15.0 Planning - Static Analysis

🔒 Secure, Static Analysis - Milestone Planning

devopssecure groupstatic analysis

⚠ This is the first time we're trying a new iteration of the planning issue process. This issue will become more refined as we all engage with it. See gitlab-com/www-gitlab-com!102042 (merged) for new process details and intentions.

Category Direction Maturity Priority
Category:SAST Epic / Strategy maturitycomplete ~P1
Category:Secret Detection Epic / Strategy maturityviable ~P2
Category:Code Quality Epic TBD / Strategy maturityminimal ~P3

On this page:

Themes

♻ Complete analyzer consolidation

Engineering team: @zrice, @rossfuhrman, @vbhat161

It's time! Let's complete our %15.0 deprecations/removals/breaking changes. See 15.0 Deprecations and Removals Work - Static An... (&7201 - closed) for details.

To see what has been announced publicly about analyzer changes, see the deprecation announcement SAST analyzer consolidation and CI/CD template changes and our deprecation announcement issues.

Specific issues:

💻 Pick up Code Quality

Engineering team: @rossfuhrman, @jannik_lehmann

  1. Continue/complete [MR Widget Eng] Code quality (&7701 - closed)
  2. Diagnose performance issues that blocked rollout of support for multiple reports in inline diffs: #358759 (closed)
  3. Begin adapting inline diff feature toward new design (#359847 (closed))

🆕 Revive VET transition

Engineering team: @zrice, @vbhat161

  1. Work on Go language frontend (https://gitlab.com/gitlab-org/gitlab/-/issues/356378)
  2. Familiarize ourselves with latest updates

🔎 Customer issues

Let's try to get a handle on issues, whether or not we can resolve all of them. It's important to demonstrate that we hear our users and internal stakeholders!

Bugs over SLO and need resolution (either "already fixed", "we'll work on it in 15.0", "we will file a docs issue/MR to say how to fix this", or something else):

See all of our over-SLO bugs.

🆕 Monthly Analyzer Updates

We have over a dozen analyzers that need to be maintained, these analyzers are checked and updated every month.

Issue: https://gitlab.com/gitlab-org/security-products/release/-/issues/121

📖 Odds and ends

🚒 Engineering Allocation 10% floor - empower every SWEs from raising reliability and security issues

#352050 (comment 832630296)

🔮 What's next, if you have time

We'll be investing in:

  • taking ownership of Code Quality
    • possibly coming up with a solution to "bridge" scanning to a new design by resolving short-term issues faster. do we fork?
  • investing in VET
  • improving the IaC experience

Any work getting ready for those will be useful!

📚 Documentation priorities

Technical Writing stable counterpart: @rdickenson

New content

Pending

Maintenance

Anticipated release posts

  • Removal announcements will need to be updated
  • We can highlight the improvements as a release post as well (faster scanning, no Java builds, etc.)

🔬 Quality priorities

Quality stable counterpart: @cahamed

TODO

⏩ Planning priorities

Product Manager: @connorgilbert

  • Complete updates to direction pages
  • Begin UX research/design and feature scoping for next iteration of Code Quality
  • Create a plan for delivering VET in detection mode (including tiering, rollout customer experience, etc.)

UX Designer: @mfangman

Outcomes

Release Post Candidates

Release post MRs for this milestone

Feedback

Helpful Links 🔗

Edited by Connor Gilbert