Merge pull request #50962 from flokli/gitlab-updater

gitlab: 11.4.4 -> 11.5.0

15 files changed, 554 insertions, 267 deletions

diff --git a/nixos/tests/gitlab.nix b/nixos/tests/gitlab.nix
index 661caa8aa83..269da8aa215 100644
--- a/nixos/tests/gitlab.nix
+++ b/nixos/tests/gitlab.nix
@@ -16,6 +16,7 @@ import ./make-test.nix ({ pkgs, lib, ...} : with lib; {
 
       services.nginx = {
         enable = true;
+        recommendedProxySettings = true;
         virtualHosts = {
           "localhost" = {
             locations."/".proxyPass = "http://unix:/run/gitlab/gitlab-workhorse.socket";
@@ -75,7 +76,8 @@ import ./make-test.nix ({ pkgs, lib, ...} : with lib; {
     $gitlab->waitForUnit("gitlab.service");
     $gitlab->waitForUnit("gitlab-sidekiq.service");
     $gitlab->waitForFile("/var/gitlab/state/tmp/sockets/gitlab.socket");
-    $gitlab->waitUntilSucceeds("curl -sSf http://localhost/users/sign_in");
+    $gitlab->waitUntilSucceeds("curl -sSf http://gitlab/users/sign_in");
+    $gitlab->succeed("curl -isSf http://gitlab  | grep -i location | grep -q http://gitlab/users/sign_in");
     $gitlab->succeed("${pkgs.sudo}/bin/sudo -u gitlab -H gitlab-rake gitlab:check 1>&2")
   '';
 })
diff --git a/pkgs/applications/version-management/gitlab-shell/remove-hardcoded-locations.patch b/pkgs/applications/version-management/gitlab-shell/remove-hardcoded-locations.patch
deleted file mode 100644
index 38181399eec..00000000000
--- a/pkgs/applications/version-management/gitlab-shell/remove-hardcoded-locations.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-diff --git a/go/internal/config/config.go b/go/internal/config/config.go
-index c57b4de..88cfc95 100644
---- a/go/internal/config/config.go
-+++ b/go/internal/config/config.go
-@@ -27,7 +27,7 @@ func New() (*Config, error) {
- 	}
- 	cfg.RootDir = dir
- 
--	configBytes, err := ioutil.ReadFile(path.Join(cfg.RootDir, configFile))
-+	configBytes, err := ioutil.ReadFile("/run/gitlab/shell-config.yml")
- 	if err != nil {
- 		return nil, err
- 	}
-diff --git a/lib/gitlab_shell.rb b/lib/gitlab_shell.rb
-index 1452f95..2b40327 100644
---- a/lib/gitlab_shell.rb
-+++ b/lib/gitlab_shell.rb
-@@ -180,7 +180,8 @@ class GitlabShell
-     end
- 
-     # We use 'chdir: ROOT_PATH' to let the next executable know where config.yml is.
--    Kernel.exec(env, *args, unsetenv_others: true, chdir: ROOT_PATH)
-+    # Except we don't, because we're already in the right directory on nixos!
-+    Kernel.exec(env, *args, unsetenv_others: true)
-   end
- 
-   def api
