gitlab-labkit 2.6.0 → 2.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 15a3589c7770e0c9368d19d4acb2365fb627f40a7a2c3dd65c03057399585036
-  data.tar.gz: 2f45f67fd34c8031306f1cf7197e69f82d19215dc3fdb6fcb38ff1ff0b5fd804
+  metadata.gz: 47f5227804a89cc5611c65a3c69e221b192e47cb40437c1c6f5ec722cd61e58b
+  data.tar.gz: 8c361ca03e53892c607cedf959adf94af0f45da7cf353915a67f284b5b4db3ab
 SHA512:
-  metadata.gz: c6858aecff6a32e4ca9b3b9c4b512b43de320b9f7b838348bb83de3d878a910b20169f64634c41bea4bdfa9f67db94ee2bf84864353e453296f8d40fd8d1934a
-  data.tar.gz: e4a9d5ac76d5e4b43220a469d7557c1bbfffb4fe9abb171978ee427981623ef4b1f1a20cde3c9b8c818b83e268eb0b509201a53f4aa47b74e924127ae03186b5
+  metadata.gz: cfc8ff84e29c5a292f409e91b4e44b74a6a7e18f243e22b4840070f7113be537fea7f2096e6033a980e2aa163db43718c7d6f5a5fbeb2797324018f697e77cb3
+  data.tar.gz: 4ca119aa945825d075dee174a6b9b2ec1d16f5786bb8eae1d778000ae66eb5243a3222259025f9d66fdf32086bb2c51eab4ba05fc8b53d5de071e3f7d9d13119

data/.copier-answers.yml

@@ -3,7 +3,7 @@
 # See the project for instructions on how to update the project
 #
 # Changes here will be overwritten by Copier; NEVER EDIT MANUALLY
-_commit: v1.51.0
+_commit: v1.60.0
 _src_path: https://gitlab.com/gitlab-com/gl-infra/common-template-copier.git
 ee_licensed: false
 gitlab_namespace: gitlab-org/ruby/gems
@@ -16,5 +16,6 @@ project_name: labkit-ruby
 release_platform: false
 ruby: true
 rubygem: true
+rust: false
 terraform: false
 truncated_tags: true

data/.editorconfig

@@ -16,6 +16,10 @@ trim_trailing_whitespace = true
 [.copier-*.yml]
 insert_final_newline = unset
 indent_size = unset
+charset = unset
+end_of_line = unset
+indent_style = unset
+trim_trailing_whitespace = unset
 
 [*.md]
 indent_size = unset

data/.gitlab/duo/agent-config.yml

@@ -0,0 +1,33 @@
+# GitLab Duo Agent Platform execution config.
+# https://docs.gitlab.com/user/duo_agent_platform/flows/execution/
+#
+# Runs flows for this project inside our own duo-workflow-sandbox image (which
+# ships mise), pre-installs the repo's mise toolset, and caches it between runs.
+# NOTE: this file is only read from the default branch.
+image: registry.gitlab.com/gitlab-com/gl-infra/common-ci-tasks-images/duo-workflow-sandbox:latest
+
+setup_script:
+  # Keep mise's data + cache inside the project dir so the `cache:` block below
+  # can capture them (caching only reliably covers paths under the project dir).
+  - export MISE_DATA_DIR="${CI_PROJECT_DIR}/.cache/mise/data"
+  - export MISE_CACHE_DIR="${CI_PROJECT_DIR}/.cache/mise/cache"
+  - mise trust --yes
+  - mise install --yes
+
+cache:
+  # Re-use installed tools as long as the version pins are unchanged.
+  key:
+    files:
+      - .tool-versions
+      - .mise.toml
+  paths:
+    - .cache/mise/data
+    - .cache/mise/cache
+
+network_policy:
+  # Allow the Sandbox Runtime's recommended allowlist (GitLab, package
+  # registries, etc.) so flows can reach the services they normally need.
+  include_recommended_allowed: true
+  # Additional domains flows are allowed to reach.
+  allowed_domains:
+    - api.osv.dev

data/.gitlab-ci-asdf-versions.yml

@@ -1,5 +1,5 @@
 # DO NOT MANUALLY EDIT; Run ./scripts/update-asdf-version-variables.sh to update this
 variables:
-    GL_ASDF_RUBY_VERSION: "4.0.1"
+    GL_ASDF_RUBY_VERSION: "4.0.5"
     GL_ASDF_SHELLCHECK_VERSION: "0.11"
     GL_ASDF_SHFMT_VERSION: "3.13"

data/.gitlab-ci.yml

@@ -19,13 +19,13 @@ include:
   # It includes standard checks, gitlab-scanners, validations and release processes
   # common to all projects using this template library.
   # see https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/blob/main/templates/standard.md
-  - component: $CI_SERVER_FQDN/gitlab-com/gl-infra/common-ci-tasks/standard-build@v4.8
+  - component: $CI_SERVER_FQDN/gitlab-com/gl-infra/common-ci-tasks/standard-build@v4.22
 
