gitlab-labkit 2.6.1 → 2.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 140906bda44bd0c6017b97b2426de6ec7b5d9f8182d68c148ca03c7089119105
-  data.tar.gz: 75778be0358853695eddea8d83acfac30d764ff38c1fd3ab635caa57c8082024
+  metadata.gz: a0038ac3c9b17772bb517d4e2fc9e61ca26d05647e3de991c4899dfc867f4d88
+  data.tar.gz: 041f4b6ee0f7257738b0bb7663adcbca06c9f520152cd7f7b8397b31ed280d7c
 SHA512:
-  metadata.gz: f12fa1948cf7b5293bd72cbae7dac4b2c2d64c75120734037c3d271eb15e82c5481d7a99f79fbdf05f242b833310d58657107c315b20e29e080ea166f82b918c
-  data.tar.gz: 04c483ebc32941c2e76dabdd2c58ec3b213e02e8b1bae7a8593cfe322669db4f678c7676d9c14cc8fe3124a6c6fb42a1b31f79bbdc1b90c856bdb5f784cedb86
+  metadata.gz: ee2a000a091c0eb8433911f6a0e17d7921c1477204ed9f5e5fb54a3b8d625c8361b7653134cb5231c7b78e4fdc6df74c1b3c9d92424b1a17533f35257b913115
+  data.tar.gz: dd0a54427b6a2181bfad09efda0536ca4c0b703e2ee8182214a0ce02079f7ee207423f4e7f7d4f40f564a98d2e2d6eaeac8b4e312cf288450c2c0d8e6d146c4f

data/.copier-answers.yml

@@ -3,7 +3,7 @@
 # See the project for instructions on how to update the project
 #
 # Changes here will be overwritten by Copier; NEVER EDIT MANUALLY
-_commit: v1.52.0
+_commit: v1.60.0
 _src_path: https://gitlab.com/gitlab-com/gl-infra/common-template-copier.git
 ee_licensed: false
 gitlab_namespace: gitlab-org/ruby/gems
@@ -16,5 +16,6 @@ project_name: labkit-ruby
 release_platform: false
 ruby: true
 rubygem: true
+rust: false
 terraform: false
 truncated_tags: true

data/.editorconfig

@@ -16,6 +16,10 @@ trim_trailing_whitespace = true
 [.copier-*.yml]
 insert_final_newline = unset
 indent_size = unset
+charset = unset
+end_of_line = unset
+indent_style = unset
+trim_trailing_whitespace = unset
 
 [*.md]
 indent_size = unset

data/.gitlab/duo/agent-config.yml

@@ -0,0 +1,33 @@
+# GitLab Duo Agent Platform execution config.
+# https://docs.gitlab.com/user/duo_agent_platform/flows/execution/
+#
+# Runs flows for this project inside our own duo-workflow-sandbox image (which
+# ships mise), pre-installs the repo's mise toolset, and caches it between runs.
+# NOTE: this file is only read from the default branch.
+image: registry.gitlab.com/gitlab-com/gl-infra/common-ci-tasks-images/duo-workflow-sandbox:latest
+
+setup_script:
+  # Keep mise's data + cache inside the project dir so the `cache:` block below
+  # can capture them (caching only reliably covers paths under the project dir).
+  - export MISE_DATA_DIR="${CI_PROJECT_DIR}/.cache/mise/data"
+  - export MISE_CACHE_DIR="${CI_PROJECT_DIR}/.cache/mise/cache"
+  - mise trust --yes
+  - mise install --yes
+
+cache:
+  # Re-use installed tools as long as the version pins are unchanged.
+  key:
+    files:
+      - .tool-versions
+      - .mise.toml
+  paths:
+    - .cache/mise/data
+    - .cache/mise/cache
+
+network_policy:
+  # Allow the Sandbox Runtime's recommended allowlist (GitLab, package
+  # registries, etc.) so flows can reach the services they normally need.
+  include_recommended_allowed: true
+  # Additional domains flows are allowed to reach.
+  allowed_domains:
+    - api.osv.dev

