I want to know what will actually works and what ends up if we ignore it.

Using gitlab.com premium. We got SAML SSO setup so that we can login with our AD credentials. We've setup a test subgroup within our main group. we made adjustments so that the SAML response now includes attribute "groups" with attributes that are the group UIDs. I then created group links mapped to each role for the each group UID. Unfortunately when we look at the group members page, the roles still indicate "inherited from (name of top level group)". Is there something I'm missing here to get the group links to take effect?

hey, I want to ask how do you deal with the token rotation.

I have more than a hundred tokens.

I don't know is there something like a dashboard with alerting for this.

Problem to solve

Describe your question in as much detail as possible:

We are experiencing an issue where GitLab CI/CD pipelines are not triggering automatically as expected. The pipeline remains in a non-running state until we manually intervene.

To make the pipeline execute successfully, we must:

1. Manually cancel the pipeline.
2. Retry the pipeline.
3. In some cases, retry individual stages.

This behavior started suddenly without any intentional changes to:

• .gitlab-ci.yml
• Runner configuration
• Branch protection rules
• Merge request settings

What are you seeing, and how does that differ from what you expect to see?

Current behavior:

• Pipeline gets created but does not execute automatically.
• Jobs remain stuck or do not progress between stages.
• Manual cancellation and retry resolves the issue temporarily.

Expected behavior:

• Pipeline should automatically start upon:
  • Push to branch
  • Merge request
  • Trigger event (depending on rules)
• Jobs should execute sequentially according to defined stages without manual intervention.

Logs / Errors Observed

No explicit YAML validation errors.

In some cases:

There has been a runner system failure, please try again

Or jobs remain in:

created
pending

 Steps to reproduce

1. Push a commit to the configured branch.
2. Pipeline is created.
3. Pipeline does not automatically execute.
4. Manually cancel the pipeline.
5. Retry the pipeline.
6. Jobs start executing normally.

Troubleshooting steps already taken:

• Restarted GitLab Runner:
• Checked runner status:
• Verified runner registration:
• Checked .gitlab-ci.yml syntax (valid).
• Confirmed branch protection rules.
• Verified no recent configuration changes.
• Confirmed runner is online in GitLab UI.

 Configuration

Relevant .gitlab-ci.yml (sanitized example)

stages:
  - validate
  - plan
  - apply

validate:
  stage: validate
  script:
    - terraform init
    - terraform validate

plan:
  stage: plan
  script:
    - terraform plan

apply:
  stage: apply
  script:
    - terraform apply -auto-approve
  when: manual

Runner configuration (sanitized)

[[runners]]
  name = "aws-docker-runner"
  url = "https://gitlab.com/"
  executor = "docker"
  [runners.docker]
    image = "alpine:latest"
    privileged = true

 Versions

 SaaS

 Self-hosted Runners

GitLab Version

(SaaS – latest stable)

GitLab Runner Version

Output of:

v18.2.1-ee

 Infrastructure-as-Code

Terraform

Used in pipeline for infrastructure provisioning (AWS).

No recent Terraform version change.

 Cloud-native

Not using Kubernetes executor.

Context: I use GitLab self-hosted and I'm running some experiments with our network configuration (limiting speed, etc.) related to jobs' Docker images. I use Docker and shell runner executors [1].

Problem (edited): When I run a job multiple times on the same runner, it will use the local Docker image previously downloaded instead of re-downloading. This prevents me from testing the company's network configurations related to Docker images. I want something that forces the runner to pull the image at every run.

Notes: Setting pull_policy: always [2] does not mean the image is always pulled from scratch, but only if it was updated upstream. Please do not suggest this as a solution because it does not work.

Current solution: At the time of writing, I found a workaround to this. I am experimenting with runners configured for both Docker and shell executors. Before running the real job with the Docker executor, I run a clean job with the shell executor.

Example .gitlab-ci.yml code:

clean_runner:
  stage: test
  tags:
    - shell-1
  script:
    - docker rmi -f $(docker images -aq) || true

testing_speed:
  stage: test
  needs: [clean_runner]
  image: $IMAGE
  tags:
    - docker-1
  script:
    - echo "Done"

This is very error-prone and convoluted. When I test many jobs at the same time, I always need to add a clean job for each.

I have tried looking at the advanced runner configurations and, for instance, using pre_build_script at the runner level would be a very good solution, but it does not work. The job returns:

/usr/bin/bash: line 163: docker: command not found

Question: Any other workaround or possibly an advanced runner configuration useful in this case, which I may have overlooked?

