GitLab

Mentors: Student: Omar Nasser

Currently, devfile validation only occurs after the user submits the form to create a workspace. This means users only discover invalid devfiles after waiting for form submission. Implement just-in-time (JIT) validation for devfiles in the workspace creation form: When a user selects a devfile from the dropdown, validate it immediately in the background, Display a visual indicator (icon/label) next to the selected devfile showing its validity status, Provide clear, actionable error messages for invalid devfiles before form submission

Mentors: Student: Pratibha Gupta

This project is a notification system that alerts its users before their deploy tokens expire. Deploy tokens are used to provide secure access to repositories and container registries, independent of a user account. Due to this reason, they are used in CI/CD pipelines, automation scripts, and third-party integrations. Some of these tokens are configured to have an expiry date at the time of creation. Currently, GitLab lacks an automated way to notify users about tokens that are about to expire. This can lead to last-minute troubleshooting and potential downtimes. To address this, we can integrate a notification system that notifies the project owners, group owners and admins at different intervals [14, 7, 1] days through email notifications and webhooks. This will ensure timely renewals of the token and avoid unexpected failures.

Mentors: Student: Sahil Sarawagi

This project aims to improve GitLab’s policy system by developing a custom RuboCop rule that detects and prevents incorrect usage of scope declarations (such as `scope: :subject`) in conditions where both `user` and `subject` are accessed. Improper scope usage can lead to overly broad caching and security bugs. By automating detection, this rule helps ensure more robust and reliable authorization logic within GitLab's codebase.

Mentors: Student: Patrick He

GitLab's security features help developers find vulnerabilities in their code, but the current API doesn't expose all the important information that security teams need. For example, users can't easily access details about when vulnerabilities were first discovered, who authored the related commits, or which pipelines detected the issues. This makes it difficult for teams to automate their security workflows and track vulnerability trends over time.

Mentors: Student: Ahmed Kashkoush

This project aims to implement essential Git operations in GitLab's Web IDE, eliminating inefficient repository cloning for common version control tasks. The project will add commit amend, force push, stash, and rebase functionality. Implementation will proceed methodically, beginning with features requiring no backend changes before addressing REST API modifications. These enhancements will significantly improve developer productivity by enabling complete Git workflows within the browser, bringing Web IDE capabilities closer to VS-Code source control.