RFI_GitLab Ultimate_FY26 (1).xlsx
XLSX spreadsheet 30 KB Posted
- Attached to
- GitLab or Alternatives - Request for Information
- Solicitation number
- FA830726RB022
About this file
This is a Request for Information (RFI) issued by the Air Force Lifecycle Management Center (AFLCMC), Cryptologic and Cyber Systems Division (CCSD), located at Joint Base San Antonio - Lackland, Texas, for market research and planning purposes only. The RFI seeks information on alternative software solutions to GitLab Ultimate, with a focus on vendors proposing competing products rather than GitLab itself. Responses are strictly voluntary and will not affect future solicitation participation or entitle respondents to payment. The government explicitly states this is not a request for proposal, invitation for bid, or announcement of a solicitation, and no contract will be awarded based on this RFI.
The RFI requires vendors to complete three sections addressing alternative license types and capabilities, pricing information, and other considerations. Vendors must provide detailed comparisons of their alternative solutions against 65 specific requirements outlined in the Requirements Capability Sheet, including self-hosting and containerization capabilities, CI/CD pipeline support with YAML configuration, multiple package repository support (npm, NuGet, Python/pip, Maven/Gradle), security testing capabilities (SAST and DAST), source control management, compliance and audit features, service mesh compatibility (Istio), API functionality, role-based access control, and NIST 800-53 control compliance. Additionally, vendors must provide transition and training cost estimates, pricing plans (monthly, annual, trial options), information on value-added services, and confirm willingness to enter into contracts with a base year plus up to four one-year options. The RFI emphasizes that responses should address operational, security, and compliance needs, particularly multi-environment visibility and compliance auditing capabilities.
View the file
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
T&C and Contact Information
| Note: Please read and complete the middle portion. | |
| 1 | This Request for Information (RFI) is issued in accordance with the Federal Acquisition Regulation (FAR) clause 52.215-3 (Request for Information or Solicitation for Planning Purposes - Oct 1997) and is published to obtain information for use by the Air Force Lifecycle Management Center (AFLCMC), Cryptologic and Cyber Systems Division (CCSD), Joint Base San Antonio - Lackland, Texas, for market research and planning purposes only. |
| 2 | THIS RFI IS NOT A REQUEST FOR PROPOSAL, INVITATION FOR BID, OR AN ANNOUNCEMENT OF A SOLICITATION; IT IS ONLY INTENDED FOR INFORMATION OR PLANNING PURPOSES. There is no bid package or solicitation document associated with this announcement. Response to this RFI is strictly voluntary and will not affect any potential offeror's ability to submit an offer if a solicitation is released. Any requests for a solicitation package will be disregarded. The government does not intend to award a contract on the basis of this RFI or otherwise pay for the information solicited. No entitlement to payment of direct or indirect costs or charges by the government will arise as a result of preparing submissions in response to this RFI and the government's use of such information. Submittals will not be returned to the sender. Respondents to this RFI may be asked to provide additional information/details based on their initial submittals. |
| Company Name: | |
| CAGE Code: | |
| Address: | |
| POC Name: | |
| POC E-mail: | |
| POC Phone Number: | |
| 3 | As indicated above, this is solely market research for software alternatives. Please be advised that any quote for software that is already in use, quote for alternative software, or any submissions intended for award evaluation should not be included in conjunction with this document. Any input on this document that contains responses for the software already in-use should not be included and should only contain alternative software data/answers. Your responses will only be used for planning purposes. Please address any comments and/or questions you may have regarding this RFI in writing to the listed POC. |
RFI Q&A
Note: This document is only interested in alternative software. All three sheets in this document is to be completed.
| Alternative License Types: | |
| 1 | What alternative software do you offer that is similar to GitLab Ultimate? |
(Please provide details on available options, such as enterprise, cloud-managed, or open-source/community editions. For each alternative software option/solution, please provide how it differs from the listed license.) [ENTER ANSWER HERE]
2 For each alternative software option/solution, please provide how it is similar from the listed license.
(Please specify any feature restrictions, scalability limitations, or support differences among the licenses (e.g., data retention, search query limits, or alerting capabilities) [ENTER ANSWER HERE]
3 For each alternative software option/solution, please provide how it meets the above requirements.
(Please identify core features or capabilities that are shared across all options, such as log aggregation, visualization tools, and monitoring capabilities, regardless of the license tier type.) [ENTER ANSWER HERE]
4 For each alternative software option/solution, clarify how it meets our requirement needs per the Requirements Capability Sheet (Sheet 2).