data/.gitlab-ci-asdf-versions.yml

@@ -1,5 +1,5 @@
 # DO NOT MANUALLY EDIT; Run ./scripts/update-asdf-version-variables.sh to update this
 variables:
-    GL_ASDF_RUBY_VERSION: "4.0.1"
+    GL_ASDF_RUBY_VERSION: "4.0.5"
     GL_ASDF_SHELLCHECK_VERSION: "0.11"
     GL_ASDF_SHFMT_VERSION: "3.13"

data/.gitlab-ci.yml

@@ -19,13 +19,13 @@ include:
   # It includes standard checks, gitlab-scanners, validations and release processes
   # common to all projects using this template library.
   # see https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/blob/main/templates/standard.md
-  - component: $CI_SERVER_FQDN/gitlab-com/gl-infra/common-ci-tasks/standard-build@v4.11
+  - component: $CI_SERVER_FQDN/gitlab-com/gl-infra/common-ci-tasks/standard-build@v4.22
 
   # Runs rspec tests and rubocop on the project
   # see https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/blob/main/templates/ruby.md
-  - component: $CI_SERVER_FQDN/gitlab-com/gl-infra/common-ci-tasks/ruby-build@v4.11
+  - component: $CI_SERVER_FQDN/gitlab-com/gl-infra/common-ci-tasks/ruby-build@v4.22
 
-  - component: $CI_SERVER_FQDN/gitlab-com/gl-infra/common-ci-tasks/danger@v4.11
+  - component: $CI_SERVER_FQDN/gitlab-com/gl-infra/common-ci-tasks/danger@v4.22
 
 # Attach a redis service to the rspec job from common-ci-tasks/ruby-build.
 # GitLab merges keys when a local job has the same name as an included one,

data/.mise.toml

@@ -1,5 +1,11 @@
 [settings]
 legacy_version_file = false
+# Install precompiled Ruby instead of building from source. The from-source
+# build compiles a vendored OpenSSL (ruby-build's `needs_openssl` check fails
+# because CI images ship the OpenSSL runtime but no dev headers/pkg-config),
+# and that compile is slow and fails in CI. Precompiled Ruby bundles its own
+# OpenSSL and sidesteps it. This becomes mise's default in 2026.8.0.
+ruby.compile = false
 
 [tools]
 # Please continue to use `.tool-versions` to specify tool versions, rather than adding them directly here.

data/.pre-commit-config.yaml

@@ -25,7 +25,7 @@ repos:
   # Documentation available at
   # https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/blob/main/docs/pre-commit.md
   - repo: https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks
-    rev: v4.11  # renovate:managed
+    rev: v4.22  # renovate:managed
 
     hooks:
       - id: shellcheck  # Run shellcheck for changed Shell files

data/.tool-versions

@@ -1,3 +1,3 @@
-ruby 4.0.1
+ruby 4.0.5
 shfmt 3.13
 shellcheck 0.11

data/LICENSE

@@ -1,4 +1,4 @@
-Copyright (c) 2011-2022 GitLab, Inc.
+Copyright (c) 2011-2026 GitLab, Inc.
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

data/README.md

@@ -21,6 +21,7 @@ LabKit-Ruby provides functionality in a number of areas:
 1. `Labkit::Context` used for providing context information to log messages.
 1. `Labkit::Correlation` for accessing the correlation id. (Generated and propagated by `Labkit::Context`)
 1. `Labkit::UserExperienceSli` for tracking User Experience SLIs. More on the [README](./lib/labkit/user_experience_sli/README.md).
+1. `Labkit::ApplicationSli` for tracking Application SLIs (Apdex and error-rate). More on the [README](./lib/labkit/application_sli/README.md).
 1. `Labkit::FIPS` for checking for FIPS mode and using FIPS-compliant algorithms.
 1. `Labkit::Logging` for sanitizing log messages.
 1. `Labkit::Metrics` for metrics. More on the [README](./lib/labkit/metrics/README.md).