diff --git a/pkgs/applications/version-management/gitlab-workhorse/deterministic-build.patch b/pkgs/applications/version-management/gitlab-workhorse/deterministic-build.patch
deleted file mode 100644
index da6dc5493ac..00000000000
--- a/pkgs/applications/version-management/gitlab-workhorse/deterministic-build.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/Makefile	2018-10-08 12:45:15.206269937 +0200
-+++ b/Makefile	2018-10-08 12:45:24.435366307 +0200
-@@ -6,7 +6,7 @@
- BIN_BUILD_DIR := $(TARGET_DIR)/bin
- PKG_BUILD_DIR := $(TARGET_DIR)/src/$(PKG)
- COVERAGE_DIR := $(TARGET_DIR)/cover
--VERSION := $(shell git describe)-$(shell date -u +%Y%m%d.%H%M%S)
-+VERSION := 6.1.1
- GOBUILD := go build -ldflags "-X main.Version=$(VERSION)"
- EXE_ALL := gitlab-zip-cat gitlab-zip-metadata gitlab-workhorse
- INSTALL := install
diff --git a/pkgs/applications/version-management/gitlab/data.json b/pkgs/applications/version-management/gitlab/data.json
new file mode 100644
index 00000000000..e2be6fb2a90
--- /dev/null
+++ b/pkgs/applications/version-management/gitlab/data.json
@@ -0,0 +1,32 @@
+{
+  "ce": {
+    "version": "11.5.0",
+    "repo_hash": "0cjkkap3n9g9zahrxk99a330ahyb6cvx97dsnrxcdsn0cbrsxsrb",
+    "deb_hash": "0kn7mg1lk4gvc3x76z4rbh0j03b0wk6x1p5938wx8sc50k0bgrcp",
+    "deb_url": "https://packages.gitlab.com/gitlab/gitlab-ce/packages/debian/stretch/gitlab-ce_11.5.0-ce.0_amd64.deb/download.deb",
+    "owner": "gitlab-org",
+    "repo": "gitlab-ce",
+    "rev": "v11.5.0",
+    "passthru": {
+      "GITALY_SERVER_VERSION": "0.129.0",
+      "GITLAB_PAGES_VERSION": "1.3.0",
+      "GITLAB_SHELL_VERSION": "8.4.1",
+      "GITLAB_WORKHORSE_VERSION": "7.1.0"
+    }
+  },
+  "ee": {
+    "version": "11.5.0",
+    "repo_hash": "1s2jr7vhbpklpcfjxgxnmq0zq14hh2aa6akdsb7ld7fj5lmzp00z",
+    "deb_hash": "108mgmlf947h200qrwg71ilhq5ihr4awxns6lqs2wa90ph9yq25c",
+    "deb_url": "https://packages.gitlab.com/gitlab/gitlab-ee/packages/debian/stretch/gitlab-ee_11.5.0-ee.0_amd64.deb/download.deb",
+    "owner": "gitlab-org",
+    "repo": "gitlab-ee",
+    "rev": "v11.5.0-ee",
+    "passthru": {
+      "GITALY_SERVER_VERSION": "0.129.0",
+      "GITLAB_PAGES_VERSION": "1.3.0",
+      "GITLAB_SHELL_VERSION": "8.4.1",
+      "GITLAB_WORKHORSE_VERSION": "7.1.0"
+    }
+  }
+}
\ No newline at end of file
diff --git a/pkgs/applications/version-management/gitlab/default.nix b/pkgs/applications/version-management/gitlab/default.nix
index c1c4d20feac..2ffe1141b5a 100644
--- a/pkgs/applications/version-management/gitlab/default.nix
+++ b/pkgs/applications/version-management/gitlab/default.nix
@@ -11,32 +11,22 @@ let
     groups = [ "default" "unicorn" "ed25519" "metrics" ];
   };
 
