you
know,
was.
C
G
The
feature
I
wanted,
basically,
you
know
selfishly
and
I've
got
a
new
quote
for
14,
which
is
come
for
the
ci
stay
for
the
security,
because
john
kind
of
talked
about
how
you
know
we're
trying
to
bring
modern
devops
to
everyone
right,
and
I
think
the
key
the
key
there
is.
You
know
modern
devops
is
secure
devops.
G
You
know,
I
think
you
hear
people
say
devsecops
sure
great.
We
can
say
that,
but
one
way
or
another,
I
don't
think
you
can
really
realize
the
promise
of
the
invented
word
that
is
devops
without
security,
and
so
my
kind
of
number
one
feature
I
want
to
spend
more
time
on
is
just
like
security
and
specifically,
let's
zero
in
on
static
code
analysis
right
because
it's
kind
of
the
first
step
I
would
say
on
security
and
so
gitlab
13.0
on
the
left-hand
side.
You
know
you
had
this
like
new
security
deployment.
G
Compliance
thing
actually
didn't
figure
out
exactly
when
it
came
in,
but
somewhere
around
13.00
or
before
you
know.
We
added
this
little
left-hand
thing.
It's
securing
compliance
and
there's
like
a
dashboard
and
that
list
of
dependents
is
great
fantastic.
Oh,
you
got
to
pay
for
the
dashboard.
Oh
okay,
that's
nice!
Right!
G
G
You
know
things
like
on-demand
scanning
and
threat
monitoring,
and
I
just
I
oh
I
can't
click,
I'm
not
editing.
I
I
literally
cut
off
some
of
that
slide.
I
just
realized,
but
we'll
look
at
a
live
demo
in
a
second
anyway,
and
so
my
number
one
piece
of
this
is
the
fact
that
we
move
static
code
analysis
analysis
to
core,
and
we
did
that
in
13.3
and
I
think
that's
huge
because
you
know
a
lot
of
that.
G
You
know
that
those
that
static
code
analysis
is
bringing
to
bed
together,
the
best
of
open
source,
static
code
analysis
into
git
lab,
and
so
it
like.
Because
of
that,
you
know
we
don't
need.
You
know
what
that's
not
what
we're
selling
with
gitlab
we're.
We
want
to
bring
that
modern,
secure.
Devops
to
everyone,
so
we
decided
to
move
all
of
those
static
code,
analysis
tools
that
are
open
source
themselves,
the
ability
to
use
that
into
gitlab
core
in
133
and
then
also
over
the
course
of
the
13
series.
G
We
got
lots
of
different
languages
right.
We
added
the.net
framework,
helm,
charts
and
and
moved
typescript
to
eslint.
In
you
know
the
early
13s
and
1305.
We
had
a
huge
customer
contribution
from
a
fantastic
customer
down
in
texas
in
the
us
of
you
know
a
bunch
of
frameworks
for
mobile
apps,
so
java
and
kotlin
for
android,
objective
c
and
swift
for
ios,
that's
great
in
13,
9
and
10.
We
started
to
move
the
static
code
analysis
for
a
number
of
languages
to
some
graph
and
we're
gonna.
G
We're
gonna
talk
a
little
bit
about
that
in
more
detail
in
a
second
and
then
added
general
content
support
in
1311.
So
all
these
new
languages
constantly
being
added
means
more
and
more
people
can
embrace.
You
know
the
idea
of
security
scanning
and
then
there's
lots
of
other
features
that,
like
kind
of
go
beyond
what
I
would
call
traditional,
you
know
just
scan
my
code.
G
Statically
to
see
what
problems
might
happen,
so
this
thing's,
like
secret
detection,
right
the
ability
to
find
secrets
that
are
in
your
your
repository
that
you
might
have
committed
accidentally
because
you
were
doing
a
demo
and
just
put
your
aws
credentials
in
accidentally.
The
standardizing
to
a
json
report.
G
Right
michael,
talked
a
little
bit
about
some
of
this,
like
it's
not
an
insignificant
thing,
because
all
of
these
static
code
analysis
tools
and
if
you
have
two
different
languages
in
a
project
or
in
an
application,
then
you're
going
to
have
the
output
of
different
tools.
Putting
that
into
a
standard.
G
Json
like
actually
is
a
big
deal
right,
because
now
you
can
understand
it
either
machine
or
human
readable,
and
then
we
also
built
all
this
in
the
open
right
like
gitlab
does
so
that
folks
can
bring
their
code
analysis
tools
to
it
and
they
have.
We
saw
white
duck,
bring
a
white
light
source
source.
Now,
I'm
I'm
confusing
two
companies
but
brought
that
in
as
a
scanner
to
gitlab,
and
then
you
can
also
customize
the
rules
so
again
without
having
to
learn
the
syntax
of
all
these
different
rules.
