We Switched from GitHub to GitLab for Internal Developer Platform and Cut Onboarding Time by 30%

# .gitlab-ci.yml
# GitLab CI pipeline for user-auth microservice (Node.js 20.x)
# Replaces previous GitHub Actions workflow with 40% faster execution
# Includes error handling, caching, security scans, and deployment to GKE

image: node:20-alpine

# Global variables
variables:
  NODE_ENV: "ci"
  REGISTRY: "$CI_REGISTRY/gitlab-org/internal/user-auth"
  KUBE_NAMESPACE: "prod-user-auth"
  CACHE_KEY: "${CI_COMMIT_REF_SLUG}-${CI_COMMIT_SHA}"

# Cache node_modules and build artifacts
cache:
  key: $CACHE_KEY
  paths:
    - node_modules/
    - dist/
    - .npm/

# Stages: build → test → scan → deploy
stages:
  - build
  - test
  - security
  - deploy

# Build stage: install dependencies, compile TypeScript
build_app:
  stage: build
  script:
    - echo "Starting build for commit $CI_COMMIT_SHA"
    - npm ci --cache .npm --prefer-offline || { echo "npm ci failed"; exit 1; }
    - npm run build || { echo "TypeScript compilation failed"; exit 1; }
    - echo "Build completed successfully"
  artifacts:
    paths:
      - dist/
      - node_modules/
    expire_in: 1 day
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH == "main"

# Test stage: unit, integration, e2e tests
unit_tests:
  stage: test
  script:
    - echo "Running unit tests"
    - npm run test:unit -- --coverage || { echo "Unit tests failed"; exit 1; }
    - echo "Unit tests passed: coverage at $(cat coverage/coverage-summary.json | jq '.total.lines.pct')%"
  artifacts:
    reports:
      coverage_report:
        coverage_format: cobertura
        path: coverage/cobertura-coverage.xml
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"

integration_tests:
  stage: test
  script:
    - echo "Starting integration tests with PostgreSQL"
    - docker run -d --name postgres -e POSTGRES_PASSWORD=test -p 5432:5432 postgres:16-alpine
    - sleep 5 # Wait for Postgres to start
    - npm run test:integration || { echo "Integration tests failed"; exit 1; }
    - docker stop postgres && docker rm postgres
  needs:
    - build_app
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"

# Security stage: SAST, dependency scanning
sast_scan:
  stage: security
  script:
    - echo "Running GitLab SAST scan"
    - gitlab-sast --output sast-report.json || { echo "SAST scan failed"; exit 1; }
    - if [ $(cat sast-report.json | jq '.vulnerabilities | length') -gt 0 ]; then echo "Critical vulnerabilities found"; exit 1; fi
  artifacts:
    reports:
      sast: sast-report.json
  rules:
    - if: $CI_COMMIT_BRANCH == "main"

dependency_scan:
  stage: security
  script:
    - echo "Running dependency scan"
    - npm audit --json > audit-report.json || true
    - if [ $(cat audit-report.json | jq '.vulnerabilities | length') -gt 2 ]; then echo "More than 2 dependency vulnerabilities found"; exit 1; fi
  artifacts:
    paths:
      - audit-report.json
  rules:
    - if: $CI_COMMIT_BRANCH == "main"

# Deploy stage: deploy to GKE production
deploy_prod:
  stage: deploy
  image: google/cloud-sdk:alpine
  script:
    - echo "Deploying to GKE namespace $KUBE_NAMESPACE"
    - echo $GKE_SERVICE_ACCOUNT_KEY > /tmp/gke-key.json
    - gcloud auth activate-service-account --key-file /tmp/gke-key.json
    - gcloud config set project $GCP_PROJECT_ID
    - gcloud container clusters get-credentials $GKE_CLUSTER --zone $GKE_ZONE
    - kubectl set image deployment/user-auth user-auth=$REGISTRY:$CI_COMMIT_SHA -n $KUBE_NAMESPACE
    - kubectl rollout status deployment/user-auth -n $KUBE_NAMESPACE --timeout=300s || { echo "Deployment failed"; exit 1; }
    - echo "Deployment to production completed"
  environment:
    name: production
    url: https://auth.internal.example.com
  rules:
    - if: $CI_COMMIT_BRANCH == "main"
  when: manual

# migrate_github_to_gitlab.py
# Python 3.11 script to migrate 142 GitHub repositories to GitLab with full audit logging
# Uses GitHub API v3 and GitLab API v4, handles rate limiting, and validates migrations
# Requires: requests, python-dotenv, gitpython

import os
import time
import json
import logging
from typing import Dict, List, Optional
from dotenv import load_dotenv
import requests
from git import Repo, GitCommandError