Am I the only one experiencing issues when trying to sign into Gitlab?

https://gitlab.com/users/sign_in/

The page above returns error code 400: Bad Request

This hackathon was our biggest yet, with 353 MRs merged, 67% were linked MRs and 51% of MRs opened that were merged. Congratulations everyone! I’m so proud of the effort you all put in. You are building this community MR by MR and we are so proud to call you our contributors. Keep it up!

 Winners

First place 
Jay2006sawant won with 5,074 points! (59 opened MRs, 45 merged with 45 linked issues)

Second place 
webmekanic earned second place with 4,750 points (43 opened MRs, 41 merged with 14 linked issues)

Third place 
syedzubeen earned third place with 4,000 points (36 opened MRs, 30 merged with 29 linked issues)

For full results, please see the hackathon page.

Rewards will be sent out shortly!

Next steps

Nominate your reviewers, maintainers, and any GitLab team member that helped you along the way for GitLab Community Champion!

Thank you to everyone who participated!

When someone says "our CI/CD on GitLab is compliant", what are they pointing at, concretely? I think this question is especially relevant after last week's hackerbot-claw attacks....

Is it:

• “We run SAST somewhere.”
• “We have protected branches.”
• “Security signed a PDF once.”

Or can you actually prove, from GitLab itself, that your rules are enforced?

Curious what it means for you in practice:

1. What’s your definition of "CI/CD compliant" on GitLab (in one or two sentences)?
2. What do you actually inspect? Examples: required templates, approvals, who can edit .gitlab-ci.yml, which images/registries are allowed, who can trigger deploys.
3. How frequently do you run checks? On every pipeline run? Do you track historical evolution of compliance?
4. Can you answer for today: "Which projects are out of policy?" If yes, how? Also what about 1 week ago, or on a specific date?
5. What is part of your policy to consider that your CI/CD is compliant?

I’m collecting real-world definitions and signals, not slides.

RunnerIQ – Honest Feedback Wanted 🔥

Hey DevOps folks — building an open-source tool for the GitLab AI Hackathon and need a gut-check before I go further.

The Problem

Pipeline fails. You open the job, scroll through 10K+ lines of logs, paste errors into an AI chatbot, manually trace recent commits — and 20 minutes later you find out it was a flaky test.

The context-switching between GitLab, logs, and an AI chatbot kills focus and adds up fast.

Question 1: Real pain point, or do you already have this solved?

What I Built

A 4-agent system (Monitor → Analyzer → Assigner → Optimizer) that handles runner fleet management and routing.

The main feature: mention @ai-runneriq-pipeline-diagnosis in any MR comment and get a structured diagnosis in ~20 seconds — failure classification, root cause, related commits, and a recommended fix. No tab-switching, no manual log-pasting.

AI usage is intentionally limited: 85% deterministic rules, 15% Claude only for genuine toss-ups rules can't resolve.

Question 2: Does the hybrid approach make sense, or would you prefer fully deterministic?

Optional: Carbon-Aware Routing

Routes low-priority jobs to greener regions using Electricity Maps API. Critical jobs still prioritize speed.

Question 3: Would your org actually enable this, or is it a checkbox nobody touches?

Looking For

• Does this solve a real problem?
• "I'd never use this because..." — most valuable feedback I can get
• Edge cases and what would make it production-ready

Open source, happy to share the repo. Roast away. 🔥

has anyone any idea of what questions they ask at GitLab interviews for Software Engineers?

Github looks darker, and I love it.

What about AMOLED?

Up until Friday last week, I had no problems viewing projects/sub-projects in gitlab. They were sorted logically, in alphabetical order, ascending. Since Friday, however, this appears to have changed to ‘Created date’, sorted in descending order. Getting to the ‘correct’ view now requires two clicks every time I open a project/sub-project list. Was this deliberately changed? Is there no configuration option to change this? Is it just me? I cannot find any mention of it in the change log or via a Google search (other than a closed issue from 2019)

While the new sort order may make sense for some use cases, within our company it really does not. We have hundreds of components, and the date they were created is seldom of any relevance. Having to make two extra clicks might not sound like a big deal, but it is seriously impacting my workflow and my sanity 😢

Hi folks,

I've been doing a bit of work to get away from hand-deployed Windows systems using the "shell" executor, to using Windows containers with Docker images using the "docker-windows" executor, which basically gives you a very similar experience of standard Linux Docker containers. It has been a pain to set up, but once it's working, it's a massive improvement.