(Please highlight specific ways in which each alternative software can address our operational, security, and compliance needs, particularly in areas like multi-environment visibility, role-based access control, and support for compliance auditing.) [ENTER ANSWER HERE]
| Pricing Information: | |
| 1 | For each alternative software, please provide estimated transition and training costs and schedule for both transitioning to and from your proposed solution. |
(Include details on onboarding costs, consulting, or configuration support required for a smooth transition. Specify any training options available, such as workshops, online courses, or documentation resources, and their associated costs.) [ENTER ANSWER HERE]
2 For each alternative software, please provide any price plans associated such as monthly, trial, annual.
(Indicate if discounts are offered for longer-term contracts or high-volume deployments. For cloud-managed options, provide cost breakdowns for storage, query processing, and other usage-based charges.) [ENTER ANSWER HERE]
| Other Considerations: | |
| 1 | Are there any additional features or benefits associated with the alternative software that we should consider? |
For example, are advanced analytics, machine learning-based anomaly detection, or pre-built integrations with other monitoring tools included at higher licensing tiers? - Please clarify any value-added services, such as dedicated account support, proactive health checks, or best-practice workshops, that come with certain licenses tiers. [ENTER ANSWER HERE]
2 Is your company willing to enter into contracts with a base year with up to four one-year options? If not, how many years is your company willing to agree to?
(For longer-term contracts, specify any guarantees on pricing, renewal terms, or opportunities to adjust the contract scope to accommodate potential changes in our data volume or monitoring requirements.) [ENTER ANSWER HERE]
Requirements Capability Sheet
| GitLab Ultimate ALTERNATIVE: | [TYPE NAME HERE] | ||||
| Requirement: | Ready on Day 1 | Future Capability | Estimated date of Capability | Comments | |
| 1 | · Must be capable of being self-hosted. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 2 | · Must be capable of being containerized. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 3 | · Must be deployable with containers and Helm Charts. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 4 | · Must be compatible with Amazon Web Services (AWS) EKS. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 5 | · The solution must be able to leverage Single Sign On (SSO), and OIDC and SAML compatibility. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 6 | · Must provide built-in CI/CD capabilities with pipeline support with configuration-as-code via YAML files. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 7 | · Must provide the ability to create templated CI/CD pipelines. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 8 | · Must be capable of hosting Linux Foundation Open Container Initiative (OCI) artifact registry. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 9 | · Must be capable of acting as a package repository for the following: | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 10 | Npm | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 11 | NuGet | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 12 | Python/pip | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 13 | Maven/Gradle | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 14 | Generic/tarbell artifacts | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 15 | · Must provide Static Application Security Testing (SAST) capability for scanning pipelines. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 16 | · Must support Dynamic Application Security Testing (DAST), license compliance, and dependency scanning. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 17 | · Vulnerability Management: Must provide clear vulnerability reporting and management with options for automatic vulnerability remediation (GitLab offers an in-depth vulnerability dashboard and dependency scanning). | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 18 | · Must provide a built-in Issue Tracker integrated with pipeline operations with issue management workflows. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 19 | · Must provide KanBan-style boards for planning and managing work. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 20 | · Needs-based pipelines: Pipeline must be able to be run in parallel and dependencies setup in a non-linear manner | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 21 | · Must have integrated source control management. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 22 | · Must have compatibility with service mesh usage–Istio at a minimum. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 23 | · Project Creation and Management: Must provide an ability to create and organize projects efficiently, with options for subgrouping and nesting within repositories. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 24 | · Repository Mirroring: Must provide a capability to mirror repositories to and from external sources to sync code across different servers. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 25 | · Customizable Project Templates: Must provide access to predefined project templates to standardize setup across repositories. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 26 | · Branching Strategy Support: Must support a range of branching strategies such as Git Flow, feature branches, and hotfix branches. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 27 | · Merge Request System: Must provide robust merge request (MR) features for collaborative code review, with options for approvals, discussions, and suggestions within the MR. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 28 | · Discussions and Threads: Must support in-line code comments, discussions, and threads within merge requests for effective code review (GitLab’s MR comments and threads improve team collaboration). | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 29 | · Customizable Runners: Must provide support for self-hosted or shared runners to control build environments and workload distribution. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 30 | · Environment Management: Must provide the ability to manage and preview deployment environments and monitor each environment’s status. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 31 | · Automated Testing and Code Quality Reports: Must provide built-in integration for automated testing and analysis tools, including code quality reports and test summaries. