GitLab: The All-in-One DevOps Platform

Editor’s Note: This article is part of our definitive guide to GitHub Alternatives. Click here to read the main overview.

Pro Tip: Use ctrl+F to find text through the article

Table of Contents

• Introduction
• Key Features at a Glance
• The GitLab Philosophy: Who Is It For?
• GitHub vs. GitLab: A Detailed Comparison
• Pros and Cons
• GitLab Installation Guide
• Getting Started: Your First Project
• Mastering GitLab CI/CD
• Advanced DevSecOps Integration
• Project Management & Collaboration
• GitLab Performance & Scaling
• Migration Strategies
• Best Practices & Real-World Examples
• Troubleshooting Common Issues
• Frequently Asked Questions
• Conclusion

Introduction

When discussing alternatives to GitHub, it’s impossible not to start with GitLab. Originally created as an open-source project to provide a self-hosted Git solution, GitLab has evolved into a comprehensive, single-application platform for the entire DevOps lifecycle. Its core mission is to streamline the software development process by eliminating the need for a complex toolchain of disparate applications.

Instead of stitching together tools for planning, source code management, CI/CD, and security, GitLab offers a cohesive, integrated experience from idea to production.

Why This Guide Matters:

• Over 30 million registered users trust GitLab for their DevOps needs
• Companies report 200%+ efficiency gains when consolidating to GitLab
• GitLab handles over 1 billion CI/CD jobs annually
• 50% of Fortune 100 companies use GitLab in some capacity

Key Features at a Glance

GitLab’s power lies in its breadth of features. While it excels at source code management, its true value is in the integrated components that support every stage of development.

Feature Comparison Matrix

Core Feature Deep Dive

The GitLab Philosophy: Who Is It For?

GitLab is built for teams and enterprises that want to adopt a true DevOps culture by consolidating their toolchain. Its philosophy is centered on a “single application” approach.

Target Audience Analysis

Enterprises (1000+ employees)

• Primary Need: Standardization and governance at scale
• Key Benefits: Compliance frameworks, advanced analytics, enterprise support
• ROI Timeline: 6-12 months
• Typical Use Case: Large-scale software delivery with multiple teams and complex compliance requirements

Mid-size Companies (100-1000 employees)

• Primary Need: Efficient toolchain consolidation without enterprise complexity
• Key Benefits: Integrated CI/CD, simplified workflows, cost reduction
• ROI Timeline: 3-6 months
• Typical Use Case: Growing engineering teams looking to scale development practices

Startups & Small Teams (10-100 employees)

• Primary Need: Maximum functionality with minimal overhead
• Key Benefits: Free tier capabilities, self-hosting options, all-in-one platform
• ROI Timeline: Immediate
• Typical Use Case: Resource-constrained teams wanting enterprise-grade tools

Open Source Projects

• Primary Need: Community collaboration and transparency
• Key Benefits: Public repositories, community features, free hosting
• ROI Timeline: Immediate
• Typical Use Case: Open source maintainers seeking professional development tools

This makes it the ideal choice for:

Teams valuing self-hosting: GitLab’s free and open-source Community Edition offers unparalleled power for teams who want full control over their infrastructure and data.

DevSecOps Adopters: Organizations that prioritize security and want to integrate it seamlessly into their development lifecycle without adding friction.

If your team is tired of “integration hell” and wants a single, cohesive platform to manage everything from planning and coding to building, securing, and deploying applications, GitLab is designed for you.

GitHub vs. GitLab: A Detailed Comparison

While both platforms are leaders in Git hosting, their core focus and approach differ significantly.

Feature-by-Feature Comparison

Performance Metrics Comparison

Pros and Cons

Why You Might Choose GitLab

True All-in-One Platform

The biggest advantage. A single, unified UI and data model for your entire workflow simplifies processes and improves team collaboration.

Quantified Benefits:

• 40% reduction in context switching between tools
• 25% faster onboarding for new team members
• 60% improvement in cross-team visibility

Superior Self-Hosting Flexibility

GitLab’s Community Edition is a feature-rich, free, and open-source option for self-hosting, giving you complete control and data privacy.

Self-Hosting Advantages:

• Complete data sovereignty
• Custom compliance requirements
• Unlimited storage and compute resources
• No vendor lock-in concerns

Powerful Integrated CI/CD

GitLab CI/CD is mature, robust, and tightly integrated. The Auto DevOps feature can automatically build, test, and deploy applications with zero configuration.

CI/CD Metrics:

• 3x faster pipeline setup compared to Jenkins
• 50% reduction in build failures due to configuration errors
• Built-in Docker registry and Kubernetes integration

Built-in Security Scanning (DevSecOps)

Integrating security scanning directly into merge requests is a game-changer for building secure applications from the start.

Security Impact:

• 70% of vulnerabilities caught before production
• 90% reduction in security review cycle time
• Automated compliance reporting

Potential Drawbacks

Can Feel Overwhelming

The sheer number of features can make the UI feel cluttered and complex compared to GitHub’s more focused interface.

Mitigation Strategies:

• Use GitLab’s role-based access to hide unused features
• Implement phased rollout starting with core SCM features
• Provide comprehensive team training

Resource-Intensive Self-Hosting

Running the full GitLab omnibus package requires a significant amount of server resources (RAM and CPU), which can be a barrier for smaller teams or individuals.

Resource Requirements:

• Minimum: 4GB RAM, 2 CPU cores
• Recommended: 8GB RAM, 4 CPU cores
• Enterprise: 16GB+ RAM, 8+ CPU cores

Slightly Steeper Learning Curve

Because it does so much, mastering the entire platform takes more time than learning a more focused tool.

Learning Path Recommendations:

• Week 1-2: Source code management and basic workflows
• Week 3-4: CI/CD pipeline configuration
• Month 2: Advanced features and integrations
• Month 3+: DevSecOps and enterprise features

GitLab Installation Guide

Cloud vs. Self-Hosted Decision Matrix

Self-Hosted Installation: Step-by-Step Guide

Prerequisites Checklist

# System requirements verification script
#!/bin/bash

echo "GitLab Installation Prerequisites Check"
echo "======================================"

# Check OS version
echo "OS Version:"
cat /etc/os-release

# Check available memory
echo -e "\nMemory Check:"
free -h

# Check available disk space
echo -e "\nDisk Space Check:"
df -h

# Check if Docker is installed (for Docker installation)
echo -e "\nDocker Status:"
docker --version 2>/dev/null || echo "Docker not installed"

# Check if required ports are available
echo -e "\nPort Availability Check:"
for port in 80 443 22; do
    netstat -tuln | grep ":$port " && echo "Port $port is in use" || echo "Port $port is available"
done

Installation Method 1: Ubuntu/Debian Package Installation

# Step 1: Install dependencies
sudo apt-get update
sudo apt-get install -y curl openssh-server ca-certificates tzdata perl

# Step 2: Configure firewall (if using ufw)
sudo ufw allow OpenSSH
sudo ufw allow http
sudo ufw allow https
sudo ufw enable

# Step 3: Add GitLab package repository
curl https://packages.gitlab.com/install/repositories/gitlab/gitlab-ce/script.deb.sh | sudo bash

# Step 4: Install GitLab Community Edition
sudo EXTERNAL_URL="https://gitlab.example.com" apt-get install gitlab-ce

# Step 5: Initial configuration
sudo gitlab-ctl reconfigure

Installation Method 2: Docker Compose Installation

Create a docker-compose.yml file:

version: "3.8"

services:
  gitlab:
    image: "gitlab/gitlab-ce:latest"
    hostname: "gitlab.example.com"
    container_name: gitlab
    restart: always
    environment:
      GITLAB_OMNIBUS_CONFIG: |
        external_url 'https://gitlab.example.com'
        gitlab_rails['gitlab_shell_ssh_port'] = 2224
        # Email configuration
        gitlab_rails['smtp_enable'] = true
        gitlab_rails['smtp_address'] = "smtp.gmail.com"
        gitlab_rails['smtp_port'] = 587
        gitlab_rails['smtp_user_name'] = "[email protected]"
        gitlab_rails['smtp_password'] = "your-app-password"
        gitlab_rails['smtp_domain'] = "smtp.gmail.com"
        gitlab_rails['smtp_authentication'] = "login"
        gitlab_rails['smtp_enable_starttls_auto'] = true
        gitlab_rails['smtp_tls'] = false
    ports:
      - "80:80"
      - "443:443"
      - "2224:22"
    volumes:
      - "$GITLAB_HOME/config:/etc/gitlab"
      - "$GITLAB_HOME/logs:/var/log/gitlab"
      - "$GITLAB_HOME/data:/var/opt/gitlab"
    shm_size: "256m"

# Set environment variable for data location
export GITLAB_HOME=/srv/gitlab

# Create directories
sudo mkdir -p $GITLAB_HOME/{config,logs,data}

# Start GitLab
docker-compose up -d

# Monitor startup progress
docker logs -f gitlab

Installation Method 3: Kubernetes Helm Chart

# Step 1: Add GitLab Helm repository
helm repo add gitlab https://charts.gitlab.io/
helm repo update

# Step 2: Create values file
cat <<EOF > gitlab-values.yaml
global:
  hosts:
    domain: example.com
  ingress:
    configureCertmanager: true
  email:
    from: '[email protected]'
    display_name: GitLab
    reply_to: '[email protected]'

certmanager:
  install: true

postgresql:
  install: true

redis:
  install: true

registry:
  enabled: true

gitlab-runner:
  install: true
EOF

# Step 3: Install GitLab
kubectl create namespace gitlab
helm install gitlab gitlab/gitlab \
  --namespace gitlab \
  --values gitlab-values.yaml \
  --timeout 600s