data/lib/labkit/fields.rb

@@ -206,7 +206,7 @@ module Labkit
         Fields::SEVERITY => %w[level],
         Fields::LOG_MESSAGE => %w[msg custom_message extra.message fields.message graphql.message reason color_message exception.gitaly],
         Fields::CLASS_NAME => %w[class author_class exception.class extra.class extra.class_name],
-        Fields::SERVICE_NAME => %w[service grpc.service_name auth_service type component subcomponent],
+        Fields::SERVICE_NAME => %w[service grpc.service_name auth_service component subcomponent],
         Fields::GL_ORGANIZATION_ID => %w[organization_id],
         Fields::GL_PROJECT_PATH => %w[project_path full_path root_pipeline_project_path requested_project_path auth_project_path extra.gl_project_path],
       }.freeze

data/lib/labkit/rate_limit/README.md

@@ -116,7 +116,8 @@ the same counter.
 mutate Redis. It is useful when one code path should account for the request
 (`check`) and another should gate a side-effect on whether the caller is
 already over-limit. `peek` skips `:log` rules — their state is unobservable
-without incrementing.
+without incrementing. A matched `:skip` rule terminates `peek` the same way
+it terminates `check`: matched, `:allow`, no Redis read, no `info`.
 
 ## Identifier
 
@@ -145,7 +146,7 @@ A `Rule` is a `Data.define` value object with the following fields:
 | `match`           | Hash of identifier key/value predicates that must **all** be satisfied for the rule to apply. Empty hash matches anything. See [Matchers](#matchers).                |
 | `limit`           | Integer request threshold per `period`. May be a callable resolved on every check.                                                                                   |
 | `period`          | Window length in seconds. May be a callable resolved on every check.                                                                                                 |
-| `action`          | What the result reports when the limit is exceeded. One of `:block`, `:log`, `:allow`. Default `:block`. See [Actions](#actions).                                    |
+| `action`          | What the result reports when the limit is exceeded. One of `:block`, `:log`, `:allow`, `:skip`. Default `:block`. See [Actions](#actions).                           |
 | `characteristics` | Array of identifier keys whose values are folded into the Redis counter key. Each unique combination gets its own counter.                                           |
 
 Making `limit` or `period` callable is the supported pattern for
@@ -189,7 +190,10 @@ flowchart TD
     Start([check identifier]) --> Iter{Next rule?}
     Iter -->|yes| Match{rule.match<br/>all satisfied?}
     Match -->|no| Iter
-    Match -->|yes| Eval["INCR Redis counter<br/>(see Redis sequence below)"]
+    Match -->|yes| Skip{rule.action<br/>== :skip?}
+    Skip -->|"yes (no Redis op)"| SkipEmit[Emit calls_total<br/>action=skip]
+    SkipEmit --> SkipReturn([Return matched=true<br/>action=:allow])
+    Skip -->|no| Eval["INCR Redis counter<br/>(see Redis sequence below)"]
     Eval --> Build[Build Result<br/>resolve limit/period]
     Build --> Emit[Emit calls_total + limit/period gauges]
     Emit --> Act{rule.action}
@@ -204,7 +208,8 @@ flowchart TD
 ### Actions
 
 The rule's `action` controls how the `Result` reports an over-limit hit. The
-counter is always incremented when a rule matches, regardless of `action`:
+counter is always incremented when a rule matches, except for `:skip` rules,
+which never touch Redis:
 