-  version = "11.4.4";
+  flavour = if gitlabEnterprise then "ee" else "ce";
+  data = (builtins.fromJSON (builtins.readFile ./data.json)).${flavour};
 
-  sources = if gitlabEnterprise then {
-    gitlabDeb = fetchurl {
-      url = "https://packages.gitlab.com/gitlab/gitlab-ee/packages/debian/stretch/gitlab-ee_${version}-ee.0_amd64.deb/download.deb";
-      sha256 = "15lpcdjcw6lpmzlhqnpd6pgaxh7wvx2mldjd1vqr414r4bcnhgy4";
-    };
+  version = data.version;
+  sources = {
     gitlab = fetchFromGitLab {
-      owner = "gitlab-org";
-      repo = "gitlab-ee";
-      rev = "v${version}-ee";
-      sha256 = "046hchr7q4jnx3j4yxg3rdixfzlva35al3ci26pf9vxrbbl5y8cg";
+      owner = data.owner;
+      repo = data.repo;
+      rev = data.rev;
+      sha256 = data.repo_hash;
     };
-  } else {
     gitlabDeb = fetchurl {
-      url = "https://packages.gitlab.com/gitlab/gitlab-ce/packages/debian/stretch/gitlab-ce_${version}-ce.0_amd64.deb/download.deb";
-      sha256 = "02p7azyjgb984bk491q6f4zk1mikbcd38rif08kl07bjjzzkir81";
-    };
-    gitlab = fetchFromGitLab {
-      owner = "gitlab-org";
-      repo = "gitlab-ce";
-      rev = "v${version}";
-      sha256 = "1hq9iyp0xrxwmncn61ja3pdj9h2hmdy1l63d1ic3r1dyacybaf2g";
+      url = data.deb_url;
+      sha256 = data.deb_hash;
     };
   };
-
 in
 
 stdenv.mkDerivation rec {
@@ -101,6 +91,10 @@ stdenv.mkDerivation rec {
   passthru = {
     inherit rubyEnv;
     ruby = rubyEnv.wrappedRuby;
+    GITALY_SERVER_VERSION = data.passthru.GITALY_SERVER_VERSION;
+    GITLAB_PAGES_VERSION = data.passthru.GITLAB_PAGES_VERSION;
+    GITLAB_SHELL_VERSION = data.passthru.GITLAB_SHELL_VERSION;
+    GITLAB_WORKHORSE_VERSION = data.passthru.GITLAB_WORKHORSE_VERSION;
   };
 
   meta = with lib; {
diff --git a/pkgs/applications/version-management/gitaly/Gemfile b/pkgs/applications/version-management/gitlab/gitaly/Gemfile
index 2b752992fec..016f80284da 100644
--- a/pkgs/applications/version-management/gitaly/Gemfile
+++ b/pkgs/applications/version-management/gitlab/gitaly/Gemfile
@@ -1,14 +1,17 @@
 source 'https://rubygems.org'
 
-gem 'rugged', '~> 0.27.4'
+# Require bundler >= 1.16.5 to avoid this bug: https://github.com/bundler/bundler/issues/6537
+gem 'bundler', '>= 1.16.5'
+
+gem 'rugged', '~> 0.27'
 gem 'github-linguist', '~> 6.1', require: 'linguist'
 gem 'gitlab-markup', '~> 1.6.4'
-gem 'gitaly-proto', '~> 0.116.0', require: 'gitaly'
+gem 'gitaly-proto', '~> 0.123.0', require: 'gitaly'
 gem 'activesupport', '~> 5.0.2'
 gem 'rdoc', '~> 4.2'
 gem 'gitlab-gollum-lib', '~> 4.2', require: false
 gem 'gitlab-gollum-rugged_adapter', '~> 0.4.4', require: false
-gem 'grpc', '~> 1.11.0'
+gem 'grpc', '~> 1.15.0'
 gem 'sentry-raven', '~> 2.7.2', require: false
 gem 'faraday', '~> 0.12'
 
@@ -16,10 +19,12 @@ gem 'faraday', '~> 0.12'
 # This version needs to be in sync with GitLab CE/EE
 gem 'licensee', '~> 8.9.0'
 
-# Locked until https://github.com/google/protobuf/issues/4210 is closed
-gem 'google-protobuf', '= 3.5.1'
+gem 'google-protobuf', '~> 3.6'
 
