## Summary Roll out [the feature](https://gitlab.com/gitlab-org/gitlab/-/work_items/631890) currently behind the `dependency_firewall_group_prevented_stats` feature flag: group-level prevented-package stat cards on the dependency firewall dashboard. The flag is `beta`, default off, and defined in https://gitlab.com/gitlab-org/gitlab/-/merge_requests/261477 (merged). It is checked for the root namespace (top-level group), so top-level groups are the rollout unit. It gates, as the parts land: 1. Running `Security::DependencyFirewall::RefreshGroupPreventedStatsWorker`, which recomputes a group's 7 and 30 day summary rows from the prevented-packages ledger in batches of 500 projects (https://gitlab.com/gitlab-org/gitlab/-/merge_requests/261478). The worker re-checks the flag. 1. Scheduling refreshes for the groups affected by each ledger flush (https://gitlab.com/gitlab-org/gitlab/-/merge_requests/261479). 1. A daily refresh of all flagged groups at 00:05 UTC (https://gitlab.com/gitlab-org/gitlab/-/merge_requests/261485). 1. Serving group prevented-package stats from the summary table (https://gitlab.com/gitlab-org/gitlab/-/merge_requests/261481), and from ClickHouse where available, which is also behind `dependency_firewall_clickhouse_reads` (https://gitlab.com/gitlab-org/gitlab/-/merge_requests/261486). 1. The new dashboard on group pages, which needs both this flag and `dependency_firewall_dashboard_v2` (https://gitlab.com/gitlab-org/gitlab/-/merge_requests/261483). The ledger already has data wherever `dependency_firewall_dashboard_v2` is on, so a group's cards are filled by its first refresh. - DRI: @arpitgogia - Team Slack channel: `#g_sscs-dependency-firewall` > [!note] > Process and guidance live in the docs — this issue is just the commands and a place to track the rollout. > "Rolling out" means incrementally enabling the flag on GitLab.com to validate stability — it is not the same as releasing the feature, which happens when the flag is removed. > [Feature flag controls](https://docs.gitlab.com/development/feature_flags/controls/) · [Feature flag lifecycle](https://handbook.gitlab.com/handbook/product-development/how-we-work/product-development-flow/feature-flag-lifecycle/#feature-flag-lifecycle) ## Prerequisites 1. The MRs above merged and deployed to GitLab.com production; the group page MR (https://gitlab.com/gitlab-org/gitlab/-/merge_requests/261483) last. 2. `dependency_firewall_dashboard_v2` enabled for the target group (rollout issue https://gitlab.com/gitlab-org/gitlab/-/work_items/631486). 3. Retention enforced: before enabling for large groups (more than 1,000 projects), the ledger's declared 90 day retention must be enforced (https://gitlab.com/gitlab-org/gitlab/-/work_items/629117), so each refresh batch keeps reading mostly rows inside the 30 day window. Requested in the database review of https://gitlab.com/gitlab-org/gitlab/-/merge_requests/261478. ## What could go wrong? - Refresh cost: one `window_flags` query per 500-project batch. For a group the size of gitlab-org (9,140 projects) a refresh measured about 3.3 s of warm query time plus about 0.4 s for listing projects, each statement well under the 15 s statement timeout. - The worker has `concurrency_limit` 5, retries 3 times, runs one refresh per group at a time (`until_executed` with `reschedule_once`), and is deferred on database health signals; the daily run enqueues every flagged group, so it drains over time. - Blast radius: top-level groups with this flag on; project dashboards and package enforcement are not affected. - Watch: errors, duration and deferrals for `Security::DependencyFirewall::RefreshGroupPreventedStatsWorker` and `Security::DependencyFirewall::ScheduleDailyGroupPreventedStatsRefreshCronWorker`, database load, and the Events links below. ## Events - [Exceptions with dependency_firewall_group_prevented_stats:1](https://log.gprd.gitlab.net/app/discover#/?_g=(time:(from:now-1d,to:now))&_a=(index:'7092c4e2-4eb5-46f2-8305-a7da2edad090',query:(language:kuery,query:'json.exception.feature_flag_states.keyword:%22dependency_firewall_group_prevented_stats:1%22'),columns:!(json.exception.class,json.exception.message,json.extra.workflow_id,json.meta.caller_id),sort:!(!