Post-Installation Configuration

Initial Admin Setup

# Get initial root password (for package installations)
sudo cat /etc/gitlab/initial_root_password

# For Docker installations
docker exec -it gitlab grep 'Password:' /etc/gitlab/initial_root_password

SSL Certificate Configuration

# Using Let's Encrypt (recommended for production)
sudo gitlab-ctl reconfigure

# Manual SSL certificate configuration
sudo mkdir -p /etc/gitlab/ssl
sudo cp your-domain.crt /etc/gitlab/ssl/
sudo cp your-domain.key /etc/gitlab/ssl/
sudo chmod 600 /etc/gitlab/ssl/*

SMTP Configuration for Email Notifications

Edit /etc/gitlab/gitlab.rb:

# SMTP Settings
gitlab_rails['smtp_enable'] = true
gitlab_rails['smtp_address'] = "smtp.office365.com"
gitlab_rails['smtp_port'] = 587
gitlab_rails['smtp_user_name'] = "[email protected]"
gitlab_rails['smtp_password'] = "your-password"
gitlab_rails['smtp_domain'] = "yourcompany.com"
gitlab_rails['smtp_authentication'] = "login"
gitlab_rails['smtp_enable_starttls_auto'] = true
gitlab_rails['smtp_tls'] = false

# GitLab email sender
gitlab_rails['gitlab_email_from'] = '[email protected]'
gitlab_rails['gitlab_email_display_name'] = 'GitLab'

Apply configuration:

sudo gitlab-ctl reconfigure
sudo gitlab-ctl restart

# Test email configuration
sudo gitlab-rails console
> Notify.test_email('[email protected]', 'Test Subject', 'Test Body').deliver_now

Backup Configuration

# Configure automated backups
cat <<EOF >> /etc/gitlab/gitlab.rb
# Backup settings
gitlab_rails['backup_keep_time'] = 604800  # 7 days
gitlab_rails['backup_path'] = "/var/opt/gitlab/backups"

# Upload backups to S3 (optional)
gitlab_rails['backup_upload_connection'] = {
  'provider' => 'AWS',
  'region' => 'us-east-1',
  'aws_access_key_id' => 'your-access-key',
  'aws_secret_access_key' => 'your-secret-key'
}
gitlab_rails['backup_upload_remote_directory'] = 'your-backup-bucket'
EOF

# Reconfigure and test backup
sudo gitlab-ctl reconfigure
sudo gitlab-backup create

Runner Registration

# Install GitLab Runner
curl -L "https://packages.gitlab.com/install/repositories/runner/gitlab-runner/script.deb.sh" | sudo bash
sudo apt-get install gitlab-runner

# Register runner (get token from GitLab admin area)
sudo gitlab-runner register \
  --url "https://gitlab.example.com/" \
  --registration-token "your-registration-token" \
  --description "docker-runner" \
  --executor "docker" \
  --docker-image alpine:latest

Getting Started: Your First Project

Project Creation Walkthrough

1. Creating a New Project

# Via GitLab UI: Projects > New Project > Create blank project
# Via GitLab CLI (glab)
glab repo create my-first-project --private --description "My first GitLab project"

# Via API
curl --request POST --header "PRIVATE-TOKEN: your-token" \
     --header "Content-Type: application/json" \
     --data '{"name":"my-first-project","description":"My first GitLab project","visibility":"private"}' \
     "https://gitlab.example.com/api/v4/projects"

2. Repository Setup

# Clone your new repository
git clone https://gitlab.example.com/username/my-first-project.git
cd my-first-project

# Create initial project structure
mkdir -p {src,tests,docs,scripts}
touch README.md .gitignore

# Create a sample application
cat <<EOF > src/app.py
#!/usr/bin/env python3
"""
Sample Python application for GitLab demonstration
"""

def hello_world(name: str = "World") -> str:
    """Return a greeting message."""
    return f"Hello, {name}!"

def main():
    """Main application entry point."""
    print(hello_world("GitLab"))

if __name__ == "__main__":
    main()
EOF

# Create requirements file
cat <<EOF > requirements.txt
pytest>=7.0.0
pytest-cov>=4.0.0
flake8>=5.0.0
EOF

# Create test file
cat <<EOF > tests/test_app.py
"""Tests for the sample application."""
import pytest
from src.app import hello_world

def test_hello_world_default():
    """Test hello_world with default parameter."""
    result = hello_world()
    assert result == "Hello, World!"

def test_hello_world_custom_name():
    """Test hello_world with custom name."""
    result = hello_world("GitLab")
    assert result == "Hello, GitLab!"
EOF

3. GitLab Configuration Files

Create .gitlab-ci.yml for CI/CD:

# GitLab CI/CD Pipeline Configuration
stages:
  - lint
  - test
  - build
  - security
  - deploy

variables:
  PIP_CACHE_DIR: "$CI_PROJECT_DIR/.cache/pip"

cache:
  paths:
    - .cache/pip/
    - venv/

before_script:
  - python -V # Print Python version for debugging
  - pip install virtualenv
  - virtualenv venv
  - source venv/bin/activate
  - pip install -r requirements.txt

# Linting stage
lint:
  stage: lint
  script:
    - flake8 src/ tests/
  only:
    - merge_requests
    - main

# Testing stage
test:
  stage: test
  script:
    - pytest tests/ --cov=src --cov-report=xml --cov-report=term
  coverage: "/TOTAL.+ ([0-9]{1,3}%)/"
  artifacts:
    reports:
      coverage_report:
        coverage_format: cobertura
        path: coverage.xml
  only:
    - merge_requests
    - main

# Security scanning
security_scan:
  stage: security
  script:
    - echo "Running security scans..."
    - pip install safety bandit
    - safety check
    - bandit -r src/
  only:
    - merge_requests
    - main

# Build stage
build:
  stage: build
  script:
    - echo "Building application..."
    - python setup.py sdist bdist_wheel
  artifacts:
    paths:
      - dist/
  only:
    - main

# Deploy to staging
deploy_staging:
  stage: deploy
  script:
    - echo "Deploying to staging environment..."
    - echo "Application URL: https://staging.example.com"
  environment:
    name: staging
    url: https://staging.example.com
  only:
    - main

# Deploy to production (manual trigger)
deploy_production:
  stage: deploy
  script:
    - echo "Deploying to production environment..."
    - echo "Application URL: https://production.example.com"
  environment:
    name: production
    url: https://production.example.com
  when: manual
  only:
    - main

Create project setup file:

# setup.py
from setuptools import setup, find_packages

setup(
    name="my-first-project",
    version="0.1.0",
    packages=find_packages(),
    install_requires=[],
    author="Your Name",
    author_email="[email protected]",
    description="A sample GitLab project",
    long_description=open("README.md").read(),
    long_description_content_type="text/markdown",
    url="https://gitlab.example.com/username/my-first-project",
    classifiers=[
        "Development Status :: 3 - Alpha",
        "Intended Audience :: Developers",
        "License :: OSI Approved :: MIT License",
        "Programming Language :: Python :: 3",
        "Programming Language :: Python :: 3.8",
        "Programming Language :: Python :: 3.9",
        "Programming Language :: Python :: 3.10",
    ],
    python_requires=">=3.8",
)

4. Initial Commit and Push

# Configure Git (if not already done)
git config user.name "Your Name"
git config user.email "[email protected]"

# Add files and commit
git add .
git commit -m "Initial commit: Add sample Python application with CI/CD pipeline"

# Push to GitLab
git push -u origin main

Setting Up Branch Protection and Merge Requests

1. Configure Protected Branches

Navigate to Project Settings > Repository > Protected branches or use the API:

# Protect main branch via API
curl --request POST --header "PRIVATE-TOKEN: your-token" \
     "https://gitlab.example.com/api/v4/projects/PROJECT_ID/protected_branches" \
     --form "name=main" \
     --form "push_access_level=40" \
     --form "merge_access_level=40"

2. Create Your First Merge Request

# Create a feature branch
git checkout -b feature/add-documentation

# Add documentation
cat <<EOF > docs/INSTALLATION.md
# Installation Guide

## Requirements
- Python 3.8 or higher
- pip package manager

## Installation Steps
1. Clone the repository
2. Install dependencies: \`pip install -r requirements.txt\`
3. Run the application: \`python src/app.py\`

## Running Tests
\`\`\`bash
pytest tests/
\`\`\`
EOF

# Commit and push
git add docs/INSTALLATION.md
git commit -m "Add installation documentation"
git push -u origin feature/add-documentation

# Create merge request via glab CLI
glab mr create --title "Add installation documentation" \
               --description "This MR adds comprehensive installation documentation for new users"

Mastering GitLab CI/CD

Pipeline Architecture Overview

GitLab CI/CD follows a stage-based architecture where jobs run in parallel within stages and stages run sequentially.

graph LR
    A[Source Code] --> B[Build Stage]
    B --> C[Test Stage]
    C --> D[Security Stage]
    D --> E[Deploy Staging]
    E --> F[Deploy Production]

    B --> B1[Compile]
    B --> B2[Package]

    C --> C1[Unit Tests]
    C --> C2[Integration Tests]
    C --> C3[Code Coverage]

    D --> D1[SAST Scan]
    D --> D2[DAST Scan]
    D --> D3[Dependency Scan]

Advanced Pipeline Examples

Multi-Language Monorepo Pipeline

# .gitlab-ci.yml for monorepo with multiple services
stages:
  - analyze
  - build
  - test
  - security
  - package
  - deploy

variables:
  DOCKER_DRIVER: overlay2
  DOCKER_TLS_CERTDIR: "/certs"

# Template for service jobs
.service_template: &service_template
  rules:
    - changes:
        - "$SERVICE_PATH/**/*"
        - ".gitlab-ci.yml"

