## Summary Roll out [the v3 license expression sync](https://gitlab.com/gitlab-org/gitlab/-/issues/606527) — flipping `license_configs` from v2 to `VERSION_FORMAT_V3` in `sync_configuration.rb` — currently behind the `sync_v3_license_expressions` feature flag. Part of https://gitlab.com/groups/gitlab-org/-/work_items/22880+s. - DRI: @onaaman - Team Slack channel: `#g_secure-composition-analysis` > [!note] > > **Instance-wide flag (no actor).** The license sync is a single background cron, so this is checked with `Feature.enabled?(:sync_v3_license_expressions)` (no actor argument) and rolled out with **boolean** enablement per environment — not an `--actors` percentage rollout. > [!important] > > **One flag for the whole path.** The flag gates only the producer switch (the v2 → v3 version pin). Ingestion, storage, and the read path follow from whichever format was synced, so there is deliberately **no separate ingestion flag** (unlike the malware advisory rollout, [#604583 (closed)](https://gitlab.com/gitlab-org/gitlab/-/work_items/604583) / [#604584 (closed)](https://gitlab.com/gitlab-org/gitlab/-/work_items/604584)). Mirrors `cyclonedx_license_expression_ingestion` ([#604791 (closed)](https://gitlab.com/gitlab-org/gitlab/-/issues/604791)). > [!note] > > Process and guidance live in the docs — this issue is just the commands and a place to track the rollout. "Rolling out" means incrementally enabling the flag on GitLab.com to validate stability — it is not the same as releasing the feature, which happens when the flag is removed. [Feature flag controls](https://docs.gitlab.com/development/feature_flags/controls/) · [Feature flag lifecycle](https://handbook.gitlab.com/handbook/product-development/how-we-work/product-development-flow/feature-flag-lifecycle/#feature-flag-lifecycle) > > Notice that in this case we cannot incrementally enable this feature. Is a boolean action. Syncs or doesn't sync. ## What could go wrong? - **Blast radius:** the license sync cron only — no request-path or customer-facing surface. Enabling switches the sync to the v3 expression format via PDS. - **Rollback caveat:** disabling the flag stops future v3 syncs and reverts the producer to v2, but it **does not revert v3 data already ingested**. - **Data risk:** malformed or unexpected v3 blocks (`{expression}` / `{licenses:[{id}]}`, `LicenseRef-*`) could produce bad license rows; verify parse/store on staging before production. - **Dependencies:** the flag is a no-op until the exporter publishes v3 (https://gitlab.com/groups/gitlab-org/-/work_items/22925+s) and PDS serves the licenses bucket (https://gitlab.com/groups/gitlab-org/-/work_items/23152+s). ## Rollout Run all production `/chatops` in [`#production`](https://gitlab.slack.com/archives/C101F3796) and cross-post the results to `#g_secure-composition-analysis`. Instance-wide (no actors) → boolean enablement. **Non-production** ``` /chatops gitlab run feature set sync_v3_license_expressions true --dev --pre --staging --staging-ref ``` Verify on staging against the staging PDS endpoint: sync ingests expressions, packages reference them, the read path returns them, and dependency list + license scanning render them — before production. **Production** ``` /chatops gitlab run feature set sync_v3_license_expressions true ``` Watch the dashboards through the first full sync cycle. ## Before global rollout Confirm the relevant gotchas before going to 100% — see [enabling a feature for GitLab.com](https://docs.gitlab.com/development/feature_flags/controls/#enabling-a-feature-for-gitlabcom): - [Docs + version history](https://docs.gitlab.com/development/documentation/feature_flags/) updated - [Breaking changes](https://docs.gitlab.com/development/documentation/release_notes/#deprecations-removals-and-breaking-changes) announced, if any - [Change management issue](https://handbook.gitlab.com/handbook/engineering/infrastructure-platforms/change-management/#feature-flags-and-the-change-management-process) opened, if required - Re-sync note for upgraded self-managed instances written (see https://gitlab.com/gitlab-org/gitlab/-/issues/606527+s) ## Cleanup Remove the flag once [deemed stable](https://handbook.gitlab.com/handbook/product-development/how-we-work/product-development-flow/feature-flag-lifecycle/#feature-flag-lifecycle) — see [cleaning up](https://docs.gitlab.com/development/feature_flags/controls/#cleaning-up). Track it here, or open a follow-up [Feature Flag Cleanup issue](https://gitlab.com/gitlab-org/gitlab/-/work_items/new?description_template=Feature%20Flag%20Cleanup). Remove the flag and its YAML definition from the codebase, then: ``` /chatops gitlab run release check <merge-request-url> <milestone> /chatops gitlab run feature delete sync_v3_license_expressions --dev --pre --staging --staging-ref --production ``` ## Rollback ``` /chatops gitlab run feature set sync_v3_license_expressions false # production — reverts the producer to v2; does NOT revert already-ingested v3 data /chatops gitlab run feature set sync_v3_license_expressions false --dev --pre --staging --staging-ref # non-production /chatops gitlab run feature delete sync_v3_license_expressions --dev --pre --staging --staging-ref --production # remove entirely ```