(json.time,desc)))) - [Events with dependency_firewall_group_prevented_stats:1](https://log.gprd.gitlab.net/app/discover#/?_g=(time:(from:now-1d,to:now))&_a=(index:'7092c4e2-4eb5-46f2-8305-a7da2edad090',query:(language:kuery,query:'json.feature_flag_states:%22dependency_firewall_group_prevented_stats:1%22'),columns:!(json.meta.caller_id,json.feature_flag_states),sort:!(!(json.time,desc)))) - [Error rate and other graphs by modifying the examples in the Visualization Library](https://log.gprd.gitlab.net/app/visualize#/?_g=h@358d019&s=FF%20Observability) Feature Flag events are only logged by default for feature flags marked for the current or future milestones. To enable while the feature flag is active, see https://docs.gitlab.com/development/feature_flags/#logging ## Rollout Run all production `/chatops` in [`#production`](https://gitlab.slack.com/archives/C101F3796) and cross-post the results to `#g_sscs-dependency-firewall`. Background: [incremental rollout process](https://docs.gitlab.com/development/feature_flags/controls/#process), [feature actors](https://docs.gitlab.com/development/feature_flags/#feature-actors). **Non-production** ``` /chatops gitlab run feature set dependency_firewall_group_prevented_stats 50 --actors --dev --pre --staging --staging-ref /chatops gitlab run feature set dependency_firewall_group_prevented_stats true --dev --pre --staging --staging-ref ``` **Production** (wait at least 15 minutes between steps, watch dashboards): Enable for a few small top-level groups first. Enable for large groups (more than 1,000 projects), including `gitlab-org`, only after retention is enforced (see Prerequisites). Then roll out by percentage of actors, since the flag is checked against the root group: ``` /chatops gitlab run feature set --group=<top-level group path> dependency_firewall_group_prevented_stats true /chatops gitlab run feature set --group=gitlab-org dependency_firewall_group_prevented_stats true /chatops gitlab run feature set dependency_firewall_group_prevented_stats <percentage> --actors ``` ## Before global rollout Confirm the relevant gotchas before going to 100%. See [enabling a feature for GitLab.com](https://docs.gitlab.com/development/feature_flags/controls/#enabling-a-feature-for-gitlabcom): - [Docs + version history](https://docs.gitlab.com/development/documentation/feature_flags/) updated - [Breaking changes](https://docs.gitlab.com/development/documentation/release_notes/#deprecations-removals-and-breaking-changes) announced, if any - [Change management issue](https://handbook.gitlab.com/handbook/engineering/infrastructure-platforms/change-management/#feature-flags-and-the-change-management-process) opened, if required - [External API consumers](https://docs.gitlab.com/development/feature_flags/#do-not-use-feature-flags-in-external-api-consumers) handled with a fail-open mechanism, if applicable ## Cleanup Remove the flag once [deemed stable](https://handbook.gitlab.com/handbook/product-development/how-we-work/product-development-flow/feature-flag-lifecycle/#feature-flag-lifecycle). See [cleaning up](https://docs.gitlab.com/development/feature_flags/controls/#cleaning-up). Track it here, or open a follow-up [Feature Flag Cleanup issue](https://gitlab.com/gitlab-org/gitlab/-/work_items/new?description_template=Feature%20Flag%20Cleanup). Remove the flag and its YAML definition from the codebase, then: ``` /chatops gitlab run release check <merge-request-url> <milestone> /chatops gitlab run feature delete dependency_firewall_group_prevented_stats --dev --pre --staging --staging-ref --production ``` `beta` flags can be set to `default_enabled: true` before removal, which releases the feature to self-managed while keeping an off switch. ## Rollback ``` /chatops gitlab run feature set dependency_firewall_group_prevented_stats false # production /chatops gitlab run feature set dependency_firewall_group_prevented_stats false --dev --pre --staging --staging-ref # non-production /chatops gitlab run feature delete dependency_firewall_group_prevented_stats --dev --pre --staging --staging-ref --production # remove entirely ``` Disabling stops refreshes and hides the group stats; existing summary rows are kept but go stale, and the ledger is unaffected.