G
It
gives
you
this
very
simple
summarized:
output
or
you
can
dig
into
the
detailed
report.
You
know
get
a
nice
summary
on
a
merge
request,
we'll
see
in
a
second
and
then
also
this
concept
of
multi-project
right
gitlab
has
this
advantage
of
having
all
your
code
and
having
the
ability
to
understand
and
you
to
model
how
that
code
interacts,
and
so
it's
not
just
static.
It
can
be
somewhat
dynamic
and
security.
G
G
Is
worth
a
thousand
words?
So,
let's,
let's
talk
a
little
bit
about
that
so
yeah?
The
thing
john
pointed
out.
The
thing
that
I
I
cut
off
in
my
slide
is
the
thing
I
actually
wanted
to
demo,
because
this
project
that
we're
looking
at
here
is
the
project
that
originally
brought
me
to
git
lab
many
many
years
ago,
as
a
customer,
in
fact,
can
we
see
when
this
might?
These
commits
might
be
overloaded
a
little?
G
Oh
I'd
have
to
go
all
the
way
back
to
the
end.
I
don't
know
it
was
many.
You
just
have
to
trust
me.
It
was
like
four
or
five
years.
I
think
it
was
five
years
ago
and
I've
been
meaning
to
set
up
static
code
analysis.
You
know
at
least
since
I've
worked
at
get
lab
on
this
thing.
This
is
a
a
project.
That's
little
side,
hustle
app
for
slack,
the
spoiler
alert
being
that
nobody
pays
for
slack,
so
they
don't
really
want
to
pay
for
your
app
for
slack.
G
You
know
you
live
in
your
line
and
I've
never
set
up
like
for
all
the
you
know
the
fact
that
I'm
a
git
lab
person
now
and
get
paid
by
gitlab.
I've
never
set
up
static
code
analysis
and
why
well
because
it
was
hard.
Well,
it
wasn't
that
hard,
but
there
wasn't
a
button
to
do
it.
Well,
guess
what
now
there's
a
button
to
do
it,
so
I
can
come
in
here
I
can
go
to
configuration.
This
is
just
on
a
free
plan.
This
is
like
my
buddy
and
mine's.
You
know
free
plan
on
gitlab.com.
G
It
pre-fills
some
stuff
for
me.
I
can
exclude
certain
you
know
paths
I
can
say
what
pipeline
stage
I
want
it
in.
I
don't
know
I'm
just
going
to
leave
that
all
as
default
and
I'm
going
to
click
create
merge
request,
and
so
with
that
one
button.
It
now
brings
me
to
our
merge
request
and
when
I
click
create,
we
can
see
what
it
changed.
G
G
Could
have
done
that
you
know
before
the
button
existed,
but
somehow
the
button
existing
is
what
pushed
me
over
the
edge
to
be
able
to
go
and
do
it
and
the
nice
thing
about
this
template
is
it's
bringing
in
a
vendor
template
so
that
little
little
friend
there
is
bringing
in
actually
all
of
this
code
into
my
gitlab
ciaml
that
I
didn't
have
to
write
that
can
then
go
and
run
all
the
tests
that
that
gitlab
runs
against
any
static
code.
That's
in
my
repository.
G
Matter
what
language
it's
in
right!
If
it's
python,
it's
going
to
run
the
python.
If
it's
ruby,
it's
going
to
run,
ruby
happens
to
be
javascript,
so
it's
going
to
run
all
of
that
and
then
the
other
thing
my
mom
always
told
me
about
the
demo,
is
to
have
a
cooked
turkey
already
when
you
put
the
turkey
in
the
oven.
So
here
it
is
at
the
end,
and
you
can
see
it
added
this
test
stage
with
eslint
and
node.js
scan
and
some
grab
scans
and
oh
look
at
this.
G
G
G
I
can
create
an
issue
right
from
here
to
to
address
it.
You
know
this
is
a
lib
admin.
That's
probably
bad,
probably
gonna,
look
at
that
after
the
call,
but
yeah
the
other
huge
thing.
That
brings,
though,
is
this
other
thing
I'm
really
excited
about,
which
is
you
know
we
talked
about
in
the
slides,
but
we're
bringing
this
new
static
code,
analyzer
called
semgrapin
and
semgrip.
Is
this?
Like
really?
G
You
know
it
comes
from
the
word
semantic
and
grep
together
right,
two
words
that
we
understand
as
developers,
and
it
has
this
whole
set
of
rules
for
lots
and
lots
of
different
languages,
and
it
can
then
also
integrate
directly
in
to
your
git
lab
instance,
and
put
comments
on
your
merge
request.