   # Runs rspec tests and rubocop on the project
   # see https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/blob/main/templates/ruby.md
-  - component: $CI_SERVER_FQDN/gitlab-com/gl-infra/common-ci-tasks/ruby-build@v4.8
+  - component: $CI_SERVER_FQDN/gitlab-com/gl-infra/common-ci-tasks/ruby-build@v4.22
 
-  - component: $CI_SERVER_FQDN/gitlab-com/gl-infra/common-ci-tasks/danger@v4.8
+  - component: $CI_SERVER_FQDN/gitlab-com/gl-infra/common-ci-tasks/danger@v4.22
 
 # Attach a redis service to the rspec job from common-ci-tasks/ruby-build.
 # GitLab merges keys when a local job has the same name as an included one,

data/.pre-commit-config.yaml

@@ -25,7 +25,7 @@ repos:
   # Documentation available at
   # https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/blob/main/docs/pre-commit.md
   - repo: https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks
-    rev: v4.8  # renovate:managed
+    rev: v4.22  # renovate:managed
 
     hooks:
       - id: shellcheck  # Run shellcheck for changed Shell files

data/.tool-versions

@@ -1,3 +1,3 @@
-ruby 4.0.1
+ruby 4.0.5
 shfmt 3.13
 shellcheck 0.11

data/LICENSE

@@ -1,4 +1,4 @@
-Copyright (c) 2011-2022 GitLab, Inc.
+Copyright (c) 2011-2026 GitLab, Inc.
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

data/README.md

@@ -21,6 +21,7 @@ LabKit-Ruby provides functionality in a number of areas:
 1. `Labkit::Context` used for providing context information to log messages.
 1. `Labkit::Correlation` for accessing the correlation id. (Generated and propagated by `Labkit::Context`)
 1. `Labkit::UserExperienceSli` for tracking User Experience SLIs. More on the [README](./lib/labkit/user_experience_sli/README.md).
+1. `Labkit::ApplicationSli` for tracking Application SLIs (Apdex and error-rate). More on the [README](./lib/labkit/application_sli/README.md).
 1. `Labkit::FIPS` for checking for FIPS mode and using FIPS-compliant algorithms.
 1. `Labkit::Logging` for sanitizing log messages.
 1. `Labkit::Metrics` for metrics. More on the [README](./lib/labkit/metrics/README.md).

data/lib/labkit/rate_limit/README.md

@@ -116,7 +116,8 @@ the same counter.
 mutate Redis. It is useful when one code path should account for the request
 (`check`) and another should gate a side-effect on whether the caller is
 already over-limit. `peek` skips `:log` rules — their state is unobservable
-without incrementing.
+without incrementing. A matched `:skip` rule terminates `peek` the same way
+it terminates `check`: matched, `:allow`, no Redis read, no `info`.
 
 ## Identifier
 
@@ -145,7 +146,7 @@ A `Rule` is a `Data.define` value object with the following fields:
 | `match`           | Hash of identifier key/value predicates that must **all** be satisfied for the rule to apply. Empty hash matches anything. See [Matchers](#matchers).                |
 | `limit`           | Integer request threshold per `period`. May be a callable resolved on every check.                                                                                   |
 | `period`          | Window length in seconds. May be a callable resolved on every check.                                                                                                 |
-| `action`          | What the result reports when the limit is exceeded. One of `:block`, `:log`, `:allow`. Default `:block`. See [Actions](#actions).                                    |
+| `action`          | What the result reports when the limit is exceeded. One of `:block`, `:log`, `:allow`, `:skip`. Default `:block`. See [Actions](#actions).                           |
 | `characteristics` | Array of identifier keys whose values are folded into the Redis counter key. Each unique combination gets its own counter.                                           |
 