# Analyze stage - detect changes
detect_changes:
  stage: analyze
  image: alpine/git
  script:
    - |
      echo "Detecting changes..."
      if git diff --name-only $CI_COMMIT_BEFORE_SHA $CI_COMMIT_SHA | grep -q "^frontend/"; then
        echo "FRONTEND_CHANGED=true" >> variables.env
      fi
      if git diff --name-only $CI_COMMIT_BEFORE_SHA $CI_COMMIT_SHA | grep -q "^backend/"; then
        echo "BACKEND_CHANGED=true" >> variables.env
      fi
      if git diff --name-only $CI_COMMIT_BEFORE_SHA $CI_COMMIT_SHA | grep -q "^mobile/"; then
        echo "MOBILE_CHANGED=true" >> variables.env
      fi
  artifacts:
    reports:
      dotenv: variables.env

# Frontend jobs
frontend_lint:
  stage: build
  image: node:16-alpine
  <<: *service_template
  variables:
    SERVICE_PATH: frontend
  script:
    - cd frontend
    - npm ci
    - npm run lint
    - npm run type-check
  cache:
    key: frontend-$CI_COMMIT_REF_SLUG
    paths:
      - frontend/node_modules/

frontend_test:
  stage: test
  image: node:16-alpine
  <<: *service_template
  variables:
    SERVICE_PATH: frontend
  script:
    - cd frontend
    - npm ci
    - npm run test:coverage
  coverage: '/All files[^|]*\|[^|]*\s+([\d\.]+)/'
  artifacts:
    reports:
      coverage_report:
        coverage_format: cobertura
        path: frontend/coverage/cobertura-coverage.xml
  cache:
    key: frontend-$CI_COMMIT_REF_SLUG
    paths:
      - frontend/node_modules/

frontend_build:
  stage: package
  image: node:16-alpine
  <<: *service_template
  variables:
    SERVICE_PATH: frontend
  script:
    - cd frontend
    - npm ci
    - npm run build
  artifacts:
    paths:
      - frontend/dist/
    expire_in: 1 hour

# Backend jobs
backend_lint:
  stage: build
  image: python:3.9-slim
  <<: *service_template
  variables:
    SERVICE_PATH: backend
  before_script:
    - cd backend
    - pip install -r requirements-dev.txt
  script:
    - flake8 .
    - black --check .
    - mypy .

backend_test:
  stage: test
  image: python:3.9-slim
  <<: *service_template
  variables:
    SERVICE_PATH: backend
  services:
    - postgres:13
    - redis:6-alpine
  variables:
    POSTGRES_DB: testdb
    POSTGRES_USER: testuser
    POSTGRES_PASSWORD: testpass
    DATABASE_URL: postgresql://testuser:testpass@postgres:5432/testdb
    REDIS_URL: redis://redis:6379
  before_script:
    - cd backend
    - pip install -r requirements.txt
    - pip install -r requirements-dev.txt
  script:
    - pytest --cov=app --cov-report=xml --cov-report=term
  coverage: '/TOTAL.+ ([0-9]{1,3}%)/'
  artifacts:
    reports:
      coverage_report:
        coverage_format: cobertura
        path: backend/coverage.xml

# Container build jobs
.docker_build_template: &docker_build_template
  stage: package
  image: docker:20.10.16
  services:
    - docker:20.10.16-dind
  before_script:
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
  script:
    - |
      docker build -t $CI_REGISTRY_IMAGE/$SERVICE_NAME:$CI_COMMIT_SHA \
                   -t $CI_REGISTRY_IMAGE/$SERVICE_NAME:latest \
                   $SERVICE_PATH/
      docker push $CI_REGISTRY_IMAGE/$SERVICE_NAME:$CI_COMMIT_SHA
      docker push $CI_REGISTRY_IMAGE/$SERVICE_NAME:latest

frontend_docker:
  <<: *docker_build_template
  variables:
    SERVICE_NAME: frontend
    SERVICE_PATH: frontend
  rules:
    - changes:
        - "frontend/**/*"
        - ".gitlab-ci.yml"

backend_docker:
  <<: *docker_build_template
  variables:
    SERVICE_NAME: backend
    SERVICE_PATH: backend
  rules:
    - changes:
        - "backend/**/*"
        - ".gitlab-ci.yml"

# Security scanning
include:
  - template: Security/SAST.gitlab-ci.yml
  - template: Security/Dependency-Scanning.gitlab-ci.yml
  - template: Security/Container-Scanning.gitlab-ci.yml
  - template: Security/DAST.gitlab-ci.yml

# Custom security job for secrets detection
secrets_scan:
  stage: security
  image: alpine/git
  script:
    - apk add --no-cache git
    - git clone https://github.com/trufflesecurity/trufflehog.git
    - cd trufflehog && go build
    - ./trufflehog filesystem ../
  allow_failure: true

# Deployment jobs
.deploy_template: &deploy_template
  image: alpine/k8s:1.24.0
  before_script:
    - echo $KUBECONFIG | base64 -d > /tmp/kubeconfig
    - export KUBECONFIG=/tmp/kubeconfig
    - kubectl version --client

deploy_staging:
  <<: *deploy_template
  stage: deploy
  environment:
    name: staging
    url: https://staging.example.com
    deployment_tier: staging
  script:
    - |
      helm upgrade --install myapp-staging ./helm-chart \
        --namespace staging \
        --set image.frontend.tag=$CI_COMMIT_SHA \
        --set image.backend.tag=$CI_COMMIT_SHA \
        --set ingress.host=staging.example.com
  only:
    - main

deploy_production:
  <<: *deploy_template
  stage: deploy
  environment:
    name: production
    url: https://production.example.com
    deployment_tier: production
  script:
    - |
      helm upgrade --install myapp-production ./helm-chart \
        --namespace production \
        --set image.frontend.tag=$CI_COMMIT_SHA \
        --set image.backend.tag=$CI_COMMIT_SHA \
        --set ingress.host=production.example.com
  when: manual
  only:
    - main

Dynamic Pipeline Configuration

# Dynamic pipeline based on project structure
stages:
  - prepare
  - build
  - test
  - deploy

# Job to generate dynamic pipeline
generate_pipeline:
  stage: prepare
  image: alpine:latest
  script:
    - |
      cat > dynamic-pipeline.yml << EOF
      stages:
        - build
        - test
        - deploy
      EOF

      # Check for different project types
      if [ -f "package.json" ]; then
        cat >> dynamic-pipeline.yml << EOF

      node_build:
        stage: build
        image: node:16
        script:
          - npm ci
          - npm run build
        artifacts:
          paths:
            - dist/

      node_test:
        stage: test
        image: node:16
        script:
          - npm ci
          - npm test
      EOF
      fi

      if [ -f "requirements.txt" ]; then
        cat >> dynamic-pipeline.yml << EOF

      python_build:
        stage: build
        image: python:3.9
        script:
          - pip install -r requirements.txt
          - python setup.py sdist bdist_wheel
        artifacts:
          paths:
            - dist/

      python_test:
        stage: test
        image: python:3.9
        script:
          - pip install -r requirements.txt
          - pytest
      EOF
      fi

      if [ -f "Dockerfile" ]; then
        cat >> dynamic-pipeline.yml << EOF

      docker_build:
        stage: build
        image: docker:20.10.16
        services:
          - docker:20.10.16-dind
        script:
          - docker build -t \$CI_REGISTRY_IMAGE:\$CI_COMMIT_SHA .
          - docker push \$CI_REGISTRY_IMAGE:\$CI_COMMIT_SHA
      EOF
      fi
  artifacts:
    paths:
      - dynamic-pipeline.yml
  rules:
    - if: $CI_COMMIT_BRANCH == "main"

# Include the dynamically generated pipeline
include:
  - local: dynamic-pipeline.yml

GitLab Runner Configuration

Installing and Configuring Runners

# Install GitLab Runner on Ubuntu
curl -L "https://packages.gitlab.com/install/repositories/runner/gitlab-runner/script.deb.sh" | sudo bash
sudo apt-get install gitlab-runner

# Create custom config for Docker executor
cat <<EOF > /tmp/runner-config.toml
concurrent = 10
check_interval = 0

[session_server]
  session_timeout = 1800

[[runners]]
  name = "docker-runner-1"
  url = "https://gitlab.example.com/"
  token = "your-runner-token"
  executor = "docker"
  [runners.custom_build_dir]
  [runners.cache]
    [runners.cache.s3]
    [runners.cache.gcs]
    [runners.cache.azure]
  [runners.docker]
    tls_verify = false
    image = "alpine:latest"
    privileged = true
    disable_entrypoint_overwrite = false
    oom_kill_disable = false
    disable_cache = false
    volumes = ["/var/run/docker.sock:/var/run/docker.sock", "/cache"]
    shm_size = 0
EOF

# Copy config and restart
sudo cp /tmp/runner-config.toml /etc/gitlab-runner/config.toml
sudo gitlab-runner restart

Kubernetes Runner with Auto-scaling

# kubernetes-runner-values.yaml
gitlabUrl: https://gitlab.example.com/
runnerToken: "your-runner-token"

runners:
  config: |
    [[runners]]
      [runners.kubernetes]
        image = "ubuntu:20.04"
        privileged = true
        namespace = "gitlab-runner"

        # Resource limits
        cpu_limit = "1"
        memory_limit = "2Gi"
        service_cpu_limit = "0.5"
        service_memory_limit = "512Mi"

        # Node selector for dedicated nodes
        node_selector_overwrite_allowed = ".*"

        # Helper image configuration
        helper_cpu_limit = "0.1"
        helper_memory_limit = "128Mi"

        # Volume mounts
        [[runners.kubernetes.volumes.empty_dir]]
          name = "docker-certs"
          mount_path = "/certs/client"
          medium = "Memory"