So
when
you
make
an
error
in
a
merge
request,
it'll
actually
comment.
G
You
know
what
the
issue
is
on
that
merge
request
and
that's
really
exciting.
Now
it's
also
really
smart
about
running
that
murder
running
itself.
Only
against
your
merge
request,
diff
and
so
again.
This
is
some
of
the
stuff
that
I'm
being
given
in
the
background
by
bringing
in
gitlab,
but
I
can
actually
then
go
customize
it
right.
So
in
reality,
I'm
probably
going
to
want
to
customize
how
it's
running
and
so
to
do
that.
G
That
brings
that
in-
and
you
know
it's
relatively
simple
too,
but
here
I
get
to
specify
all
the
rules
that
I
want.
So
what
are
the
specific
rules?
These
are
ones
given
to
me
by
some
graph,
but
I
can
also
write
my
own.
For
instance,
I
don't
think
I
don't
think
that
this
scanned
for
something
that
I
also
I
know
I
do,
which
is
do
console.log
a
lot
which
I'd
love
to
not
do
and
put
everything
through
my
actual
logger.
G
That
goes
out
to
my
goes
out
to
my
logging
service,
so
I
can
actually
see
it.
So
I
I'm
didn't
get
it
done
before
the
call,
but
I'm
going
to
go
figure
out
how
to
write
now
an
extra
sungrip
role
to
do
that
and
then,
when
I
do
it.
All
I
have
to
do
is
add
one
line
of
code
here
to
my
gitlab
script
and
I
get
it
automatically.
G
I
don't
think
it
creates
issues
automatically
for
all
of
them
today,
because
the
idea
of
that
security
kind
of
dashboard
we
saw
so
let
me
show
this
again
as
I
just
stopped-
sharing
the
idea
of
this
kind
of
security
dashboard.
Some
of
these
things,
like
I
don't
know-
let's
say
this
middleware
thing
I
know
is
you
know
not
called.
G
I
can
actually
dismiss
that
as
a
false,
positive
or
won't
fix,
accept
risk
or
no
reason
right
and
then
I'm
able
to
dismiss.
So
I
think
the
idea
is
now
again.
The
idea
is
you
wouldn't
wait
five
years
to
run
this,
the
first
time
and
you'd
only
be
dealing
with
the
changes
that
you
made
and
in
fact
we
can
see
on
this
merge
request.
G
Where
I
added
some
grip
manually,
I
had
it
only
look
at
the
merge
request
and
not
against
all
the
code
versus
the
one
that
was
looking
all
they
could
didn't
find
anything
because
all
I
changed
was
the
gitlab
ci.
So
if
I
wanted
to
just
kind
of
start
from
a
baseline
of
like
okay,
whatever
security
is
today
is
what
it
is.
G
G
G
Scanning
is
a
thing
that
we
do
in
addition
to
sas,
so
the
sas
is
really
static.
Code
analysis
against
the
code
that
you
wrote
right.
So
it's
looking
at
the
code,
that's
in
the
repository
and
analyzing
that
dynamic
or
not
sorry,
dependencies.
We
call
the
looking
for
like
active
cvs
or
known
cvs,
dependency
scanning
and
that's
where
it
goes
and
looks
at
you
know
what
open
source
dependencies
you
have
so
in
ruby
it
looks
at
your
gem
file
or
in
the
case
of
this
node
project.
G
B
G
And
yeah,
let
me
just
show
this
page.
I
can
show
this
page
again.
So
we
we
talk.
When
we
talk
about
security,
we
mean
lots
of
different
things
right,
so
we
what
I
demoed
today
is
static
code
analysis
right
this
top
thing,
but
we
also
have
a
number
of
other
kinds
of
security
that
we
talk
about,
so
that
includes
dependency
scanning.
G
You
know
the
container
scanning
also
some
fuzzing
that
we
can
do
fuzzing
against
your
apis
license
compliance.
Do
you
have
open
source
licenses
that
are,
you
know,
out
of
compliance
for
what
you're,
building
dynamic
application
security
testing?
How
you
like
run
the
old
last,
like
top
10
things
against
an
active
version
of
your
application,
so
there's
lots
of
different
aspects
of
security.
I
focused
mostly
on
sas
because
a
they
got
huge
upgrades
throughout
the
13
life
cycle
and
b,
moved
to
core
in
that
same
cycle.
A
Thanks,
I
wanted
to
just
quickly
go
back.
There
was
two
questions
that
came
in
kind
of
early
that
we
tabled
for
later
and
since
we
do
have
a
little
bit
of
time
here,
I
think
we
can.
We
can
quickly
answer
those,
so
one
of
them
was
hold
on.
I
got
to
pull
up
the
document
where
I
was
keeping
those,
and
I
have
way
too
many
tabs
open.
