## Links ## Type of new component ## Review process To help us to make concise and sustainable decision when converting the prototype to a product, it is highly recommended that the PM and EM start with a self assessment with this checklist, and then engage the appropriate groups and/or departments to review if anything in doubt. This is **NOT** a gating process, rather a friendly checklist to ensure the success of the new component. The review should be quick and with the least number of steps. The review will likely have 2 DRIs as reviewers for each component to ensure we can move quickly and handle any out of office (OOO). ## Checklist Complete common and the appropriate checklists per the type of new component mentioned above (Skip any item if not applicable). ### Common - [ ] Definition and Goals - [ ] What the component does and what values it provides from the external and internal customer's perspective? - [ ] Is any existing component capable for the same use case? If so, why is the new component required? - [ ] What is the usage estimation in both .com and self-managed? - [ ] Who are the development and operation DRI groups? - [ ] Legal and Security - [ ] Are you conducting a legal and compliance review with legal department? - [ ] Are you conducting an in-depth security review of the component with security department? - [ ] What type of license do they use? - [ ] What is the data classification this component will process? - [ ] Support - [ ] Have you involved the Customer Support Team by drafting a [Support Readiness Issue](https://gitlab.com/gitlab-com/support/support-team-meta/-/issues/new?issuable_template=Support%20Readiness)? And complete it before releasing to customers. - [ ] Business - [ ] Margin impact - (sheet to be created) - [ ] What is the estimated cost of the component and associated support including infrastructure operations if any? - [ ] Architecture - [ ] Does the component support auto-scaling? If not, how does it handle a sudden traffic increasing? - [ ] What are the dependencies between existing GitLab services and this component? - [ ] What is the infrastructure requirement? - [ ] Is this SaaS only, or will it also be supported for Self-Managed and Dedicated? - [ ] Development, Testing, Deployment, and Operation - [ ] Complete the [production readiness review](https://about.gitlab.com/handbook/engineering/infrastructure/production/readiness/). - [ ] As the owner, are you confident to manage and maintain the new component end to end (E2E)? You can review below typical considerations as a guidance. -
Typical considerations - [ ] Talent pool, e.g. existing engineers, maintainers, and future hiring opportunities.
- [ ] Testing, e.g. end-to-end, dependencies, performance.
- [ ] Operational considerations, e.g. observability, hosting knowledge, etc.
### New GitLab service - [ ] Legal and Security - [ ] Is there any specific security standard and compliance required before deploying to production? If so, what needs to be done? - [ ] Architecture - [ ] Complete `New data store, third party dependency` checklist as well if a new dependency is used - [ ] Complete `New programming language, development, and testing framework` checklist as well if a new programming language, development, and/or testing framework is used ### New data store, third party dependency - [ ] Legal and Security - [ ] What is the [classification](https://about.gitlab.com/handbook/security/data-classification-standard.html#data-classification-levels) of data stored in the data store? - [ ] Have they got any security standards to meet our and/or our customers' requirements? (i.e. FIPS and/or Fed-RAMP) If not, what needs to be done? - [ ] Development, Testing, Deployment, and Operation - [ ] What integration types do they provide, e.g. SaaS and/or self-hosting? - [ ] Is rate limit possible? - [ ] What is the cadence of version upgrades? - [ ] What is their defect fix and security patch turnaround time? ### New programming language, development, and testing framework - [ ] Is there a mature ecosystem that provides tooling (profiling, debugging, etc.) and 3rd party libraries? /assign /label /cc /confidential