# Install with Helm
helm repo add gitlab https://charts.gitlab.io
helm install gitlab-runner gitlab/gitlab-runner \
  --namespace gitlab-runner \
  --create-namespace \
  --values kubernetes-runner-values.yaml

Custom Runner with GPU Support

# GPU runner configuration
[[runners]]
  name = "gpu-runner"
  url = "https://gitlab.example.com/"
  token = "your-gpu-runner-token"
  executor = "docker"
  [runners.docker]
    image = "nvidia/cuda:11.8-runtime-ubuntu20.04"
    privileged = true
    runtime = "nvidia"
    environment = ["NVIDIA_VISIBLE_DEVICES=all"]
    volumes = ["/var/run/docker.sock:/var/run/docker.sock"]

Pipeline Optimization Strategies

Caching Best Practices

# Global cache configuration
variables:
  CACHE_VERSION: "v1"

# Cache templates for different languages
.python_cache: &python_cache
  cache:
    key: python-$CACHE_VERSION-$CI_COMMIT_REF_SLUG
    paths:
      - .pip-cache/
      - venv/
    policy: pull-push

.node_cache: &node_cache
  cache:
    key: node-$CACHE_VERSION-$CI_COMMIT_REF_SLUG
    paths:
      - node_modules/
      - .npm/
    policy: pull-push

.maven_cache: &maven_cache
  cache:
    key: maven-$CACHE_VERSION-$CI_COMMIT_REF_SLUG
    paths:
      - .m2/repository/
    policy: pull-push

# Example job with optimized caching
python_test:
  stage: test
  image: python:3.9
  <<: *python_cache
  before_script:
    - export PIP_CACHE_DIR=.pip-cache
    - python -m venv venv
    - source venv/bin/activate
    - pip install --upgrade pip
    - pip install -r requirements.txt
  script:
    - pytest --junitxml=report.xml --cov=src --cov-report=xml
  artifacts:
    reports:
      junit: report.xml
      coverage_report:
        coverage_format: cobertura
        path: coverage.xml

Parallel Job Execution

# Matrix builds for multiple environments
test:
  stage: test
  image: python:${PYTHON_VERSION}
  parallel:
    matrix:
      - PYTHON_VERSION: ["3.8", "3.9", "3.10", "3.11"]
        OS: ["ubuntu-latest"]
      - PYTHON_VERSION: ["3.9"]
        OS: ["windows-latest", "macos-latest"]
  script:
    - pip install -r requirements.txt
    - pytest

# Parallel test execution by test suite
test_unit:
  stage: test
  script:
    - pytest tests/unit/
  parallel: 4

test_integration:
  stage: test
  script:
    - pytest tests/integration/
  parallel: 2

# Fan-out/fan-in pattern for microservices
build_services:
  stage: build
  script:
    - echo "Building service $SERVICE_NAME"
  parallel:
    matrix:
      - SERVICE_NAME: ["auth", "user", "payment", "notification"]

deploy_all:
  stage: deploy
  needs:
    - job: build_services
      parallel:
        matrix:
          - SERVICE_NAME: ["auth", "user", "payment", "notification"]
  script:
    - echo "Deploying all services"

Environment Management

Environment-specific Deployments

# Environment configuration
.deploy_template: &deploy_template
  stage: deploy
  image: alpine/k8s:1.24.0
  before_script:
    - echo $KUBECONFIG | base64 -d > /tmp/kubeconfig
    - export KUBECONFIG=/tmp/kubeconfig

# Development environment
deploy_development:
  <<: *deploy_template
  environment:
    name: development
    url: https://dev.example.com
    deployment_tier: development
    auto_stop_in: 1 day
  script:
    - helm upgrade --install myapp-dev ./chart --set env=development
  rules:
    - if: $CI_COMMIT_BRANCH != "main"
      when: manual

# Staging environment
deploy_staging:
  <<: *deploy_template
  environment:
    name: staging
    url: https://staging.example.com
    deployment_tier: staging
  script:
    - helm upgrade --install myapp-staging ./chart --set env=staging
  rules:
    - if: $CI_COMMIT_BRANCH == "main"

# Production environment with approval
deploy_production:
  <<: *deploy_template
  environment:
    name: production
    url: https://production.example.com
    deployment_tier: production
  script:
    - helm upgrade --install myapp-prod ./chart --set env=production
  rules:
    - if: $CI_COMMIT_BRANCH == "main"
      when: manual
  allow_failure: false

Blue-Green Deployment Strategy

# Blue-Green deployment implementation
deploy_blue:
  stage: deploy
  environment:
    name: production-blue
    url: https://blue.production.example.com
  script:
    - |
      helm upgrade --install myapp-blue ./chart \
        --set deployment.color=blue \
        --set image.tag=$CI_COMMIT_SHA \
        --set ingress.host=blue.production.example.com
    - ./scripts/health-check.sh blue.production.example.com
  artifacts:
    reports:
      dotenv: blue-deployment.env

smoke_test_blue:
  stage: deploy
  needs: ["deploy_blue"]
  script:
    - ./scripts/smoke-tests.sh blue.production.example.com
    - echo "BLUE_HEALTH=healthy" >> deployment.env
  artifacts:
    reports:
      dotenv: deployment.env

switch_traffic:
  stage: deploy
  needs: ["smoke_test_blue"]
  environment:
    name: production
    url: https://production.example.com
  script:
    - |
      # Update load balancer to point to blue environment
      kubectl patch service production-service \
        -p '{"spec":{"selector":{"color":"blue"}}}'
    - echo "Traffic switched to blue environment"
    - ./scripts/monitor-metrics.sh
  when: manual

cleanup_green:
  stage: deploy
  needs: ["switch_traffic"]
  script:
    - helm uninstall myapp-green || true
    - echo "Green environment cleaned up"
  when: manual

Advanced DevSecOps Integration

Security Scanning Configuration

SAST (Static Application Security Testing)

# Custom SAST configuration
include:
  - template: Security/SAST.gitlab-ci.yml

variables:
  SAST_EXCLUDED_PATHS: "tests/, docs/, *.md"
  SAST_EXCLUDED_ANALYZERS: "eslint" # Exclude specific analyzers

# Custom SAST job for additional tools
sonarqube_scan:
  stage: security
  image: sonarsource/sonar-scanner-cli:latest
  variables:
    SONAR_HOST_URL: "https://sonarqube.example.com"
    SONAR_TOKEN: $SONAR_TOKEN
    GIT_DEPTH: "0"
  script:
    - sonar-scanner
      -Dsonar.projectKey=$CI_PROJECT_NAME
      -Dsonar.sources=src/
      -Dsonar.tests=tests/
      -Dsonar.python.coverage.reportPaths=coverage.xml
      -Dsonar.python.xunit.reportPath=pytest-report.xml
  coverage: '/COVERAGE.+?(\d+(?:\.\d+)?%)/'
  artifacts:
    reports:
      junit: pytest-report.xml

# Custom security rules enforcement
security_policy_check:
  stage: security
  image: alpine:latest
  before_script:
    - apk add --no-cache jq curl
  script:
    - |
      # Download security scan results
      SCAN_RESULTS=$(curl -s --header "PRIVATE-TOKEN: $CI_JOB_TOKEN" \
        "$CI_API_V4_URL/projects/$CI_PROJECT_ID/vulnerability_findings")

      # Count critical and high vulnerabilities
      CRITICAL=$(echo "$SCAN_RESULTS" | jq '[.[] | select(.severity == "Critical")] | length')
      HIGH=$(echo "$SCAN_RESULTS" | jq '[.[] | select(.severity == "High")] | length')

      echo "Critical vulnerabilities: $CRITICAL"
      echo "High vulnerabilities: $HIGH"

      # Fail if policy violations exist
      if [ "$CRITICAL" -gt 0 ]; then
        echo "❌ Policy violation: Critical vulnerabilities found"
        exit 1
      fi

      if [ "$HIGH" -gt 5 ]; then
        echo "❌ Policy violation: Too many high-severity vulnerabilities ($HIGH > 5)"
        exit 1
      fi

      echo "✅ Security policy compliance check passed"

DAST (Dynamic Application Security Testing)

# DAST configuration
include:
  - template: DAST.gitlab-ci.yml

variables:
  DAST_WEBSITE: "https://staging.example.com"
  DAST_FULL_SCAN_ENABLED: "true"
  DAST_AUTH_URL: "https://staging.example.com/login"
  DAST_USERNAME: $DAST_USERNAME
  DAST_PASSWORD: $DAST_PASSWORD
  DAST_EXCLUDE_URLS: "https://staging.example.com/admin,https://staging.example.com/logout"

# Custom DAST with OWASP ZAP
owasp_zap_scan:
  stage: security
  image: owasp/zap2docker-stable:latest
  variables:
    ZAP_TARGET: "https://staging.example.com"
  script:
    - mkdir -p /zap/wrk
    - |
      zap-full-scan.py \
        -t $ZAP_TARGET \
        -r zap-report.html \
        -x zap-report.xml \
        -J zap-report.json \
        -a \
        --hook=/zap/auth_hook.py
  artifacts:
    reports:
      dast: zap-report.json
    paths:
      - zap-report.html
      - zap-report.xml
    expire_in: 1 week
  allow_failure: true

Container Security Scanning

# Container scanning configuration
include:
  - template: Security/Container-Scanning.gitlab-ci.yml

variables:
  CS_IMAGE: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
  CS_DISABLE_DEPENDENCY_LIST: "false"
  CS_SEVERITY_THRESHOLD: "HIGH"