 - `:block` — when exceeded, `Result#action` is `:block`. Caller should reject
   the request (e.g. with HTTP 429). When under the limit, action is `:allow`.
@@ -218,6 +223,13 @@ counter is always incremented when a rule matches, regardless of `action`:
   `:block`). Useful for "always allow this caller even if they're over the
   limit" cases while still observing them via metrics. Evaluation terminates
   on the first match.
+- `:skip` — bypass. A matching rule terminates evaluation with
+  `Result#action` `:allow` **without any Redis operation**: nothing is
+  counted, so `limit`, `period`, `characteristics`, and `count_distinct` are
+  inert and the result carries no `info` (`to_response_headers` is `{}`).
+  The match is still observable via `calls_total{action="skip"}`. Use this
+  for bypasses that don't need a counter; use `:allow` only when you want
+  the bypassed traffic counted.
 
 ### Redis keys
 
@@ -302,7 +314,7 @@ should treat the request as allowed.
 
 | metric                                          | type    | labels                              | meaning                                                              |
 |-------------------------------------------------|---------|-------------------------------------|----------------------------------------------------------------------|
-| `gitlab_labkit_rate_limiter_calls_total`        | counter | `rate_limiter`, `rule`, `action`    | One increment per terminating decision; also incremented per matched `:log` rule. `action` is one of `"allow"`, `"block"`, `"log"`. `rule="unmatched", action="allow"` when no rule terminated. |
+| `gitlab_labkit_rate_limiter_calls_total`        | counter | `rate_limiter`, `rule`, `action`    | One increment per terminating decision; also incremented per matched `:log` rule. `action` is one of `"allow"`, `"block"`, `"log"`, `"skip"`. `rule="unmatched", action="allow"` when no rule terminated. |
 | `gitlab_labkit_rate_limiter_errors_total`       | counter | `rate_limiter`                      | Fail-open events (any `StandardError` in the labkit path).            |
 | `gitlab_labkit_rate_limiter_limit`              | gauge   | `rate_limiter`, `rule`              | Resolved limit at the last check (useful when `limit:` is callable). |
 | `gitlab_labkit_rate_limiter_period_seconds`     | gauge   | `rate_limiter`, `rule`              | Resolved period at the last check.                                   |

data/lib/labkit/rate_limit/evaluator.rb

@@ -91,6 +91,11 @@ module Labkit
       # :log rules are non-terminating: they emit metrics and continue,
       # so a shadow :log rule cannot disable a following :block rule.
       #
+      # :skip rules terminate on match without touching Redis: no counter is
+      # incremented, so the branch sits before the count_distinct check
+      # (identifier completeness is irrelevant to a rule that builds no key).
+      # calls_total still increments so the bypass stays observable.
+      #
       # SET-mode rules (rule.count_distinct set) that match but whose identifier
       # is missing the count_distinct key fail open + log + bump errors_total, and
       # the loop continues to the next rule (the rule is treated as not applicable
@@ -99,6 +104,11 @@ module Labkit
         @rules.each do |rule|
           next unless rule_matches?(rule, identifier)
 
+          if rule.action == :skip
+            report_skipped_metrics(rule)
+            return skip_result(rule)
+          end
+
           if rule.count_distinct && missing_count_distinct_value?(rule, identifier)
             log_missing_count_distinct(rule, identifier)
             report_error_metrics
@@ -125,6 +135,8 @@ module Labkit
           next if rule.action == :log
           next unless rule_matches?(rule, identifier)
 
+          return skip_result(rule) if rule.action == :skip
+
           return peek_rule(rule, identifier, rule_context)
         end
 
@@ -135,6 +147,12 @@ module Labkit
         rule.match.all? { |key, matcher| matcher.match?(identifier[key]) }
       end
 
+      # A matched :skip rule allows without evaluating: no counter exists, so
+      # info is nil (to_response_headers is {} for skip results).
+      def skip_result(rule)
+        Result.new(matched: true, action: :allow, rule: rule)
+      end
+
       def missing_count_distinct_value?(rule, identifier)
         value = identifier[rule.count_distinct]
         value.nil? || value.to_s.empty?
@@ -321,6 +339,17 @@ module Labkit
         )
       end
 