# Load environment variables from .env file
load_dotenv()

# Configure logging
logging.basicConfig(
    level=logging.INFO,
    format="%(asctime)s - %(levelname)s - %(message)s",
    handlers=[logging.FileHandler("migration_audit.log"), logging.StreamHandler()]
)
logger = logging.getLogger(__name__)

# API clients configuration
GITHUB_TOKEN = os.getenv("GITHUB_TOKEN")
GITLAB_TOKEN = os.getenv("GITLAB_TOKEN")
GITHUB_ORG = os.getenv("GITHUB_ORG", "example-org")
GITLAB_GROUP_ID = os.getenv("GITLAB_GROUP_ID", "123")
GITHUB_API_BASE = "https://api.github.com"
GITLAB_API_BASE = "https://gitlab.com/api/v4"

# Validate environment variables
if not all([GITHUB_TOKEN, GITLAB_TOKEN]):
    logger.error("Missing required environment variables: GITHUB_TOKEN, GITLAB_TOKEN")
    exit(1)

# Headers for API requests
github_headers = {
    "Authorization": f"token {GITHUB_TOKEN}",
    "Accept": "application/vnd.github.v3+json"
}
gitlab_headers = {
    "Authorization": f"Bearer {GITLAB_TOKEN}",
    "Content-Type": "application/json"
}

def handle_rate_limiting(response: requests.Response, platform: str) -> None:
    """Handle rate limiting for GitHub and GitLab APIs"""
    if response.status_code == 429:
        retry_after = int(response.headers.get("Retry-After", 60))
        logger.warning(f"{platform} rate limit hit. Retrying after {retry_after} seconds")
        time.sleep(retry_after)
        return True
    return False

def get_github_repos() -> List[Dict]:
    """Fetch all repositories from GitHub organization"""
    repos = []
    page = 1
    while True:
        url = f"{GITHUB_API_BASE}/orgs/{GITHUB_ORG}/repos?page={page}&per_page=100"
        response = requests.get(url, headers=github_headers)
        if handle_rate_limiting(response, "GitHub"):
            continue
        if response.status_code != 200:
            logger.error(f"Failed to fetch GitHub repos: {response.status_code} {response.text}")
            exit(1)
        page_repos = response.json()
        if not page_repos:
            break
        repos.extend(page_repos)
        page += 1
        time.sleep(1) # Respect rate limits
    logger.info(f"Fetched {len(repos)} repositories from GitHub org {GITHUB_ORG}")
    return repos

def create_gitlab_project(repo_name: str, description: str) -> Optional[int]:
    """Create a new project in GitLab group"""
    url = f"{GITLAB_API_BASE}/projects"
    payload = {
        "name": repo_name,
        "namespace_id": GITLAB_GROUP_ID,
        "description": description,
        "visibility": "private",
        "initialize_with_readme": False
    }
    response = requests.post(url, headers=gitlab_headers, json=payload)
    if handle_rate_limiting(response, "GitLab"):
        return create_gitlab_project(repo_name, description)
    if response.status_code == 201:
        project_id = response.json()["id"]
        logger.info(f"Created GitLab project {repo_name} with ID {project_id}")
        return project_id
    elif response.status_code == 400 and "already exists" in response.text.lower():
        # Project already exists, fetch ID
        existing = requests.get(f"{GITLAB_API_BASE}/groups/{GITLAB_GROUP_ID}/projects?search={repo_name}", headers=gitlab_headers)
        if existing.status_code == 200:
            for proj in existing.json():
                if proj["name"] == repo_name:
                    logger.info(f"GitLab project {repo_name} already exists with ID {proj['id']}")
                    return proj["id"]
    logger.error(f"Failed to create GitLab project {repo_name}: {response.status_code} {response.text}")
    return None

def migrate_repo(repo: Dict) -> bool:
    """Migrate a single GitHub repository to GitLab"""
    repo_name = repo["name"]
    repo_url = repo["clone_url"].replace("https://", f"https://{GITHUB_TOKEN}@")
    gitlab_project_id = create_gitlab_project(repo_name, repo.get("description", ""))
    if not gitlab_project_id:
        return False
    gitlab_project_url = f"https://gitlab.com/group/{repo_name}.git".replace("https://", f"https://oauth2:{GITLAB_TOKEN}@")

    try:
        # Clone GitHub repo
        logger.info(f"Cloning {repo_name} from GitHub")
        repo_path = f"/tmp/{repo_name}"
        if os.path.exists(repo_path):
            Repo(repo_path).remote().update()
        else:
            Repo.clone_from(repo_url, repo_path)