# Custom Trivy scan
trivy_scan:
  stage: security
  image: aquasec/trivy:latest
  services:
    - docker:20.10.16-dind
  variables:
    DOCKER_DRIVER: overlay2
    DOCKER_TLS_CERTDIR: "/certs"
  before_script:
    - export TRIVY_USERNAME="$CI_REGISTRY_USER"
    - export TRIVY_PASSWORD="$CI_REGISTRY_PASSWORD"
  script:
    - |
      # Scan for vulnerabilities
      trivy image \
        --format json \
        --output trivy-report.json \
        --severity HIGH,CRITICAL \
        $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA

      # Scan for secrets
      trivy config \
        --format json \
        --output trivy-config-report.json \
        .

      # Scan for misconfigurations
      trivy fs \
        --format json \
        --output trivy-fs-report.json \
        --security-checks config,secret \
        .
  artifacts:
    reports:
      container_scanning: trivy-report.json
    paths:
      - trivy-*.json
    expire_in: 1 week

# Admission controller policy check
opa_policy_check:
  stage: security
  image: openpolicyagent/opa:latest
  script:
    - |
      # Download Kubernetes manifests
      helm template myapp ./chart > k8s-manifests.yaml

      # Run OPA policy checks
      opa eval -d policies/ -i k8s-manifests.yaml \
        "data.kubernetes.admission.deny[x]" > policy-violations.json

      # Check for violations
      VIOLATIONS=$(cat policy-violations.json | jq length)
      if [ "$VIOLATIONS" -gt 0 ]; then
        echo "❌ Policy violations found:"
        cat policy-violations.json | jq '.'
        exit 1
      fi

      echo "✅ All OPA policy checks passed"
  artifacts:
    paths:
      - policy-violations.json
    expire_in: 1 week

Compliance and Governance

FIPS 140-2 Compliance Pipeline

# FIPS compliance validation
fips_compliance_check:
  stage: security
  image: registry.access.redhat.com/ubi8/ubi:latest
  script:
    - |
      # Verify FIPS mode is enabled
      if [ ! -f /proc/sys/crypto/fips_enabled ] || [ "$(cat /proc/sys/crypto/fips_enabled)" != "1" ]; then
        echo "❌ FIPS mode not enabled"
        exit 1
      fi

      # Check cryptographic libraries
      rpm -qa | grep -E "(openssl|nss|gnutls)" > crypto-packages.txt

      # Validate approved algorithms only
      ./scripts/validate-crypto-algorithms.sh

      echo "✅ FIPS 140-2 compliance validated"
  artifacts:
    paths:
      - crypto-packages.txt
    expire_in: 30 days
  only:
    variables:
      - $FIPS_REQUIRED == "true"

SOC 2 Compliance Automation

# SOC 2 compliance checks
soc2_compliance:
  stage: security
  image: alpine:latest
  before_script:
    - apk add --no-cache curl jq git
  script:
    - |
      # CC6.1 - Logical and physical access controls
      echo "Checking access controls..."
      ./scripts/check-access-controls.sh

      # CC6.7 - System operations
      echo "Validating system operations..."
      ./scripts/validate-operations.sh

      # CC7.1 - System monitoring
      echo "Verifying monitoring capabilities..."
      ./scripts/check-monitoring.sh

      # A1.2 - Availability monitoring
      echo "Checking availability metrics..."
      ./scripts/check-availability.sh

      echo "✅ SOC 2 compliance checks completed"
  artifacts:
    reports:
      junit: soc2-compliance-report.xml
    paths:
      - compliance-evidence/
    expire_in: 1 year

Project Management & Collaboration

Issue Tracking and Planning

Epic and Issue Management

# GitLab CLI commands for project management
# Create an epic
glab epic create --title "User Authentication System" \
                 --description "Implement comprehensive user authentication with SSO support"

# Create issues under the epic
glab issue create --title "Design authentication API endpoints" \
                  --description "Define REST API endpoints for user authentication" \
                  --label "backend,api" \
                  --assignee "backend-dev" \
                  --milestone "Sprint 1"

glab issue create --title "Implement OAuth2 integration" \
                  --description "Add OAuth2 support for Google and GitHub" \
                  --label "backend,oauth" \
                  --assignee "backend-dev" \
                  --milestone "Sprint 2"

# Link issues to epic via API
curl --request POST --header "PRIVATE-TOKEN: your-token" \
     "https://gitlab.example.com/api/v4/groups/GROUP_ID/epics/EPIC_ID/issues/ISSUE_ID"

Advanced Issue Templates

Create .gitlab/issue_templates/Bug.md:

## Bug Report

### Summary

Brief description of the bug

### Environment

- GitLab version:
- Browser:
- OS:

### Steps to Reproduce

1.
2.
3.

### Expected Behavior

What you expected to happen

### Actual Behavior

What actually happened

### Screenshots/Logs

Add screenshots or error logs here

### Additional Context

Add any other context about the problem here

### Definition of Done

- [ ] Bug is reproduced
- [ ] Root cause is identified
- [ ] Fix is implemented
- [ ] Tests are added
- [ ] Documentation is updated
- [ ] Code is reviewed and merged

---

/label ~bug ~needs-investigation
/assign @team-lead

Create .gitlab/issue_templates/Feature.md:

## Feature Request

### User Story

As a [user type], I want [functionality] so that [benefit/value]

### Acceptance Criteria

- [ ] Criteria 1
- [ ] Criteria 2
- [ ] Criteria 3

### Technical Requirements

- [ ] API endpoints defined
- [ ] Database schema updated
- [ ] Frontend components created
- [ ] Tests implemented
- [ ] Documentation updated

### Design Mockups

Add design mockups or wireframes here

### Technical Approach

Brief description of technical implementation

### Dependencies

List any dependencies or blockers

### Effort Estimation

- Story Points:
- Time Estimate:

---

/label ~feature ~needs-design
/milestone %"Sprint X"

Advanced Merge Request Workflows

Merge Request Templates

Create .gitlab/merge_request_templates/Default.md:

## Merge Request Checklist

### Changes Made

- [ ] What changes were made
- [ ] Why these changes were necessary
- [ ] Impact on existing functionality

### Testing

- [ ] Unit tests added/updated
- [ ] Integration tests added/updated
- [ ] Manual testing completed
- [ ] Performance impact assessed

### Code Quality

- [ ] Code follows project standards
- [ ] No new security vulnerabilities introduced
- [ ] Documentation updated
- [ ] Comments added where necessary

### Deployment

- [ ] Database migrations included (if applicable)
- [ ] Environment variables updated (if applicable)
- [ ] Configuration changes documented
- [ ] Rollback plan considered

### Review Requirements

- [ ] Code reviewed by team lead
- [ ] Security review completed (if applicable)
- [ ] Architecture review completed (if applicable)

### Screenshots/Evidence

Add screenshots or evidence of functionality here

---

Closes #ISSUE_NUMBER
/assign @reviewer

Advanced Approval Rules

# Configure push rules via API
curl --request POST --header "PRIVATE-TOKEN: your-token" \
     "https://gitlab.example.com/api/v4/projects/PROJECT_ID/push_rule" \
     --data "commit_message_regex=^(feat|fix|docs|style|refactor|test|chore)(\(.+\))?: .{1,50}" \
     --data "branch_name_regex=^(feature|bugfix|hotfix)\/.+$" \
     --data "author_email_regex=@yourcompany\.com$" \
     --data "file_name_regex=" \
     --data "max_file_size=100"

# Configure approval rules
curl --request POST --header "PRIVATE-TOKEN: your-token" \
     "https://gitlab.example.com/api/v4/projects/PROJECT_ID/merge_request_approval_rules" \
     --data "name=Security Review" \
     --data "approvals_required=1" \
     --data "user_ids[]=SECURITY_TEAM_USER_ID" \
     --data "rule_type=regular"

Code Review Best Practices

Automated Code Review Integration

# Code review automation pipeline
stages:
  - review
  - approve

# Automated code analysis
code_analysis:
  stage: review
  image: alpine:latest
  before_script:
    - apk add --no-cache git jq curl
  script:
    - |
      # Get merge request changes
      MR_CHANGES=$(git diff --name-only origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME..HEAD)

      # Calculate complexity metrics
      echo "Analyzing code complexity..."
      ./scripts/calculate-complexity.sh > complexity-report.json

      # Check for large files
      echo "Checking for large files..."
      find . -name "*.py" -size +500c > large-files.txt

      # Generate review report
      cat > review-report.md << EOF
      # Automated Code Review Report

      ## Changes Summary
      - Files changed: $(echo "$MR_CHANGES" | wc -l)
      - Lines added: $(git diff --numstat origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME..HEAD | awk '{sum+=$1} END {print sum}')
      - Lines removed: $(git diff --numstat origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME..HEAD | awk '{sum+=$2} END {print sum}')

      ## Complexity Analysis
      $(cat complexity-report.json | jq -r '.summary')

      ## Recommendations
      $(./scripts/generate-recommendations.sh)
      EOF

      # Post comment to merge request
      curl --request POST --header "PRIVATE-TOKEN: $CI_JOB_TOKEN" \
           --header "Content-Type: application/json" \
           --data "{\"body\":\"$(cat review-report.md | sed 's/"/\\"/g' | tr '\n' ' ')\"}" \
           "$CI_API_V4_URL/projects/$CI_PROJECT_ID/merge_requests/$CI_MERGE_REQUEST_IID/notes"
  artifacts:
    paths:
      - review-report.md
      - complexity-report.json
    expire_in: 7 days
  only:
    - merge_requests

GitLab Performance & Scaling

Performance Monitoring

GitLab Metrics and Observability

# Prometheus configuration for GitLab monitoring
global:
  scrape_interval: 15s
  evaluation_interval: 15s

rule_files:
  - "gitlab_rules.yml"

scrape_configs:
  - job_name: "gitlab"
    static_configs:
      - targets: ["gitlab.example.com:9090"]
    metrics_path: "/-/metrics"