+      # calls_total carries action="skip" (the rule action, not the :allow the
+      # caller sees) so bypass traffic stays distinguishable from counted
+      # allows. No limit/period gauges: a skip rule has no limit to report.
+      def report_skipped_metrics(rule)
+        Metrics.calls_total.increment(
+          rate_limiter: @name,
+          rule: rule.name,
+          action: "skip"
+        )
+      end
+
       def report_unmatched_metrics
         Metrics.calls_total.increment(
           rate_limiter: @name,

data/lib/labkit/rate_limit/result.rb

@@ -9,11 +9,13 @@ module Labkit
     #             :block = rule matched, exceeded, rule configured to block
     #             :log   = rule matched, exceeded, rule configured to log only
     #             :allow = rule matched but count within limit, rule configured to allow,
+    #                      rule configured to skip (bypass, nothing counted),
     #                      no rule matched, or error (fail-open)
     #             The rule's configured action is available via rule.action.
     # rule      - the matched Rule object (nil when matched? is false)
     # error?    - true if Redis was unavailable; result fails open (exceeded? is false)
-    # info      - Result::Info with per-window counters; nil when matched? is false or error?
+    # info      - Result::Info with per-window counters; nil when matched? is false,
+    #             error?, or the matched rule is :skip (no counter exists)
     Result = Data.define(:matched, :exceeded, :action, :rule, :error, :info) do
       def initialize(matched:, action: nil, exceeded: false, rule: nil, error: false, info: nil)
         super

data/lib/labkit/rate_limit/rule.rb

@@ -2,7 +2,7 @@
 
 module Labkit
   module RateLimit
-    KNOWN_ACTIONS = %i[block log allow].freeze
+    KNOWN_ACTIONS = %i[block log allow skip].freeze
     RULE_NAME_PATTERN = /\A[a-z0-9_]+\z/
     RULE_NAME_MAX_LENGTH = 64
 
@@ -13,9 +13,12 @@ module Labkit
     # limit           - request threshold; may be a callable (resolved per check)
     # period          - window in seconds; may be a callable (resolved per check)
     # action          - :block (enforce), :log (count and log only, do not block,
-    #                   evaluation continues to subsequent rules), or :allow
+    #                   evaluation continues to subsequent rules), :allow
     #                   (count but always permit; terminates evaluation on match
-    #                   regardless of whether the limit was exceeded)
+    #                   regardless of whether the limit was exceeded), or :skip
+    #                   (bypass: permit and terminate evaluation on match without
+    #                   counting; performs no Redis operation, so limit, period,
+    #                   characteristics, and count_distinct are inert)
     # characteristics - identifier keys used to build the compound Redis counter key
     # count_distinct  - optional Symbol naming an identifier key. When set, the rule
     #                   counts the number of distinct values seen for that key within

data/scripts/prepare-dev-env.sh

@@ -54,7 +54,7 @@ fi
 # install mise/asdf dependencies
 echo "installing required plugins with mise install.."
 mise plugins update -q
-mise trust
+mise trust --yes
 mise install
 
 # set PROMPT_COMMAND to empty value for mise if unset

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: gitlab-labkit
 version: !ruby/object:Gem::Version
-  version: 2.6.1
+  version: 2.8.0
 platform: ruby
 authors:
 - Andrew Newdigate
@@ -550,6 +550,7 @@ files:
 - ".gitlab-ci-other-versions.yml"
 - ".gitlab-ci.yml"
 - ".gitlab/CODEOWNERS"
+- ".gitlab/duo/agent-config.yml"
 - ".gitlab/merge_request_templates/default.md"
 - ".gitleaks.toml"
 - ".mise.toml"
@@ -715,7 +716,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.3
+rubygems_version: 4.0.10
 specification_version: 4
 summary: Instrumentation for GitLab
 test_files: []