[Experiment Rollout] new_project_sast_enabled - Add option to enable SAST at project creation to the new project flow

Summary

This issue tracks the rollout and status of an experiment through to removal.

  1. Experiment key / feature flag name: new_project_sast_enabled
  2. Epic or issue link: https://gitlab.com/gitlab-org/gitlab/-/issues/333196

This is an experiment rollout issue using the scoped experiment label. As well as defining the experiment rollout and cleanup, this issue incorporates the relevant Feature Flag Roll Out steps.

Owners

  • Team: group::adoption
  • Most appropriate slack channel to reach out to: #g_adoption
  • Best individual to reach out to: @mkarampalas @jejacks0n
  • Product manager (PM): @mkarampalas

Stakeholders

Are there any other stages or teams involved that need to be kept in the loop?

  • PM: @connorgilbert
  • Group: group::static analysis
  • The Support Team
  • The Delivery Team

Expectations

What are we expecting to happen?

We expect that by providing the option to enable SAST when a project is created that we'll increase SAST adoption, as well as improve 2 and 3+ SpO.

What might happen if this goes wrong?

What can we monitor to detect problems with this?

https://app.periscopedata.com/app/gitlab:safe-dashboard/945033/Growth:-Adoption-Experiment-enable-SAST

Tracked data

To be created - tracking details from issue: https://gitlab.com/gitlab-org/gitlab/-/issues/333196#tracking-details

Rollout plan

  • Runtime in days, or until we expect to reach statistical significance: 30
  • We will roll this out behind a feature flag and expose this to <rollout-percentage>% of actors to start then ramp it up from there.

/chatops run feature set new_project_sast_enabled <rollout-percentage> --actors

Status

Preferred workflow

The issue should be assigned to the Product manager (PM) or Engineer (Eng) as follows:

  1. PM determines and manages the status of the experiment (assign this issue to the PM)
  2. PM asks for initial rollout on production, or changes to the status (assign to an Eng)
  3. Eng changes the status using chatops (reassign to the PM)
  4. When concluded, PM updates the 'Roll Out Steps' and adds a milestone (assigns to an Eng)

The current status and history can be viewed using the:

In this rollout issue, ensure the scoped experiment:: label is kept accurate.

Experiment Results

Results are available at https://gitlab.com/gitlab-org/gitlab/-/issues/333196#results-lessons-learned-next-steps

Next steps

Resolve the experiment:

  1. Remove experiment code
  2. Make the unchecked_candidate the default behavior for 100% of new projects created in-app
  3. Remove the cache (if necessary)

Roll Out Steps

  • Confirm that QA tests pass with the feature flag enabled (if you're unsure how, contact the relevant stable counterpart in the Quality department)
  • Enable on staging (/chatops run feature set <experiment-key> true --staging)
  • Test on staging
  • Ensure that documentation has been updated
  • Enable on GitLab.com for individual groups/projects listed above and verify behaviour (/chatops run feature set --project=gitlab-org/gitlab feature_name true)
  • Coordinate a time to enable the flag with the SRE oncall and release managers
    • In #production mention @sre-oncall and @release-managers. Once an SRE on call and Release Manager on call confirm, you can proceed with the rollout
  • Announce on the issue an estimated time this will be enabled on GitLab.com
  • Enable on GitLab.com by running chatops command in #production (/chatops run feature set feature_name true)
  • Cross post chatops Slack command to #support_gitlab-com (more guidance when this is necessary in the dev docs) and in your team channel
  • Announce on the issue that the flag has been enabled
  • Remove experiment code and feature flag and add changelog entry - a separate cleanup issue might be required
  • After the flag removal is deployed, clean up the feature flag by running chatops command in #production channel
  • Assign to the product manager to update the knowledge base (if applicable)

Rollback Steps

  • This feature can be disabled by running the following Chatops command:
/chatops run feature set new_project_sast_enabled false
Edited by Connor Gilbert