A
A
A
G
So
like
gitlab,
auto,
build
and
waypoints
build
process
are
both
based
off
of
the
cloud
native,
build
packs,
so
they're
kind
of
basically
the
same
thing,
and
then
you
know
when
it
comes
to
deploying,
though
I
think
is
where
the
big
differences
come
in,
so
git
lab
has
a
concept
of
auto
deploy.
That's
part
of
auto
devops,
I
kind
of
briefly
mentioned
it.
It
was
originally
focused,
you
know
heavily
on
kubernetes
and
deploying
to
kubernetes
and
still
has
a
great
integration.
G
There
we've
since
added
integration
to
to
like
different
aws
services
like
ec2
and
ecs,
and
then
I
think
waypoint
has
a
different
set
of
services,
so
I
think,
depending
on
what
your
services
in
the
end,
you
may
find
a
smoother
path,
either
with
waypoint
or
with
gitlab.
The
other
thing
in
michael
is
maybe
googling,
oh
no,
he
had
already
did.
I
was
gonna
say
the
other
thing
is:
we've
done
a
lot
of
work
and
discussion
about
how
to
integrate
the
two.
G
So
I
I
think,
there's
a
argument
to
be
made
that
the
two
could
work
together
really
well
with
gitlab
ci
cd
as
kind
of
the
orchestration
engine,
and
then
you
know,
waypoint
is
really
good
at
being
declarative
and
having
a
declarative
definition
of
what
you
know,
deploy
and
release
looks
like
now.
That's
the
thing
that
hashicorps
made
their
their
their
living
on
right,
declarative
things
like
terraform,
and
so
I
think
it's
really
good
at
that
and
so
yeah.
I
think
I
think,
there's
an
argument
to
me.
G
It
looks
like
michael
you
shared
a
workshop.
I
know
we
wrote
a
blog
about
it.
Oh,
it's
me
showing
it
in
the
workshop,
so
yeah
that's
great.
So
I
highly
recommend
if
you
have
questions
about
waypoint
watching
that
or
I
talk
about
in
more
detail
the
differences
and
how
I
think
they
kind
of
complement
each
other.
A
Thanks
brendan
yeah,
I've
lost
track
of
who
asked
that
comment,
but
I
would
encourage
them
to
go
back
and
check
out
the
workshop
that
michael
sharon
thanks
michael
you've,
been
all
over
the
sharing
the
resources
in
chat
said.
I
appreciate
that
and
it
looks
like
sanjay
added
some
color
to
their
question.
I
was
searching
for
integrating
one
password
secret
automations
with
get
lab
auto
devops
found
there
is
a
solution
provided
by
get
lab
for
vaults.
Can
you
give
me
some
context
where
to
override
gitlab
autodevops
with
secret
management?
Like
one
password?
A
G
G
C
C
But
I
don't
know
if
there
is
a
feature
request
yet,
but
potentially
it
sounds
like
a
reasonable
idea.
I
think
there
was
something
around
one
password
for
automation
recently.
I
remember
seeing
something
around
that,
but
I
think
we
need
to
like
circle
back,
and
I
also
would
invite
sanjay
to
again
open
a
feature
request.
If
not
existing
already.
A
Please,
okay
thanks
so
yeah
sanjay!
I
just
put
my
email
address
in
the
chat
and
if
you
would
like
to
continue
the
conversation
via
email,
just
send
me
an
email
and
we'll
make
sure
to
get
back
to
you
with
an
answer,
even
if
it's
just
that
you
know
this
isn't
something
that's
offered
and
we
need
to
create
an
issue.
But
we
can
continue
that
offline
with
that.
A
I'd
love
to
you
know
just
give
a
big
thank
you
to
all
of
our
presenters
today,
especially
alejandro
and
michael,
who
are
taking
time
out
of
their
busy
schedules
to
contribute
to
the
community.
We
are
so
grateful
to
have
folks,
like
you
in
our
community
that
could
share
their
stories
and
help
us
learn
about
cool
new
things
and
cool
new
features
and
how
to
use
them
so
appreciate
that
immensely
brendan
and
michael
from
my
team.
A
A
So
much
and
hopefully
we'll
see
you
at
a
meet
up
again
soon
and
keep
an
eye
on
your
meetup
messages,
I'll
share
a
link
to
the
recording
and
any
of
the
slides
that
I
can
in
the
meetup
group,
so
that
information
will
be
available
there.
If
you
want
to
follow
up
on
anything
that
you
learned
today
and
with
that,
hopefully,
everybody
goes
and
tries
out
kit,
lab
14,
learn
something
new
and
can
report
back,
maybe
at
the
gitlab
15
meet
up
on
their
favorite
feature
next
year.