 Making `limit` or `period` callable is the supported pattern for
@@ -189,7 +190,10 @@ flowchart TD
     Start([check identifier]) --> Iter{Next rule?}
     Iter -->|yes| Match{rule.match<br/>all satisfied?}
     Match -->|no| Iter
-    Match -->|yes| Eval["INCR Redis counter<br/>(see Redis sequence below)"]
+    Match -->|yes| Skip{rule.action<br/>== :skip?}
+    Skip -->|"yes (no Redis op)"| SkipEmit[Emit calls_total<br/>action=skip]
+    SkipEmit --> SkipReturn([Return matched=true<br/>action=:allow])
+    Skip -->|no| Eval["INCR Redis counter<br/>(see Redis sequence below)"]
     Eval --> Build[Build Result<br/>resolve limit/period]
     Build --> Emit[Emit calls_total + limit/period gauges]
     Emit --> Act{rule.action}
@@ -204,7 +208,8 @@ flowchart TD
 ### Actions
 
 The rule's `action` controls how the `Result` reports an over-limit hit. The
-counter is always incremented when a rule matches, regardless of `action`:
+counter is always incremented when a rule matches, except for `:skip` rules,
+which never touch Redis:
 
 - `:block` — when exceeded, `Result#action` is `:block`. Caller should reject
   the request (e.g. with HTTP 429). When under the limit, action is `:allow`.
@@ -218,6 +223,13 @@ counter is always incremented when a rule matches, regardless of `action`:
   `:block`). Useful for "always allow this caller even if they're over the
   limit" cases while still observing them via metrics. Evaluation terminates
   on the first match.
+- `:skip` — bypass. A matching rule terminates evaluation with
+  `Result#action` `:allow` **without any Redis operation**: nothing is
+  counted, so `limit`, `period`, `characteristics`, and `count_distinct` are
+  inert and the result carries no `info` (`to_response_headers` is `{}`).
+  The match is still observable via `calls_total{action="skip"}`. Use this
+  for bypasses that don't need a counter; use `:allow` only when you want
+  the bypassed traffic counted.
 
 ### Redis keys
 
@@ -302,7 +314,7 @@ should treat the request as allowed.
 
 | metric                                          | type    | labels                              | meaning                                                              |
 |-------------------------------------------------|---------|-------------------------------------|----------------------------------------------------------------------|
-| `gitlab_labkit_rate_limiter_calls_total`        | counter | `rate_limiter`, `rule`, `action`    | One increment per terminating decision; also incremented per matched `:log` rule. `action` is one of `"allow"`, `"block"`, `"log"`. `rule="unmatched", action="allow"` when no rule terminated. |
+| `gitlab_labkit_rate_limiter_calls_total`        | counter | `rate_limiter`, `rule`, `action`    | One increment per terminating decision; also incremented per matched `:log` rule. `action` is one of `"allow"`, `"block"`, `"log"`, `"skip"`. `rule="unmatched", action="allow"` when no rule terminated. |
 | `gitlab_labkit_rate_limiter_errors_total`       | counter | `rate_limiter`                      | Fail-open events (any `StandardError` in the labkit path).            |
 | `gitlab_labkit_rate_limiter_limit`              | gauge   | `rate_limiter`, `rule`              | Resolved limit at the last check (useful when `limit:` is callable). |
 | `gitlab_labkit_rate_limiter_period_seconds`     | gauge   | `rate_limiter`, `rule`              | Resolved period at the last check.                                   |

data/lib/labkit/rate_limit/evaluator.rb

@@ -91,6 +91,11 @@ module Labkit
       # :log rules are non-terminating: they emit metrics and continue,
       # so a shadow :log rule cannot disable a following :block rule.
       #
+      # :skip rules terminate on match without touching Redis: no counter is
+      # incremented, so the branch sits before the count_distinct check
+      # (identifier completeness is irrelevant to a rule that builds no key).
+      # calls_total still increments so the bypass stays observable.
+      #
       # SET-mode rules (rule.count_distinct set) that match but whose identifier
       # is missing the count_distinct key fail open + log + bump errors_total, and
       # the loop continues to the next rule (the rule is treated as not applicable
@@ -99,6 +104,11 @@ module Labkit
         @rules.each do |rule|
           next unless rule_matches?(rule, identifier)
 
+          if rule.action == :skip
+            report_skipped_metrics(rule)
+            return skip_result(rule)
+          end
+
           if rule.count_distinct && missing_count_distinct_value?(rule, identifier)
             log_missing_count_distinct(rule, identifier)
             report_error_metrics
@@ -125,6 +135,8 @@ module Labkit
           next if rule.action == :log
           next unless rule_matches?(rule, identifier)
 
+          return skip_result(rule) if rule.action == :skip
+
           return peek_rule(rule, identifier, rule_context)
         end
 
@@ -135,6 +147,12 @@ module Labkit
         rule.match.all? { |key, matcher| matcher.match?(identifier[key]) }
       end
 
