FA8307_GitLab_Ultimate_Alternatives_Research.docx

***Please submit all responses using this word doc and the attached excel to geoffrey.bender.1@us.af.mil, kyle.hamby.1@us.af.mil.*** Government’s Current Software: GitLab Ultimate General Requirement:

Platform One (P1) has a requirement for a software platform that provides an end-to-end Development Security Operations (DevSecOps) capability to build, test, and deploy software. The solution must include Source Code Management, Continuous Integration/Continuous Development (CI/CD) pipelines, and embedded security across the software development life cycle to prevent threats and meet P1's requirements for its Continuous Authorization to Operate (cATO).

This software is a crucial component of the software development architecture of P1. It will be integrated into all of the accredited P1 pipelines. It will also enable primary container hardening for internal and external vendors to collaborate, submit justifications, and harden their respective containers.

List of Specific Requirements are at the bottom of this RFI and on the Requirements Capability Sheet in FA8307 Gitlab Ultimate Alternatives Research Attachment 1.

Instructions to Fill Out:

The Government requests that any vendor interested in proposing on either Gitlab Ultimate licenses or proposing an alternative solution please:

1) Fill out the FA8307 Gitlab Ultimate Alternatives Research Attachment 1, Requirements Capability Sheet;

AND

2) Fill out one of the following:

a. FA8307 Gitlab Ultimate Alternatives Research Attachment 1, RFI Excel version of Word Sheet

b. Page 2 of this word document to include sections Alternative License Types, Pricing Information, and Other Considerations in this word document. Insert answers as sub bullets for each number.

Please provide information on the following topics. If your company is an approved reseller of GitLab Ultimate please state so, and only fill out the pricing and other consideration portions:

Alternative License Types:

1. What alternate licensing models or solutions do you offer for Gitlab Ultimate?

· Please provide details on available options, such as enterprise, cloud-managed, or open-source/community editions. For each licensing option/solution set, please provide how it differs from the listed license.

2. For each licensing option/solution set, please provide how it is similar from the listed license.

· Specify any feature restrictions, scalability limitations, or support differences among the licenses (e.g., data retention, search query limits, or alerting capabilities).

3. For each licensing option/solution set, please provide how it meets the above requirements.

· Identify core features or capabilities that are shared across all options, such as log aggregation, visualization tools, and monitoring capabilities, regardless of the license type.

4. For each licensing option/solution set, clarify how it meets the above requirements for our logging and monitoring needs.

· Please highlight specific ways in which each licensing tier can address our operational, security, and compliance needs, particularly in areas like multi-environment visibility, role-based access control, and support for compliance auditing.

Pricing Information:

1. For each license, please provide estimated transition and training costs and schedule for both transitioning to and from your proposed solution.

· Include details on onboarding costs, consulting, or configuration support required for a smooth transition. Specify any training options available, such as workshops, online courses, or documentation resources, and their associated costs.

2. For each license, please provide any price plans associated such as monthly, trial, annual.

· Indicate if discounts are offered for longer-term contracts or high-volume deployments. For cloud-managed options, provide cost breakdowns for storage, query processing, and other usage-based charges.

Other Considerations:

1. Are there any additional features or benefits associated with the different licenses that we should consider?

· For example, are advanced analytics, machine learning-based anomaly detection, or pre-built integrations with other monitoring tools included at higher licensing tiers? - Clarify any value-added services, such as dedicated account support, proactive health checks, or best-practice workshops, that come with certain licenses.

2. Is your company willing to enter into contracts with a base year with up to four one-year options? If not, how many years is your company willing to agree to?

· For longer-term contracts, specify any guarantees on pricing, renewal terms, or opportunities to adjust the contract scope to accommodate potential changes in our data volume or monitoring requirements.

We are eager to find a solution that will best support our needs and ensure continued productivity.

Please Note: No award will be made under this RFI. Only a warranted Contracting Officer can obligate on behalf of the United States Government and that will be executed through an official request for quote (RFQ). The Government reserves the right to cancel this RFI. In the event the Government cancels this RFI, the Government has no obligation to pursue procurement or to reimburse an Offeror for any costs.

Requirements List which matches the Excel Requirements Capability Sheet:

· Must be capable of being self-hosted.

· Must be capable of being containerized.

· Must be deployable with containers and Helm Charts.

· Must be compatible with Amazon Web Services (AWS) EKS.

· The solution must be able to leverage Single Sign On (SSO), and OIDC and SAML compatibility.

· Must provide built-in CI/CD capabilities with pipeline support with configuration-as-code via YAML files.

· Must provide the ability to create templated CI/CD pipelines.

· Must be capable of hosting Linux Foundation Open Container Initiative (OCI) artifact registry.

· Must be capable of acting as a package repository for the following:

· Npm

· NuGet

· Python/pip

· Maven/Gradle

· Generic/tarball artifacts

· Must provide Static Application Security Testing (SAST) capability for scanning pipelines.

· Must support Dynamic Application Security Testing (DAST), license compliance, and dependency scanning.

· Vulnerability Management: Must provide clear vulnerability reporting and management with options for automatic vulnerability remediation (GitLab offers an in-depth vulnerability dashboard and dependency scanning).

