Enabling "Allow pre-receive secret detection" on Staging

Production Change

Change Summary

Provide a high-level summary of the change and its purpose.

In order to support dogfooding of pre-receive secret detection on gitlab.com, we want to first test it on staging.gitlab.com. This request is to have someone with admin access on staging.gitlab.com enable Allow pre-receive secret detection through the admin panel.

The pre_receive_secret_detection_beta_release feature flag (Issue) has been enabled on Staging: https://gitlab.slack.com/archives/CLM200USV/p1713200167943879

Once this setting is enabled (through the UI), I will do further testing, including writing up more detailed instructions to be used in Production, as well as recording a video.

This change can be made any time.

Change Details

1. Services Impacted - Gitaly pre-receive hook, staging.gitlab.com, pre-receive secret detection (it's not technically a service)
2. Change Technician - @ahanselka
3. Change Reviewer - @ahanselka
4. Time tracking - 5 minutes to login and enable it, 5 minutes to login and disable it (if necessary)

Detailed steps for the change

Change Steps - steps to take to execute the change

Estimated Time to Complete (mins) - 5 minutes

• Set label changein-progress /label ~change::in-progress
• Visit the Secret Detection section in the Security and Compliance Admin section (https://staging.gitlab.com/admin -> Settings -> Security and Compliance)
• Check the Allow pre-receive secret detection checkbox to enable the feature
• Click Save Changes
• Set label changecomplete /label ~change::complete

Rollback

Rollback steps - steps to be taken in the event of a need to rollback this change

Estimated Time to Complete (mins) - Estimated Time to Complete in Minutes

• Visit the Secret Detection section in the Security and Compliance Admin section (https://staging.gitlab.com/admin -> Settings -> Security and Compliance)
• Un-check the Allow pre-receive secret detection checkbox to enable the feature
• Click Save Changes
• Set label changeaborted /label ~change::aborted

Monitoring

Key metrics to observe

• Metric: Gitaly latency for PreReceiveHook
  • Location: Gitaly Latency dashboard for PreReceiveHook (Production)
  • What changes to this metric should prompt a rollback: Significant increases in latency. We have Alerting established for key components as a goal post for the Beta epic to further refine what "Significant increases" looks like.

Change Reviewer checklist

C4 C3 C2 C1:

• Check if the following applies:
  • The scheduled day and time of execution of the change is appropriate.
  • The change plan is technically accurate.
  • The change plan includes estimated timing values based on previous testing.
  • The change plan includes a viable rollback plan.
  • The specified metrics/monitoring dashboards provide sufficient visibility for the change.

Change Technician checklist

• Check if all items below are complete:
  • The change plan is technically accurate.
  • This Change Issue is linked to the appropriate Issue and/or Epic
  • Change has been tested in staging and results noted in a comment on this issue.
  • A dry-run has been conducted and results noted in a comment on this issue.
  • The change execution window respects the Production Change Lock periods.
  • For C1 and C2 change issues, the change event is added to the GitLab Production calendar.
  • For C1 and C2 change issues, the SRE on-call has been informed prior to change being rolled out. (In #production channel, mention @sre-oncall and this issue and await their acknowledgement.)
  • For C1 and C2 change issues, the SRE on-call provided approval with the eoc_approved label on the issue.
  • For C1 and C2 change issues, the Infrastructure Manager provided approval with the manager_approved label on the issue.
  • Release managers have been informed prior to any C1, C2, or blocks deployments change being rolled out. (In #production channel, mention @release-managers and this issue and await their acknowledgment.)
  • There are currently no active incidents that are severity1 or severity2
  • If the change involves doing maintenance on a database host, an appropriate silence targeting the host(s) should be added for the duration of the change.