  - job_name: "gitlab-runner"
    static_configs:
      - targets: ["runner1.example.com:9252", "runner2.example.com:9252"]

  - job_name: "postgres"
    static_configs:
      - targets: ["postgres.example.com:9187"]

  - job_name: "redis"
    static_configs:
      - targets: ["redis.example.com:9121"]

GitLab alerting rules (gitlab_rules.yml):

groups:
  - name: gitlab
    rules:
      - alert: GitLabDown
        expr: up{job="gitlab"} == 0
        for: 5m
        labels:
          severity: critical
        annotations:
          summary: "GitLab is down"
          description: "GitLab has been down for more than 5 minutes"

      - alert: GitLabHighMemoryUsage
        expr: (gitlab_memory_usage_bytes / gitlab_memory_limit_bytes) > 0.85
        for: 10m
        labels:
          severity: warning
        annotations:
          summary: "GitLab memory usage is high"
          description: "GitLab memory usage is {{ $value | humanizePercentage }}"

      - alert: GitLabHighDatabaseConnections
        expr: gitlab_database_connections > 80
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "GitLab database connections are high"
          description: "GitLab has {{ $value }} database connections"

      - alert: GitLabRunnerOffline
        expr: up{job="gitlab-runner"} == 0
        for: 3m
        labels:
          severity: warning
        annotations:
          summary: "GitLab Runner is offline"
          description: "GitLab Runner {{ $labels.instance }} has been offline for more than 3 minutes"

      - alert: GitLabJobQueueHigh
        expr: gitlab_runner_jobs{state="running"} > 50
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "GitLab job queue is high"
          description: "There are {{ $value }} jobs running, which is above the threshold"

Performance Tuning Configuration

# /etc/gitlab/gitlab.rb - Performance optimizations
# Memory allocation
puma['worker_processes'] = 4
puma['min_threads'] = 4
puma['max_threads'] = 4

# Database connection pool
gitlab_rails['db_pool'] = 20
postgresql['shared_buffers'] = "512MB"
postgresql['effective_cache_size'] = "2GB"
postgresql['work_mem'] = "16MB"
postgresql['maintenance_work_mem'] = "128MB"

# Redis configuration
redis['maxmemory'] = "2gb"
redis['maxmemory_policy'] = "allkeys-lru"

# Gitaly (Git storage)
gitaly['ruby_max_rss'] = 300000000  # 300MB
gitaly['ruby_graceful_restart_timeout'] = '10m'
gitaly['ruby_restart_delay'] = '5m'

# Sidekiq (background jobs)
sidekiq['max_concurrency'] = 25

# Nginx optimizations
nginx['worker_processes'] = 4
nginx['worker_connections'] = 1024
nginx['keepalive_timeout'] = 65
nginx['gzip'] = "on"
nginx['gzip_comp_level'] = 6

# Monitoring
prometheus_monitoring['enable'] = true
node_exporter['enable'] = true
postgres_exporter['enable'] = true
redis_exporter['enable'] = true

Scaling Strategies

Horizontal Scaling Architecture

graph TB
    LB[Load Balancer] --> |HTTPS| WEB1[GitLab Web 1]
    LB --> |HTTPS| WEB2[GitLab Web 2]
    LB --> |HTTPS| WEB3[GitLab Web 3]

    WEB1 --> |TCP| GITALY1[Gitaly 1]
    WEB2 --> |TCP| GITALY2[Gitaly 2]
    WEB3 --> |TCP| GITALY3[Gitaly 3]

    WEB1 --> |TCP| PG[(PostgreSQL Primary)]
    WEB2 --> |TCP| PG
    WEB3 --> |TCP| PG

    PG --> |Replication| PG_STANDBY[(PostgreSQL Standby)]

    WEB1 --> |TCP| REDIS[(Redis Cluster)]
    WEB2 --> |TCP| REDIS
    WEB3 --> |TCP| REDIS

    WEB1 --> |TCP| ES[(Elasticsearch)]
    WEB2 --> |TCP| ES
    WEB3 --> |TCP| ES

    SIDEKIQ1[Sidekiq 1] --> |TCP| REDIS
    SIDEKIQ2[Sidekiq 2] --> |TCP| REDIS
    SIDEKIQ3[Sidekiq 3] --> |TCP| REDIS

Kubernetes Deployment for Scale

# GitLab Helm values for production deployment
global:
  hosts:
    domain: gitlab.example.com
  edition: ce

  # High availability PostgreSQL
  psql:
    host: postgres.example.com
    port: 5432
    database: gitlab
    username: gitlab
    password:
      secret: gitlab-postgres-secret
      key: password

  # Redis cluster
  redis:
    host: redis-cluster.example.com
    port: 6379
    auth:
      enabled: true
      secret: gitlab-redis-secret
      key: password

  # Object storage
  minio:
    enabled: false
  appConfig:
    object_store:
      enabled: true
      connection:
        secret: gitlab-objectstore-secret
    artifacts:
      bucket: gitlab-artifacts
    uploads:
      bucket: gitlab-uploads
    packages:
      bucket: gitlab-packages
    backups:
      bucket: gitlab-backups

# GitLab application scaling
gitlab:
  webservice:
    replicaCount: 3
    resources:
      requests:
        cpu: 1
        memory: 2Gi
      limits:
        cpu: 2
        memory: 4Gi

  sidekiq:
    replicaCount: 3
    resources:
      requests:
        cpu: 500m
        memory: 1Gi
      limits:
        cpu: 1
        memory: 2Gi

# Gitaly cluster configuration
gitlab:
  gitaly:
    enabled: false

gitaly:
  enabled: true
  replicaCount: 3
  persistence:
    enabled: true
    size: 500Gi
    storageClass: ssd
  resources:
    requests:
      cpu: 1
      memory: 2Gi
    limits:
      cpu: 2
      memory: 4Gi

# Registry scaling
registry:
  enabled: true
  replicaCount: 2
  storage:
    secret: gitlab-registry-storage
  resources:
    requests:
      cpu: 200m
      memory: 256Mi
    limits:
      cpu: 500m
      memory: 512Mi

# Runner auto-scaling
gitlab-runner:
  replicas: 3
  concurrent: 30
  checkInterval: 3

  runners:
    config: |
      [[runners]]
        [runners.kubernetes]
          image = "ubuntu:20.04"
          privileged = true

          # Auto-scaling configuration
          request_concurrency = 10

          # Resource limits
          cpu_limit = "1"
          memory_limit = "2Gi"
          service_cpu_limit = "0.5"
          service_memory_limit = "512Mi"

Database Scaling and Optimization

-- PostgreSQL performance tuning queries
-- Find slow queries
SELECT
  query,
  calls,
  total_time,
  mean_time,
  rows
FROM pg_stat_statements
ORDER BY total_time DESC
LIMIT 10;

-- Index usage analysis
SELECT
  schemaname,
  tablename,
  attname,
  n_distinct,
  correlation
FROM pg_stats
WHERE schemaname = 'public';

-- Table sizes and bloat analysis
SELECT
  schemaname,
  tablename,
  pg_size_pretty(pg_total_relation_size(schemaname||'.'||tablename)) as size
FROM pg_tables
WHERE schemaname = 'public'
ORDER BY pg_total_relation_size(schemaname||'.'||tablename) DESC;

PostgreSQL configuration for GitLab:

# postgresql.conf optimizations for GitLab
shared_buffers = 8GB                    # 25% of total RAM
effective_cache_size = 24GB             # 75% of total RAM
work_mem = 64MB                         # For sorting operations
maintenance_work_mem = 2GB              # For VACUUM, CREATE INDEX
random_page_cost = 1.1                  # For SSD storage
effective_io_concurrency = 200          # For SSD storage

# Connection settings
max_connections = 500
shared_preload_libraries = 'pg_stat_statements'

# WAL settings
wal_buffers = 64MB
checkpoint_completion_target = 0.9
max_wal_size = 4GB
min_wal_size = 512MB

# Query planner
default_statistics_target = 1000

Migration Strategies

GitHub to GitLab Migration

Complete Migration Script

#!/bin/bash
# github-to-gitlab-migration.sh
# Complete migration script from GitHub to GitLab

set -e

# Configuration
GITHUB_ORG="your-github-org"
GITLAB_GROUP="your-gitlab-group"
GITHUB_TOKEN="your-github-token"
GITLAB_TOKEN="your-gitlab-token"
GITLAB_URL="https://gitlab.example.com"

echo "🚀 Starting GitHub to GitLab migration"

# Get list of repositories from GitHub
echo "📋 Fetching repositories from GitHub..."
REPOS=$(curl -s -H "Authorization: token $GITHUB_TOKEN" \
  "https://api.github.com/orgs/$GITHUB_ORG/repos?per_page=100&type=all" | \
  jq -r '.[].name')

for repo in $REPOS; do
  echo "🔄 Processing repository: $repo"

  # Create GitLab project
  echo "  📁 Creating GitLab project..."
  PROJECT_DATA=$(cat <<EOF
{
  "name": "$repo",
  "namespace_id": "$GITLAB_GROUP_ID",
  "description": "Migrated from GitHub",
  "visibility": "private",
  "issues_enabled": true,
  "merge_requests_enabled": true,
  "wiki_enabled": true,
  "snippets_enabled": true
}
EOF
)

  GITLAB_PROJECT_ID=$(curl -s -X POST \
    -H "Authorization: Bearer $GITLAB_TOKEN" \
    -H "Content-Type: application/json" \
    -d "$PROJECT_DATA" \
    "$GITLAB_URL/api/v4/projects" | jq -r '.id')

  # Clone from GitHub
  echo "  ⬇️ Cloning from GitHub..."
  git clone --mirror "https://$GITHUB_TOKEN@github.com/$GITHUB_ORG/$repo.git" "$repo.git"
  cd "$repo.git"

  # Push to GitLab
  echo "  ⬆️ Pushing to GitLab..."
  git remote set-url origin "$GITLAB_URL/$GITLAB_GROUP/$repo.git"
  git push --mirror origin
  cd ..
  rm -rf "$repo.git"

  # Migrate issues using GitLab import feature
  echo "  🐛 Importing issues..."
  curl -X POST \
    -H "Authorization: Bearer $GITLAB_TOKEN" \
    -H "Content-Type: application/json" \
    -d "{\"personal_access_token\": \"$GITHUB_TOKEN\"}" \
    "$GITLAB_URL/api/v4/projects/$GITLAB_PROJECT_ID/import/github"

  echo "  ✅ Repository $repo migrated successfully"
  sleep 2  # Rate limiting
done

echo "🎉 Migration completed!"