 group :development, :test do
-  gem 'gitlab-styles', '~> 2.0.0', require: false
+  gem 'rubocop', '~> 0.50', require: false
   gem 'rspec', require: false
+  gem 'rspec-parameterized', require: false
+  gem 'timecop', require: false
+  gem 'factory_bot', require: false
 end
diff --git a/pkgs/applications/version-management/gitaly/Gemfile.lock b/pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock
index d76ba86c398..0340853524b 100644
--- a/pkgs/applications/version-management/gitaly/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock
@@ -1,26 +1,37 @@
 GEM
   remote: https://rubygems.org/
   specs:
+    abstract_type (0.0.7)
     activesupport (5.0.6)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (~> 0.7)
       minitest (~> 5.1)
       tzinfo (~> 1.1)
-    addressable (2.5.2)
-      public_suffix (>= 2.0.2, < 4.0)
-    ast (2.3.0)
+    adamantium (0.2.0)
+      ice_nine (~> 0.11.0)
+      memoizable (~> 0.4.0)
+    ast (2.4.0)
+    binding_of_caller (0.8.0)
+      debug_inspector (>= 0.0.1)
     charlock_holmes (0.7.6)
+    coderay (1.1.2)
+    concord (0.1.5)
+      adamantium (~> 0.2.0)
+      equalizer (~> 0.0.9)
     concurrent-ruby (1.0.5)
     crass (1.0.4)
+    debug_inspector (0.0.3)
     diff-lcs (1.3)
+    equalizer (0.0.11)
     escape_utils (1.2.1)
-    faraday (0.12.2)
+    factory_bot (4.11.1)
+      activesupport (>= 3.0.0)
+    faraday (0.15.3)
       multipart-post (>= 1.2, < 3)
     gemojione (3.3.0)
       json
-    gitaly-proto (0.116.0)
-      google-protobuf (~> 3.1)
-      grpc (~> 1.10)
+    gitaly-proto (0.123.0)
+      grpc (~> 1.0)
     github-linguist (6.2.0)
       charlock_holmes (~> 0.7.6)
       escape_utils (~> 1.2.0)
@@ -44,60 +55,44 @@ GEM
       mime-types (>= 1.16)
       posix-spawn (~> 0.3)
     gitlab-markup (1.6.4)
-    gitlab-styles (2.0.0)
-      rubocop (~> 0.49)
-      rubocop-gitlab-security (~> 0.1.0)
-      rubocop-rspec (~> 1.15)
     gollum-grit_adapter (1.0.1)
       gitlab-grit (~> 2.7, >= 2.7.1)
-    google-protobuf (3.5.1)
-    googleapis-common-protos-types (1.0.1)
+    google-protobuf (3.6.1)
+    googleapis-common-protos-types (1.0.2)
       google-protobuf (~> 3.0)
-    googleauth (0.6.2)
-      faraday (~> 0.12)
-      jwt (>= 1.4, < 3.0)
-      logging (~> 2.0)
-      memoist (~> 0.12)
-      multi_json (~> 1.11)
-      os (~> 0.9)
-      signet (~> 0.7)
-    grpc (1.11.0)
+    grpc (1.15.0)
       google-protobuf (~> 3.1)
       googleapis-common-protos-types (~> 1.0.0)
-      googleauth (>= 0.5.1, < 0.7)
     i18n (0.8.1)
+    ice_nine (0.11.2)
     json (2.1.0)
