Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

the -

  • All in one
  • no SLA on performance/availability (but we did not pay for an Ultimate or Gold version and on gitlab.com, the aaS is very good -  we experienced some rarely problem time to time (e.g. after Microsoft announced they bought github, it was very slow, as lots of communities were moving to gitlab..))
  • CI runners are available to launch CI jobs but you still needs need cloud resources ressources to do the job (we are using our own server), no idea how much it woudl cost if it was fully externalized
  • no native integration so far with docker hub found (as github) BUT built-in docker registry

Focus on security aspects:

gitlab includes a docker registry and native integration with lots of open source tools
https://docs.gitlab.com/ee/user/project/merge_requests/

  • Analyze the impact of your changes with Code Quality reports 
  • Manage the licenses of your dependencies with License Management
  • Analyze your source code for vulnerabilities with Static Application Security Testing
  • Analyze your running web applications for vulnerabilities with Dynamic Application Security Testing
  • Analyze your dependencies for vulnerabilities with Dependency Scanning
  • Analyze your Docker images for vulnerabilities with Container Scanning
  • Determine the performance impact of changes with Browser Performance Testing

Image Added

Static Application Security Testing

this testing focuses on code vulnerability

it also evaluate potential XXS attacks

Dynamic Application Security Testing

https://docs.gitlab.com/ee/user/project/merge_requests/dast.html
=> OWASP ZAProxy


Addon to chain CI pipelines shared at ONS Europe:  https://events.linuxfoundation.org/wp-content/uploads/2017/12/Orange-Openlab-A-Full-Automated-Telco-Stack-for-the-Community-David-Blaisonneau-Nicolas-Edel-Orange.pdf

...