        # Push to GitLab
        logger.info(f"Pushing {repo_name} to GitLab")
        git_repo = Repo(repo_path)
        git_repo.create_remote("gitlab", gitlab_project_url)
        git_repo.remote("gitlab").push(refspec="refs/heads/*:refs/heads/*", force=True)
        git_repo.remote("gitlab").push(refspec="refs/tags/*:refs/tags/*", force=True)

        logger.info(f"Successfully migrated {repo_name}")
        return True
    except GitCommandError as e:
        logger.error(f"Git error migrating {repo_name}: {str(e)}")
        return False
    except Exception as e:
        logger.error(f"Unexpected error migrating {repo_name}: {str(e)}")
        return False

if __name__ == "__main__":
    logger.info("Starting GitHub to GitLab migration")
    github_repos = get_github_repos()
    successful = 0
    failed = 0
    for repo in github_repos:
        if migrate_repo(repo):
            successful += 1
        else:
            failed += 1
        time.sleep(2) # Avoid rate limits
    logger.info(f"Migration completed: {successful} successful, {failed} failed")

// gitlab-onboarding-webhook.js
// Node.js 20.x Express server to handle GitLab webhooks for automated engineer onboarding
// Triggers when a new user is added to the GitLab group, provisions access, and sends Slack notifications
// Uses GitLab API v4, Slack API, and PostgreSQL for audit logs

const express = require("express");
const bodyParser = require("body-parser");
const { WebClient } = require("@slack/web-api");
const { Pool } = require("pg");
const axios = require("axios");
require("dotenv").config();

const app = express();
const PORT = process.env.PORT || 3000;

// Middleware to parse JSON bodies
app.use(bodyParser.json());

// Configure clients
const slackClient = new WebClient(process.env.SLACK_BOT_TOKEN);
const gitlabHeaders = {
  "Authorization": `Bearer ${process.env.GITLAB_TOKEN}`,
  "Content-Type": "application/json"
};
const GITLAB_GROUP_ID = process.env.GITLAB_GROUP_ID;
const ONBOARDING_TEMPLATE_PROJECT_ID = process.env.ONBOARDING_TEMPLATE_PROJECT_ID;

// PostgreSQL pool for audit logs
const pool = new Pool({
  host: process.env.POSTGRES_HOST,
  port: process.env.POSTGRES_PORT,
  database: process.env.POSTGRES_DB,
  user: process.env.POSTGRES_USER,
  password: process.env.POSTGRES_PASSWORD,
});

// Validate required environment variables
const requiredEnvVars = [
  "SLACK_BOT_TOKEN", "GITLAB_TOKEN", "GITLAB_GROUP_ID",
  "ONBOARDING_TEMPLATE_PROJECT_ID", "POSTGRES_HOST"
];
for (const envVar of requiredEnvVars) {
  if (!process.env[envVar]) {
    console.error(`Missing required environment variable: ${envVar}`);
    process.exit(1);
  }
}

// Health check endpoint
app.get("/health", (req, res) => {
  res.status(200).json({ status: "healthy" });
});

// Webhook endpoint for GitLab user add events
app.post("/gitlab-webhook", async (req, res) => {
  try {
    const event = req.body;
    // Verify webhook secret
    const webhookSecret = req.headers["x-gitlab-token"];
    if (webhookSecret !== process.env.GITLAB_WEBHOOK_SECRET) {
      console.error("Invalid webhook secret");
      return res.status(403).json({ error: "Invalid secret" });
    }

    // Only handle user_add_to_group events
    if (event.event_type !== "user_add_to_group") {
      return res.status(200).json({ message: "Event ignored" });
    }

    const newUserId = event.user_id;
    const newUserUsername = event.user_username;
    const newUserEmail = event.user_email;

    console.log(`New user added to GitLab group: ${newUserUsername} (${newUserEmail})`);

    // 1. Provision default repository access
    await provisionRepoAccess(newUserId);

    // 2. Assign onboarding issue template
    await assignOnboardingIssue(newUserId, newUserUsername);

    // 3. Send Slack notification to #onboarding channel
    await sendSlackNotification(newUserUsername, newUserEmail);