-    jwt (2.1.0)
     licensee (8.9.2)
       rugged (~> 0.24)
-    little-plugger (1.1.4)
-    logging (2.2.2)
-      little-plugger (~> 1.1)
-      multi_json (~> 1.10)
-    memoist (0.16.0)
+    memoizable (0.4.2)
+      thread_safe (~> 0.3, >= 0.3.1)
     mime-types (3.2.2)
       mime-types-data (~> 3.2015)
     mime-types-data (3.2018.0812)
     mini_portile2 (2.3.0)
     minitest (5.9.1)
-    multi_json (1.13.1)
     multipart-post (2.0.0)
     nokogiri (1.8.4)
       mini_portile2 (~> 2.3.0)
     nokogumbo (1.5.0)
       nokogiri
-    os (0.9.6)
-    parallel (1.12.0)
-    parser (2.4.0.0)
-      ast (~> 2.2)
+    parallel (1.12.1)
+    parser (2.5.1.2)
+      ast (~> 2.4.0)
     posix-spawn (0.3.13)
-    powerpack (0.1.1)
-    public_suffix (3.0.2)
-    rainbow (2.2.2)
-      rake
-    rake (12.1.0)
+    powerpack (0.1.2)
+    proc_to_ast (0.1.0)
+      coderay
+      parser
+      unparser
+    procto (0.0.3)
+    rainbow (3.0.0)
     rdoc (4.3.0)
-    rouge (3.2.1)
+    rouge (3.3.0)
     rspec (3.7.0)
       rspec-core (~> 3.7.0)
       rspec-expectations (~> 3.7.0)
@@ -110,56 +105,66 @@ GEM
     rspec-mocks (3.7.0)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.7.0)
+    rspec-parameterized (0.4.0)
+      binding_of_caller
+      parser
+      proc_to_ast
+      rspec (>= 2.13, < 4)
+      unparser
     rspec-support (3.7.1)
-    rubocop (0.50.0)
+    rubocop (0.54.0)
       parallel (~> 1.10)
-      parser (>= 2.3.3.1, < 3.0)
+      parser (>= 2.5)
       powerpack (~> 0.1)
-      rainbow (>= 2.2.2, < 3.0)
+      rainbow (>= 2.2.2, < 4.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (~> 1.0, >= 1.0.1)
-    rubocop-gitlab-security (0.1.0)
-      rubocop (>= 0.47.1)
-    rubocop-rspec (1.17.0)
-      rubocop (>= 0.50.0)
-    ruby-progressbar (1.8.3)
-    rugged (0.27.4)
+    ruby-progressbar (1.10.0)
+    rugged (0.27.5)
     sanitize (4.6.6)
       crass (~> 1.0.2)
       nokogiri (>= 1.4.4)
       nokogumbo (~> 1.4)
     sentry-raven (2.7.2)
       faraday (>= 0.7.6, < 1.0)
-    signet (0.8.1)
-      addressable (~> 2.3)
-      faraday (~> 0.9)
-      jwt (>= 1.5, < 3.0)
-      multi_json (~> 1.10)
     stringex (2.8.4)
     thread_safe (0.3.6)
+    timecop (0.9.1)
     tzinfo (1.2.2)
       thread_safe (~> 0.1)
-    unicode-display_width (1.3.0)
+    unicode-display_width (1.4.0)
+    unparser (0.2.8)
+      abstract_type (~> 0.0.7)
+      adamantium (~> 0.2.0)
+      concord (~> 0.1.5)
+      diff-lcs (~> 1.3)
+      equalizer (~> 0.0.9)
+      parser (>= 2.3.1.2, < 2.6)
+      procto (~> 0.0.2)
 