Migration Verification Script

#!/usr/bin/env python3
"""
GitLab migration verification script
Compares GitHub and GitLab repositories to ensure complete migration
"""

import requests
import json
import sys
from typing import Dict, List

class MigrationVerifier:
    def __init__(self, github_token: str, gitlab_token: str, gitlab_url: str):
        self.github_token = github_token
        self.gitlab_token = gitlab_token
        self.gitlab_url = gitlab_url
        self.github_headers = {"Authorization": f"token {github_token}"}
        self.gitlab_headers = {"Authorization": f"Bearer {gitlab_token}"}

    def get_github_repos(self, org: str) -> List[Dict]:
        """Get all repositories from GitHub organization."""
        url = f"https://api.github.com/orgs/{org}/repos"
        response = requests.get(url, headers=self.github_headers)
        response.raise_for_status()
        return response.json()

    def get_gitlab_projects(self, group_id: int) -> List[Dict]:
        """Get all projects from GitLab group."""
        url = f"{self.gitlab_url}/api/v4/groups/{group_id}/projects"
        response = requests.get(url, headers=self.gitlab_headers)
        response.raise_for_status()
        return response.json()

    def compare_repository(self, github_repo: str, gitlab_project_id: int) -> Dict:
        """Compare a GitHub repository with GitLab project."""
        results = {
            "repository": github_repo,
            "status": "success",
            "issues": []
        }

        # Get GitHub repository details
        gh_url = f"https://api.github.com/repos/{github_repo}"
        gh_response = requests.get(gh_url, headers=self.github_headers)
        gh_data = gh_response.json()

        # Get GitLab project details
        gl_url = f"{self.gitlab_url}/api/v4/projects/{gitlab_project_id}"
        gl_response = requests.get(gl_url, headers=self.gitlab_headers)
        gl_data = gl_response.json()

        # Compare branches
        gh_branches = self._get_github_branches(github_repo)
        gl_branches = self._get_gitlab_branches(gitlab_project_id)

        if len(gh_branches) != len(gl_branches):
            results["issues"].append(
                f"Branch count mismatch: GitHub {len(gh_branches)}, GitLab {len(gl_branches)}"
            )

        # Compare tags
        gh_tags = self._get_github_tags(github_repo)
        gl_tags = self._get_gitlab_tags(gitlab_project_id)

        if len(gh_tags) != len(gl_tags):
            results["issues"].append(
                f"Tag count mismatch: GitHub {len(gh_tags)}, GitLab {len(gl_tags)}"
            )

        # Compare issues
        gh_issues = self._get_github_issues(github_repo)
        gl_issues = self._get_gitlab_issues(gitlab_project_id)

        if len(gh_issues) != len(gl_issues):
            results["issues"].append(
                f"Issue count mismatch: GitHub {len(gh_issues)}, GitLab {len(gl_issues)}"
            )

        if results["issues"]:
            results["status"] = "warning"

        return results

    def _get_github_branches(self, repo: str) -> List[Dict]:
        """Get branches from GitHub repository."""
        url = f"https://api.github.com/repos/{repo}/branches"
        response = requests.get(url, headers=self.github_headers)
        return response.json() if response.status_code == 200 else []

    def _get_gitlab_branches(self, project_id: int) -> List[Dict]:
        """Get branches from GitLab project."""
        url = f"{self.gitlab_url}/api/v4/projects/{project_id}/repository/branches"
        response = requests.get(url, headers=self.gitlab_headers)
        return response.json() if response.status_code == 200 else []

    def _get_github_tags(self, repo: str) -> List[Dict]:
        """Get tags from GitHub repository."""
        url = f"https://api.github.com/repos/{repo}/tags"
        response = requests.get(url, headers=self.github_headers)
        return response.json() if response.status_code == 200 else []

    def _get_gitlab_tags(self, project_id: int) -> List[Dict]:
        """Get tags from GitLab project."""
        url = f"{self.gitlab_url}/api/v4/projects/{project_id}/repository/tags"
        response = requests.get(url, headers=self.gitlab_headers)
        return response.json() if response.status_code == 200 else []

    def _get_github_issues(self, repo: str) -> List[Dict]:
        """Get issues from GitHub repository."""
        url = f"https://api.github.com/repos/{repo}/issues"
        response = requests.get(url, headers=self.github_headers,
                              params={"state": "all", "per_page": 100})
        return response.json() if response.status_code == 200 else []

    def _get_gitlab_issues(self, project_id: int) -> List[Dict]:
        """Get issues from GitLab project."""
        url = f"{self.gitlab_url}/api/v4/projects/{project_id}/issues"
        response = requests.get(url, headers=self.gitlab_headers,
                              params={"state": "all", "per_page": 100})
        return response.json() if response.status_code == 200 else []

def main():
    verifier = MigrationVerifier(
        github_token="your-github-token",
        gitlab_token="your-gitlab-token",
        gitlab_url="https://gitlab.example.com"
    )

    # Define repositories to verify
    repositories = [
        {"github": "your-org/repo1", "gitlab_project_id": 123},
        {"github": "your-org/repo2", "gitlab_project_id": 124},
    ]

    print("🔍 Starting migration verification...")

    all_results = []
    for repo_config in repositories:
        result = verifier.compare_repository(
            repo_config["github"],
            repo_config["gitlab_project_id"]
        )
        all_results.append(result)

        status_emoji = "✅" if result["status"] == "success" else "⚠️"
        print(f"{status_emoji} {result['repository']}: {result['status']}")

        for issue in result["issues"]:
            print(f"   - {issue}")

    # Generate summary report
    success_count = sum(1 for r in all_results if r["status"] == "success")
    warning_count = len(all_results) - success_count

    print(f"\n📊 Migration Verification Summary:")
    print(f"   ✅ Successful: {success_count}")
    print(f"   ⚠️  With warnings: {warning_count}")
    print(f"   📊 Total verified: {len(all_results)}")

    # Exit with appropriate code
    sys.exit(0 if warning_count == 0 else 1)

if __name__ == "__main__":
    main()

Legacy System Integration

Subversion to GitLab Migration

#!/bin/bash
# svn-to-gitlab-migration.sh

set -e

SVN_REPO_URL="https://svn.example.com/repo"
GITLAB_PROJECT_NAME="migrated-project"
GITLAB_GROUP="legacy-projects"

echo "🔄 Starting SVN to GitLab migration"

# Create authors file for SVN
echo "📝 Creating authors mapping..."
cat > authors.txt << EOF
svn-user1 = John Doe <[email protected]>
svn-user2 = Jane Smith <[email protected]>
(no author) = Legacy User <[email protected]>
EOF

# Clone SVN repository with full history
echo "⬇️ Cloning SVN repository..."
git svn clone "$SVN_REPO_URL" \
  --authors-file=authors.txt \
  --no-metadata \
  --trunk=trunk \
  --branches=branches \
  --tags=tags \
  "$GITLAB_PROJECT_NAME"

cd "$GITLAB_PROJECT_NAME"

# Convert SVN tags to Git tags
echo "🏷️ Converting SVN tags to Git tags..."
for tag in $(git branch -r | grep "tags/" | sed 's/.*tags\///'); do
  git tag "$tag" "refs/remotes/tags/$tag"
  git branch -D -r "tags/$tag"
done

# Convert SVN branches to Git branches
echo "🌿 Converting SVN branches..."
for branch in $(git branch -r | grep -v tags/ | grep -v trunk | sed 's/.*origin\///'); do
  git checkout -b "$branch" "refs/remotes/$branch"
done

# Checkout main branch
git checkout master
git branch -m master main

# Clean up remote references
git remote rm origin 2>/dev/null || true

# Add GitLab remote and push
echo "⬆️ Pushing to GitLab..."
git remote add origin "$GITLAB_URL/$GITLAB_GROUP/$GITLAB_PROJECT_NAME.git"
git push -u origin --all
git push origin --tags

echo "✅ SVN migration completed successfully"

Incremental Migration Strategies

Phased Migration Approach

# .gitlab-ci.yml for phased migration
stages:
  - validate
  - migrate
  - verify
  - cleanup

variables:
  MIGRATION_PHASE: "1" # Can be 1, 2, or 3

# Phase 1: Critical repositories
migrate_phase_1:
  stage: migrate
  script:
    - |
      if [ "$MIGRATION_PHASE" == "1" ]; then
        echo "🚀 Starting Phase 1: Critical repositories"
        ./scripts/migrate-critical-repos.sh
      fi
  only:
    variables:
      - $MIGRATION_PHASE == "1"

# Phase 2: Development repositories
migrate_phase_2:
  stage: migrate
  script:
    - |
      if [ "$MIGRATION_PHASE" == "2" ]; then
        echo "🚀 Starting Phase 2: Development repositories"
        ./scripts/migrate-dev-repos.sh
      fi
  only:
    variables:
      - $MIGRATION_PHASE == "2"