    // 4. Log onboarding event to PostgreSQL
    await logOnboardingEvent(newUserId, newUserUsername, newUserEmail);

    res.status(200).json({ message: "Onboarding triggered successfully" });
  } catch (error) {
    console.error(`Webhook error: ${error.message}`);
    res.status(500).json({ error: "Internal server error" });
  }
});

async function provisionRepoAccess(userId) {
  try {
    // Get all projects in the group
    const projectsResponse = await axios.get(
      `https://gitlab.com/api/v4/groups/${GITLAB_GROUP_ID}/projects`,
      { headers: gitlabHeaders, params: { per_page: 100 } }
    );
    if (projectsResponse.status !== 200) {
      throw new Error(`Failed to fetch projects: ${projectsResponse.statusText}`);
    }
    const projects = projectsResponse.data;

    // Add user as Developer to all projects
    for (const project of projects) {
      await axios.post(
        `https://gitlab.com/api/v4/projects/${project.id}/members`,
        { user_id: userId, access_level: 30 }, // 30 = Developer access
        { headers: gitlabHeaders }
      );
      console.log(`Added user ${userId} to project ${project.name} as Developer`);
    }
  } catch (error) {
    console.error(`Failed to provision repo access: ${error.message}`);
    throw error;
  }
}

async function assignOnboardingIssue(userId, username) {
  try {
    // Create issue from template in onboarding project
    const issueResponse = await axios.post(
      `https://gitlab.com/api/v4/projects/${ONBOARDING_TEMPLATE_PROJECT_ID}/issues`,
      {
        title: `Onboarding: ${username}`,
        description: `## Welcome to the team, @${username}!\n\nComplete the following tasks to get started:\n- [ ] Set up local dev environment\n- [ ] Complete security training\n- [ ] Pair with mentor for first PR`,
        assignee_id: userId
      },
      { headers: gitlabHeaders }
    );
    if (issueResponse.status !== 201) {
      throw new Error(`Failed to create onboarding issue: ${issueResponse.statusText}`);
    }
    console.log(`Created onboarding issue for ${username}`);
  } catch (error) {
    console.error(`Failed to assign onboarding issue: ${error.message}`);
    throw error;
  }
}

async function sendSlackNotification(username, email) {
  try {
    await slackClient.chat.postMessage({
      channel: "#onboarding",
      text: `New engineer onboarded: *${username}* (${email}). Onboarding issue created in GitLab.`,
      blocks: [
        {
          type: "section",
          text: {
            type: "mrkdwn",
            text: `🎉 New team member! *${username}* (${email}) has been added to GitLab. Onboarding tasks assigned.`
          }
        }
      ]
    });
    console.log(`Sent Slack notification for ${username}`);
  } catch (error) {
    console.error(`Failed to send Slack notification: ${error.message}`);
    throw error;
  }
}

async function logOnboardingEvent(userId, username, email) {
  try {
    await pool.query(
      "INSERT INTO onboarding_audit (user_id, username, email, event_type, created_at) VALUES ($1, $2, $3, $4, NOW())",
      [userId, username, email, "gitlab_user_added"]
    );
    console.log(`Logged onboarding event for ${username}`);
  } catch (error) {
    console.error(`Failed to log onboarding event: ${error.message}`);
    throw error;
  }
}

// Start server
app.listen(PORT, () => {
  console.log(`GitLab onboarding webhook server running on port ${PORT}`);
});

# Audit your current IDP tools
echo "Current IDP tools:"
echo "1. Source Control: GitHub"
echo "2. CI/CD: GitHub Actions"
echo "3. Container Registry: Harbor"
echo "4. Deployments: ArgoCD"
echo "Total tools: 4"
echo "Post-migration tools:"
echo "1. Source Control/CI/CD/Registry/Deployments: GitLab"
echo "2. Project Management: Jira"
echo "Total tools: 2"

# GitLab Omnibus SSO configuration (gitlab.rb)
gitlab_rails['omniauth_enabled'] = true
gitlab_rails['omniauth_allow_single_sign_on'] = ['okta']
gitlab_rails['omniauth_block_auto_created_users'] = false
gitlab_rails['omniauth_providers'] = [
  {
    name: 'okta',
    args: {
      client_id: 'your-okta-client-id',
      client_secret: 'your-okta-client-secret',
      site: 'https://your-org.okta.com',
      authorize_url: '/oauth2/v1/authorize',
      token_url: '/oauth2/v1/token',
      user_info_url: '/oauth2/v1/userinfo'
    }
  }
]

# Prometheus metric for onboarding time
onboarding_time_hours{team="backend", tool="gitlab"} 9.9
onboarding_time_hours{team="frontend", tool="gitlab"} 10.2
onboarding_time_hours{team="devops", tool="gitlab"} 8.7

# Grafana query to calculate average onboarding time
avg(onboarding_time_hours) by (team)