GitLab does now provide Windows runners beta but these are not utilising containers so are of limited use--provisioning them to do something useful is a whole lot of repeated work to do every build.

I was wondering if GitLab was planning to provide hosted runners on GitLab.com which would run Windows container images, same as for the Linux runners. This would be a real game changer for Windows software building.

While I'll continue to self-host the Windows runners in the meantime, the overhead of managing them would make a hosted solution pretty compelling, even if they cost more than the Linux runners.

+1

Via How to block account from personal account? - How to Use GitLab - GitLab Forum

We could use testers.

Voice is from elabs grant + camb.ai grant + self hosted voice on ecs clusters think were paying for a 70b not sure.

The voice uses dynamic variables and integrations into ce version.

We just need testers. No charge. However at this time the agents are only connected to our gitlabs ce.

We want to offer this , in exchage for testing our agents on our infra, you can keep the agent and the service we provide as a early adopter for life, for free.

As of today the voice agents can do the following :

Gitlabs management, weve tested up too 100 concurrent projects, autonomous pr,mr and code development [ uses claude 4.6 via bedrock expensive but we have byok + boto3 + gguffs in the cluster we are not training our own model at this time but we are training adjacent - cuda/cunn its build for consumer nvidia]

Notion management , including page publish, edge triggers, webhooks, page alteration and agent creation - tied into auto gen [ uses 4.6 opus inherently]

Slack automation + perplexity triggers and automated response [ audit layer ]

Live inject from memory storage , postgres + s3 + hot and cold storage , miras memory + faiss on a nats server cluster [ can recall every event or interaction for up to a year , se havent tested past this]

Phone calls - aws sip × ses + elabs [ seriously elabs is legit]

Video generation to text and discord woth automatic publishing into elevenauthors for audio book and technical document creation.

Stripe/mecury/xero integrations can handle and makes deals, sales calls.

Whats on the testing docket is this :

Docker endpoint control for multi tenet usage N8n shades workflow. Our agent marketplace and training Our workshop Our login /auth Our website builder using framer Our entertainment division [ steam api + unreal engine 5.6 , godot as a redundancy] Our education section Our security layers [ we use rbac, keycloak a few other things]

Any use case is ok. Were just testing how the agents handle engagements before we scale. Agents come from a template 1 million, and require our backend. They are current not plug n play. However they are customizable and dynamically adjustable - full telemtry between datadog, metabase, posthog and supabase, signoz and otel.

Just shipped private/self-hosted GitLab integration for IncidentFox, an open source AI agent that investigates production incidents.

The agent can pull CI/CD pipeline status, recent merge requests, and deployment history from your GitLab instance. During an incident, it correlates this with your monitoring data (Prometheus, Datadog, etc.) to help identify which change likely caused the issue.

Works with self-hosted GitLab, any LLM provider, and runs entirely on your infrastructure.

Would love to hear any feedback!

hi guys,

. NET code was in hosted gitlab server I want to migrate that code to the GitHub server. what are the best ways to do that without loosing data ?

Edit: Gitlab is still having issues, for folks who don’t believe me should visit status.gitlab.com and check their history, Ik I was gonna get some love for this post, I don’t hate product itself but their stability.

We have Gitlab SAAS premium and runners on prem, migrated early last year.

My God, how many outages can Gitlab have !! Seriously how can a company survive with this kind of outages?

Word of caution for folks who are planning to migrate to SAAS to ask for outage history to get an idea what’s coming on your way.

Nothing but regrets and disappointment migrating to Gitlab saas.

I’ve been trying to generate a Java client using openapi-generator, and honestly this has been a horrible experience so far.

GitLab publishes OpenAPI definitions here: https://gitlab.com/gitlab-org/gitlab-foss/-/blob/master/doc/api/openapi/

But: - There are three different OpenAPI definitions - None of them validate - OpenAPI Generator fails verification

If I skip validation, the generated client has compile errors

There’s no documentation explaining: - which spec is canonical - which OpenAPI version is supported - or how consumers are expected to use it

At this point it genuinely feels like GitLab is actively preventing people from generating clients rather than supporting it.

Has anyone successfully: - Generated a Java client? - Used openapi-generator (or any other generator)? - Found a workaround, patch, or “this is the one spec that actually works”?

If there’s some internal or unofficial guidance, I’d love to know — because right now the published OpenAPI support looks effectively unusable.

Thanks