· Must provide a built-in Issue Tracker integrated with pipeline operations with issue management workflows.

· Must provide KanBan-style boards for planning and managing work.

· Needs-based pipelines: Pipeline must be able to be run in parallel and dependencies setup in a non-linear manner

· Must have integrated source control management.

· Must have compatibility with service mesh usage–Istio at a minimum.

· Project Creation and Management: Must provide an ability to create and organize projects efficiently, with options for subgrouping and nesting within repositories.

· Repository Mirroring: Must provide a capability to mirror repositories to and from external sources to sync code across different servers.

· Customizable Project Templates: Must provide access to predefined project templates to standardize setup across repositories.

· Branching Strategy Support: Must support a range of branching strategies such as Git Flow, feature branches, and hotfix branches.

· Merge Request System: Must provide robust merge request (MR) features for collaborative code review, with options for approvals, discussions, and suggestions within the MR.

· Discussions and Threads: Must support in-line code comments, discussions, and threads within merge requests for effective code review (GitLab’s MR comments and threads improve team collaboration).

· Customizable Runners: Must provide support for self-hosted or shared runners to control build environments and workload distribution.

· Environment Management: Must provide the ability to manage and preview deployment environments and monitor each environment’s status.

· Automated Testing and Code Quality Reports: Must provide built-in integration for automated testing and analysis tools, including code quality reports and test summaries.

· Documentation and Wiki Support: Must provide the ability to create and maintain project documentation or Wiki pages within the repository.

· Permissions and Role Management: Must provide granular access control to set permissions by user roles.

· Audit Logs and Compliance Tracking: Must provide detailed audit logs and compliance features to track changes and meet industry standards.

· Branch Protection and Approvals: Must provide the capability to set protected branches and require approvals for merges to ensure secure code deployment.

· Project and Team Analytics: Must provide project metrics and team analytics to track contributions, velocity, and overall activity.

· Pipeline and Job Logs: Must provide detailed logging and monitoring of CI/CD pipelines for troubleshooting and performance analysis.

· Code Review Analytics: Must provide insights on code review performance, merge request times, and other metrics for process improvement.

· Integration with DevOps Tools: Must be compatible with third-party DevOps tools and services such as Kubernetes and Prometheus.

· Infrastructure as Code (IaC) Support: Must provide support for managing IaC directly in the repository, including CI/CD for IaC deployments.

· High Scalability and Availability: Must provide support for large, distributed teams with high availability options.

· Efficient Caching and Performance Optimization: Must provide built-in caching to reduce CI/CD job times and optimize resource use.

· Distributed Collaboration: Must support geographically dispersed teams to collaborate with minimal latency.

· User-Friendly Interface: Must provide an intuitive and customizable interface for ease of navigation.

· Comprehensive Documentation and Support: Must provide users access to extensive documentation, community support, and professional support plans.

· Customizable Notifications and Alerts: Must provide configurable notifications for merge requests, CI/CD pipelines, and other project events.

· Version Control: Must provide an integrated Version Control Service (VCS) with the following features:

· Must be capable of hosting git repositories,

· Must support the protection of a "main" or "master" branch and the creation of multiple other branches within the repository

· Must support a "merge" workflow to integrate the work on non-main branches ("feature branches" or "dev branches") into the protected primary branch

· Compliance: Must provide the ability to enforce policies for MRs that prevent project owners from overriding MR rules.

· Merge requests: Must provide the ability to do Merge trains, wherein merge requests are completed based on order and MR pipeline status.

· Scan execution policies: Must provide the ability to run pipelines and scans as policy, which allows for doing ad-hoc incident response.

· Tailored support: Must provide an integrated customer support model for expected use cases like meeting with P1 engineers, supporting critical CVE upgrades in Iron Bank, and being reachable via chat or other means.

· Mattermost notifications: Must provide the capability for P1 to enable webhooks to send notifications to P1's instance of Mattermost whenever any changes to repos are made or if issues are found in pipelines.

· Custom and built-in pipeline variable integrations: Must provide the ability to use built-in CI variables for easier runtime pipeline logic. Also with custom variables in pipelines, can make CI code more adaptable

· Robust API: Must provide an API that enables automation and integrations across other tools and datasets.

· Access tokens: Must provide the ability to create access tokens for personal use as well as per-repo and per-group use to scope down authentication. Access tokens must also have the ability to be scoped down in role and permissions to said groups and projects.

· Custom roles: Must provide the ability to create custom roles for specific, tailored functions within the DevOps platform.

· Auditing: Must provide the ability to audit all functions within each repository and determine user-level actions on settings manipulation and code tagging.

· DORA Metrics: Must provide CI/CD Metrics like deployment frequency, contributor level metrics, and repository analytics.

· Must be able to integrate code coverage metrics into MR dashboards.

· Must be able to support using tools like Renovate for library and dependency updates.

Desired:

· Provide NIST 800-53 controls for built-in SAST scanning capability.

· Provide testing compatibility with sidecar-less service meshes, e.g., Istio Ambient Mesh, Cillium, and other eBPF technology.