# Phase 3: Archive repositories
migrate_phase_3:
  stage: migrate
  script:
    - |
      if [ "$MIGRATION_PHASE" == "3" ]; then
        echo "🚀 Starting Phase 3: Archive repositories"
        ./scripts/migrate-archive-repos.sh
      fi
  only:
    variables:
      - $MIGRATION_PHASE == "3"

# Validation after each phase
validate_migration:
  stage: verify
  script:
    - ./scripts/validate-migration.py --phase $MIGRATION_PHASE
  artifacts:
    reports:
      junit: migration-validation-report.xml
    paths:
      - migration-report.html

Best Practices & Real-World Examples

Enterprise Implementation Case Study

Fortune 500 Company Migration

Company Profile:

• 5,000+ developers across 50 teams
• 2,000+ repositories
• Multiple compliance requirements (SOX, HIPAA, PCI-DSS)
• Global development across 12 time zones

Implementation Strategy:

# Enterprise GitLab configuration structure
# .gitlab/
# ├── ci/
# │   ├── templates/
# │   │   ├── security.yml
# │   │   ├── compliance.yml
# │   │   └── deployment.yml
# │   └── rules/
# │       ├── branch-protection.yml
# │       └── approval-rules.yml
# ├── templates/
# │   ├── issues/
# │   └── merge_requests/
# └── policies/
#     ├── security-policy.yml
#     └── compliance-policy.yml

Security Template (.gitlab/ci/templates/security.yml):

# Enterprise security pipeline template
.security_template:
  rules:
    - if: "$CI_MERGE_REQUEST_IID"
    - if: "$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH"

# Multi-stage security scanning
include:
  - template: Security/SAST.gitlab-ci.yml
  - template: Security/DAST.gitlab-ci.yml
  - template: Security/Dependency-Scanning.gitlab-ci.yml
  - template: Security/Container-Scanning.gitlab-ci.yml
  - template: Security/Secret-Detection.gitlab-ci.yml

# Custom enterprise security job
enterprise_security_scan:
  extends: .security_template
  stage: security
  image: enterprise-security-scanner:latest
  script:
    - |
      # Custom security tools integration
      enterprise-scanner --format json --output security-report.json .

      # HIPAA compliance check
      hipaa-validator --config .hipaa-config.yml --output hipaa-report.xml

      # PCI-DSS scanning
      pci-scanner --level 1 --output pci-report.json

      # Upload results to enterprise security dashboard
      curl -X POST -H "Authorization: Bearer $SECURITY_DASHBOARD_TOKEN" \
           -F "[email protected]" \
           -F "project_id=$CI_PROJECT_ID" \
           "$ENTERPRISE_SECURITY_DASHBOARD_URL/api/v1/reports"
  artifacts:
    reports:
      sast: security-report.json
      junit: hipaa-report.xml
    expire_in: 30 days
  allow_failure: false

# Compliance validation
compliance_check:
  extends: .security_template
  stage: security
  script:
    - |
      # SOX compliance validation
      sox-validator --config .sox-config.yml

      # Data classification check
      data-classifier --scan-path . --output classification-report.json

      # Audit trail generation
      audit-generator --project-id $CI_PROJECT_ID --commit-sha $CI_COMMIT_SHA
  artifacts:
    paths:
      - classification-report.json
      - audit-trail.log
    expire_in: 7 years # SOX requirement

Multi-Team Workflow Implementation

# Team-specific workflow configuration
# Marketing team workflow
.marketing_workflow:
  rules:
    - if: '$CI_COMMIT_BRANCH =~ /^marketing\/.*/'

marketing_review:
  extends: .marketing_workflow
  stage: review
  script:
    - |
      # Content review with marketing tools
      content-validator --type marketing --path content/
      brand-compliance-checker --config .brand-config.yml
  only:
    - merge_requests

# Engineering team workflow
.engineering_workflow:
  rules:
    - if: '$CI_COMMIT_BRANCH =~ /^(feature|bugfix|hotfix)\/.*/'

code_quality:
  extends: .engineering_workflow
  stage: test
  script:
    - |
      # Engineering-specific quality gates
      code-complexity-analyzer --threshold 10
      architecture-validator --config .architecture-rules.yml
      performance-regression-test --baseline production

# DevOps team workflow
.devops_workflow:
  rules:
    - if: '$CI_COMMIT_BRANCH =~ /^(infrastructure|deployment)\/.*/'

infrastructure_validation:
  extends: .devops_workflow
  stage: test
  script:
    - |
      # Infrastructure as Code validation
      terraform validate
      terraform plan -out=tfplan
      checkov -f tfplan --framework terraform
      cost-estimator --plan tfplan --output cost-report.json

Development Team Workflow Examples

Agile Sprint Integration

#!/usr/bin/env python3
"""
GitLab Agile Sprint Integration
Automatically manages sprint workflows and reporting
"""

import requests
import json
from datetime import datetime, timedelta
from typing import List, Dict

class GitLabSprintManager:
    def __init__(self, gitlab_url: str, token: str, project_id: int):
        self.gitlab_url = gitlab_url
        self.token = token
        self.project_id = project_id
        self.headers = {"Authorization": f"Bearer {token}"}

    def create_sprint_milestone(self, sprint_name: str, duration_weeks: int = 2) -> int:
        """Create a new sprint milestone."""
        start_date = datetime.now().date()
        end_date = start_date + timedelta(weeks=duration_weeks)

        milestone_data = {
            "title": sprint_name,
            "description": f"Sprint from {start_date} to {end_date}",
            "due_date": end_date.isoformat(),
            "start_date": start_date.isoformat()
        }

        response = requests.post(
            f"{self.gitlab_url}/api/v4/projects/{self.project_id}/milestones",
            headers=self.headers,
            json=milestone_data
        )

        return response.json()["id"]

    def assign_issues_to_sprint(self, milestone_id: int, issue_ids: List[int]):
        """Assign issues to sprint milestone."""
        for issue_id in issue_ids:
            issue_data = {"milestone_id": milestone_id}
            requests.put(
                f"{self.gitlab_url}/api/v4/projects/{self.project_id}/issues/{issue_id}",
                headers=self.headers,
                json=issue_data
            )

    def generate_sprint_report(self, milestone_id: int) -> Dict:
        """Generate comprehensive sprint report."""
        # Get milestone details
        milestone = requests.get(
            f"{self.gitlab_url}/api/v4/projects/{self.project_id}/milestones/{milestone_id}",
            headers=self.headers
        ).json()

        # Get issues in milestone
        issues = requests.get(
            f"{self.gitlab_url}/api/v4/projects/{self.project_id}/issues",
            headers=self.headers,
            params={"milestone": milestone["title"], "per_page": 100}
        ).json()

        # Calculate sprint metrics
        total_issues = len(issues)
        closed_issues = len([i for i in issues if i["state"] == "closed"])
        open_issues = total_issues - closed_issues

        # Calculate story points (from issue labels)
        total_points = 0
        completed_points = 0

        for issue in issues:
            points = self._extract_story_points(issue["labels"])
            total_points += points
            if issue["state"] == "closed":
                completed_points += points

        return {
            "milestone": milestone["title"],
            "start_date": milestone.get("start_date"),
            "due_date": milestone.get("due_date"),
            "total_issues": total_issues,
            "closed_issues": closed_issues,
            "open_issues": open_issues,
            "completion_rate": (closed_issues / total_issues * 100) if total_issues > 0 else 0,
            "total_story_points": total_points,
            "completed_story_points": completed_points,
            "velocity": completed_points,
            "issues_by_assignee": self._group_issues_by_assignee(issues),
            "burndown_data": self._calculate_burndown(milestone_id)
        }

    def _extract_story_points(self, labels: List[str]) -> int:
        """Extract story points from issue labels."""
        for label in labels:
            if label.startswith("SP:"):
                try:
                    return int(label.split(":")[1])
                except ValueError:
                    continue
        return 0

    def _group_issues_by_assignee(self, issues: List[Dict]) -> Dict:
        """Group issues by assignee for team analysis."""
        assignee_data = {}

        for issue in issues:
            assignee = issue.get("assignee")
            if assignee:
                name = assignee["name"]
                if name not in assignee_data:
                    assignee_data[name] = {"total": 0, "closed": 0, "points": 0}

                assignee_data[name]["total"] += 1
                if issue["state"] == "closed":
                    assignee_data[name]["closed"] += 1

                assignee_data[name]["points"] += self._extract_story_points(issue["labels"])

        return assignee_data

    def _calculate_burndown(self, milestone_id: int) -> List[Dict]:
        """Calculate burndown chart data."""
        # This would typically query issue state changes over time
        # For simplicity, showing the structure
        return [
            {"date": "2025-08-01", "remaining_points": 50},
            {"date": "2025-08-02", "remaining_points": 45},
            {"date": "2025-08-03", "remaining_points": 40},
            # ... continue for sprint duration
        ]

# Example usage
def main():
    sprint_manager = GitLabSprintManager(
        gitlab_url="https://gitlab.example.com",
        token="your-token",
        project_id=123
    )

    # Create new sprint
    milestone_id = sprint_manager.create_sprint_milestone("Sprint 2025-32", duration_weeks=2)

    # Assign issues to sprint
    sprint_manager.assign_issues_to_sprint(milestone_id, [101, 102, 103, 104])

    # Generate report at sprint end
    report = sprint_manager.generate_sprint_report(milestone_id)

    print(f"📊 Sprint Report: {report['milestone']}")
    print(f"   Completion Rate: {report['completion_rate']:.1f}%")
    print(f"   Velocity: {report['velocity']} story points")
    print(f"   Issues: {report['closed_issues']}/{report['total_issues']} completed")

if __name__ == "__main__":
    main()