+      # A matched :skip rule allows without evaluating: no counter exists, so
+      # info is nil (to_response_headers is {} for skip results).
+      def skip_result(rule)
+        Result.new(matched: true, action: :allow, rule: rule)
+      end
+
       def missing_count_distinct_value?(rule, identifier)
         value = identifier[rule.count_distinct]
         value.nil? || value.to_s.empty?
@@ -287,9 +305,10 @@ module Labkit
 
       def log_error(error, identifier)
         @logger.warn(
-          message: "rate_limit_error",
           name: @name,
-          error: error.class.to_s,
+          Labkit::Fields::ERROR_TYPE => "rate_limit_error",
+          Labkit::Fields::CLASS_NAME => error.class.to_s,
+          Labkit::Fields::ERROR_MESSAGE => error.message,
           identifier: identifier&.to_h
         )
       end
@@ -320,6 +339,17 @@ module Labkit
         )
       end
 
+      # calls_total carries action="skip" (the rule action, not the :allow the
+      # caller sees) so bypass traffic stays distinguishable from counted
+      # allows. No limit/period gauges: a skip rule has no limit to report.
+      def report_skipped_metrics(rule)
+        Metrics.calls_total.increment(
+          rate_limiter: @name,
+          rule: rule.name,
+          action: "skip"
+        )
+      end
+
       def report_unmatched_metrics
         Metrics.calls_total.increment(
           rate_limiter: @name,

data/lib/labkit/rate_limit/result.rb

@@ -9,11 +9,13 @@ module Labkit
     #             :block = rule matched, exceeded, rule configured to block
     #             :log   = rule matched, exceeded, rule configured to log only
     #             :allow = rule matched but count within limit, rule configured to allow,
+    #                      rule configured to skip (bypass, nothing counted),
     #                      no rule matched, or error (fail-open)
     #             The rule's configured action is available via rule.action.
     # rule      - the matched Rule object (nil when matched? is false)
     # error?    - true if Redis was unavailable; result fails open (exceeded? is false)
-    # info      - Result::Info with per-window counters; nil when matched? is false or error?
+    # info      - Result::Info with per-window counters; nil when matched? is false,
+    #             error?, or the matched rule is :skip (no counter exists)
     Result = Data.define(:matched, :exceeded, :action, :rule, :error, :info) do
       def initialize(matched:, action: nil, exceeded: false, rule: nil, error: false, info: nil)
         super

data/lib/labkit/rate_limit/rule.rb

@@ -2,7 +2,7 @@
 
 module Labkit
   module RateLimit
-    KNOWN_ACTIONS = %i[block log allow].freeze
+    KNOWN_ACTIONS = %i[block log allow skip].freeze
     RULE_NAME_PATTERN = /\A[a-z0-9_]+\z/
     RULE_NAME_MAX_LENGTH = 64
 
@@ -13,9 +13,12 @@ module Labkit
     # limit           - request threshold; may be a callable (resolved per check)
     # period          - window in seconds; may be a callable (resolved per check)
     # action          - :block (enforce), :log (count and log only, do not block,
-    #                   evaluation continues to subsequent rules), or :allow
+    #                   evaluation continues to subsequent rules), :allow
     #                   (count but always permit; terminates evaluation on match
-    #                   regardless of whether the limit was exceeded)
+    #                   regardless of whether the limit was exceeded), or :skip
+    #                   (bypass: permit and terminate evaluation on match without
+    #                   counting; performs no Redis operation, so limit, period,
+    #                   characteristics, and count_distinct are inert)
     # characteristics - identifier keys used to build the compound Redis counter key
     # count_distinct  - optional Symbol naming an identifier key. When set, the rule
     #                   counts the number of distinct values seen for that key within

data/scripts/prepare-dev-env.sh

@@ -54,7 +54,7 @@ fi
 # install mise/asdf dependencies
 echo "installing required plugins with mise install.."
 mise plugins update -q
-mise trust
+mise trust --yes
 mise install
 
 # set PROMPT_COMMAND to empty value for mise if unset

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: gitlab-labkit
 version: !ruby/object:Gem::Version
-  version: 2.6.0
+  version: 2.7.0
 platform: ruby
 authors:
 - Andrew Newdigate
@@ -550,6 +550,7 @@ files:
 - ".gitlab-ci-other-versions.yml"
 - ".gitlab-ci.yml"
 - ".gitlab/CODEOWNERS"
+- ".gitlab/duo/agent-config.yml"
 - ".gitlab/merge_request_templates/default.md"
 - ".gitleaks.toml"
 - ".mise.toml"
@@ -715,7 +716,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.3
+rubygems_version: 4.0.10
 specification_version: 4
 summary: Instrumentation for GitLab
 test_files: []