GitLab Unveils New Capabilities for the Governed Software Factory

GitLab is tackling the fragmentation of shadow software factories by connecting coding, security, and delivery steps under one governed system for AI-driven development.

Many organizations today assemble their software delivery from a patchwork of tools for coding, issue tracking, source code management and CI/CD, with no shared policy, identity, or audit trail. This fragmentation creates slow handoffs, broken context between stages, and leaves leaders unable to trace a change from plan to production. GitLab's new announcement addresses exactly this challenge by introducing capabilities that let AI agents work within set policies and standards, enabling teams to move AI-generated code into production safely.

What was announced

GitLab announced a set of capabilities designed to orchestrate, secure and optimize software development across the full lifecycle. The release targets the move beyond shadow software factories toward a governed software factory where agents operate under measurable controls.

• /goal in GitLab Duo Agent Platform and GitLab for Slack: automates work progression and eliminates waits between handoffs across the software lifecycle.
• GitLab Artifact Central (beta): one governed home for artifacts next to source code and CI, so teams assemble the right software every time.
• GitLab Dependency Firewall: blocks malicious, vulnerable, and non-compliant packages before they reach the build.
• Claude Mythos 5 and 5.1 by Anthropic: power new GitLab Duo Agent Platform flows that identify and remediate security findings on the path to production.
• GitLab Security Standard: defines five controls to reduce the time from detection to verified remediation for agentic software development.
• Duo Agent Platform Impact Analytics: shows cost and impact of AI-powered software delivery investment by team, task and model.

Why this matters

For CIOs, CISOs, IT directors and procurement leaders, the shift to AI-assisted development introduces new risks: unvetted dependencies, reused credentials, uncontrolled token spend, and lack of attribution for changes made by agents. GitLab's approach consolidates governance, security and analytics in one platform, giving leadership an auditable chain from plan to production. The result is a stronger defense posture for the software supply chain and clearer visibility into the business impact of AI investments.

Each vulnerability that remains open increases risk of exploitation, so hardening the defense posture for software delivery is now a board-level priority

Technical details

• Secrets management: GitLab Secrets Manager is generally available on GitLab.com and in GitLab Self-Managed 19.5, scoping each secret to the job that needs it and logging every event in the audit trail.
• Supply chain controls: Dependency Firewall prevents agents from pulling in unvetted packages during automated workflows.
• Agent efficiency: GitLab Orbit maps the software lifecycle into real-time knowledge agents can act on, enabling tasks with up to 45x fewer retries and 4.5x fewer tokens.
• AI model integration: Claude Mythos 5 and 5.1 by Anthropic power new remediation flows inside Duo Agent Platform.
• Governance framework: GitLab Security Standard defines five controls targeting faster, verified remediation in agentic development.

Softprom and GitLab

Softprom is the official partner of GitLab. Enterprise customers can access licensing, deployment and expert support through Softprom to adopt the governed software factory model with confidence.

This content was prepared as part of the Softprom DistriFlow project — an automated system for monitoring and adapting vendor news. Original source: original article.