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 32 | · Documentation and Wiki Support: Must provide the ability to create and maintain project documentation or Wiki pages within the repository. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 33 | · Permissions and Role Management: Must provide granular access control to set permissions by user roles. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 34 | · Audit Logs and Compliance Tracking: Must provide detailed audit logs and compliance features to track changes and meet industry standards. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 35 | · Branch Protection and Approvals: Must provide the capability to set protected branches and require approvals for merges to ensure secure code deployment. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 36 | · Project and Team Analytics: Must provide project metrics and team analytics to track contributions, velocity, and overall activity. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 37 | · Pipeline and Job Logs: Must provide detailed logging and monitoring of CI/CD pipelines for troubleshooting and performance analysis. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 38 | · Code Review Analytics: Must provide insights on code review performance, merge request times, and other metrics for process improvement. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 39 | · Integration with DevOps Tools: Must be compatible with third-party DevOps tools and services such as Kubernetes and Prometheus. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 40 | · Infrastructure as Code (IaC) Support: Must provide support for managing IaC directly in the repository, including CI/CD for IaC deployments. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 41 | · High Scalability and Availability: Must provide support for large, distributed teams with high availability options. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 42 | · Efficient Caching and Performance Optimization: Must provide built-in caching to reduce CI/CD job times and optimize resource use. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 43 | · Distributed Collaboration: Must support geographically dispersed teams to collaborate with minimal latency. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 44 | · User-Friendly Interface: Must provide an intuitive and customizable interface for ease of navigation. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 45 | · Comprehensive Documentation and Support: Must provide users access to extensive documentation, community support, and professional support plans. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 46 | · Customizable Notifications and Alerts: Must provide configurable notifications for merge requests, CI/CD pipelines, and other project events. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 47 | · Version Control: Must provide an integrated Version Control Service (VCS) with the following features: | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 48 | o Must be capable of hosting git repositories, | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 49 | o Must support the protection of a "main" or "master" branch and the creation of multiple other branches within the repository | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 50 | o Must support a "merge" workflow to integrate the work on non-main branches ("feature branches" or "dev branches") into the protected primary branch | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 51 | · Compliance: Must provide the ability to enforce policies for MRs that prevent project owners from overriding MR rules. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 52 | · Merge requests: Must provide the ability to do Merge trains, wherein merge requests are completed based on order and MR pipeline status. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 53 | · Scan execution policies: Must provide the ability to run pipelines and scans as policy, which allows for doing ad-hoc incident response. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 54 | · Tailored support: Must provide an integrated customer support model for expected use cases like meeting with P1 engineers, supporting critical CVE upgrades in Iron Bank, and being reachable via chat or other means. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 55 | · Mattermost notifications: Must provide the capability for P1 to enable webhooks to send notifications to P1's instance of Mattermost whenever any changes to repos are made or if issues are found in pipelines. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 56 | · Custom and built-in pipeline variable integrations: Must provide the ability to use built-in CI variables for easier runtime pipeline logic. Also with custom variables in pipelines, can make CI code more adaptable | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 57 | · Robust API: Must provide an API that enables automation and integrations across other tools and datasets. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 58 | · Access tokens: Must provide the ability to create access tokens for personal use as well as per-repo and per-group use to scope down authentication. Access tokens must also have the ability to be scoped down in role and permissions to said groups and projects. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 59 | · Custom roles: Must provide the ability to create custom roles for specific, tailored functions within the DevOps platform. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 60 | · Auditing: Must provide the ability to audit all functions within each repository and determine user-level actions on settings manipulation and code tagging. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 61 | · DORA Metrics: Must provide CI/CD Metrics like deployment frequency, contributor level metrics, and repository analytics. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 62 | · Must be able to integrate code coverage metrics into MR dashboards. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 63 | · Must be able to support using tools like Renovate for library and dependency updates. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 64 | · Provide NIST 800-53 controls for built-in SAST scanning capability. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. | |
| 65 | · Provide testing compatibility with sidecar-less service meshes, e.g., Istio Ambient Mesh, Cillium, and other eBPF technology. | FALSE | FALSE | This Column is meant for the vendor to have space to answer the questions in more detail. |
File details come from the government source that posted it. Updated .