 PLATFORMS
   ruby
 
 DEPENDENCIES
   activesupport (~> 5.0.2)
+  bundler (>= 1.16.5)
+  factory_bot
   faraday (~> 0.12)
-  gitaly-proto (~> 0.116.0)
+  gitaly-proto (~> 0.123.0)
   github-linguist (~> 6.1)
   gitlab-gollum-lib (~> 4.2)
   gitlab-gollum-rugged_adapter (~> 0.4.4)
   gitlab-markup (~> 1.6.4)
-  gitlab-styles (~> 2.0.0)
-  google-protobuf (= 3.5.1)
-  grpc (~> 1.11.0)
+  google-protobuf (~> 3.6)
+  grpc (~> 1.15.0)
   licensee (~> 8.9.0)
   rdoc (~> 4.2)
   rspec
-  rugged (~> 0.27.4)
+  rspec-parameterized
+  rubocop (~> 0.50)
+  rugged (~> 0.27)
   sentry-raven (~> 2.7.2)
+  timecop
 
 BUNDLED WITH
-   1.16.4
+   1.17.1
diff --git a/pkgs/applications/version-management/gitaly/default.nix b/pkgs/applications/version-management/gitlab/gitaly/default.nix
index 88bd0b9f10d..951dbf0bf25 100644
--- a/pkgs/applications/version-management/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@@ -7,14 +7,14 @@ let
     gemdir = ./.;
   };
 in buildGoPackage rec {
-  version = "0.125.1";
+  version = "0.129.0";
   name = "gitaly-${version}";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitaly";
     rev = "v${version}";
-    sha256 = "0vbxjqjs1r5c350r67812andasby5zk25xlaqp201lmlvamiv0ni";
+    sha256 = "0lidqa0w0vy87p5xfmqrfvbyzvl9wj2p918qs2f5rc7shzm38rn6";
   };
 
   goPackagePath = "gitlab.com/gitlab-org/gitaly";
diff --git a/pkgs/applications/version-management/gitaly/gemset.nix b/pkgs/applications/version-management/gitlab/gitaly/gemset.nix
index 0717555b382..9bf5601bf63 100644
--- a/pkgs/applications/version-management/gitaly/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/gemset.nix
@@ -1,4 +1,12 @@
 {
+  abstract_type = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "09330cmhrc2wmfhdj9zzg82sv6cdhm3qgdkva5ni5xfjril2pf14";
+      type = "gem";
+    };
+    version = "0.0.7";
+  };
   activesupport = {
     dependencies = ["concurrent-ruby" "i18n" "minitest" "tzinfo"];
     source = {
@@ -8,22 +16,31 @@
     };
     version = "5.0.6";
   };
-  addressable = {
-    dependencies = ["public_suffix"];
+  adamantium = {
+    dependencies = ["ice_nine" "memoizable"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0viqszpkggqi8hq87pqp0xykhvz60g99nwmkwsb0v45kc2liwxvk";
+      sha256 = "0165r2ikgfwv2rm8dzyijkp74fvg0ni72hpdx8ay2v7cj08dqyak";
       type = "gem";
     };
-    version = "2.5.2";
+    version = "0.2.0";
   };
   ast = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0pp82blr5fakdk27d1d21xq9zchzb6vmyb1zcsl520s3ygvprn8m";
+      sha256 = "184ssy3w93nkajlz2c70ifm79jp3j737294kbc5fjw69v1w0n9x7";
       type = "gem";
     };
-    version = "2.3.0";
+    version = "2.4.0";
+  };
+  binding_of_caller = {
+    dependencies = ["debug_inspector"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "05syqlks7463zsy1jdfbbdravdhj9hpj5pv2m74blqpv8bq4vv5g";
+      type = "gem";
+    };
+    version = "0.8.0";
   };
   charlock_holmes = {
     source = {
@@ -33,6 +50,23 @@
     };
     version = "0.7.6";
   };
+  coderay = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "15vav4bhcc2x3jmi3izb11l4d9f3xv8hp2fszb7iqmpsccv1pz4y";
+      type = "gem";
+    };
+    version = "1.1.2";
+  };
+  concord = {
+    dependencies = ["adamantium" "equalizer"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1b6cdn0fg4n9gzbdr7zyf4jq40y6h0c0g9cra7wk9hhmsylk91bg";
+      type = "gem";
+    };
+    version = "0.1.5";
+  };
   concurrent-ruby = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -49,6 +83,14 @@
     };
     version = "1.0.4";
   };
+  debug_inspector = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0vxr0xa1mfbkfcrn71n7c4f2dj7la5hvphn904vh20j3x4j5lrx0";
+      type = "gem";
+    };
+    version = "0.0.3";
+  };
   diff-lcs = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -57,6 +99,14 @@
     };
     version = "1.3";
   };
+  equalizer = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1kjmx3fygx8njxfrwcmn7clfhjhb6bvv3scy2lyyi0wqyi3brra4";
+      type = "gem";
+    };
+    version = "0.0.11";
+  };
   escape_utils = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -65,14 +115,23 @@
     };
     version = "1.2.1";
   };
+  factory_bot = {
+    dependencies = ["activesupport"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "13q1b7imb591068plg4ashgsqgzarvfjz6xxn3jk6klzikz5zhg1";
+      type = "gem";
+    };
+    version = "4.11.1";
+  };
   faraday = {
     dependencies = ["multipart-post"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "157c4cmb5g1b3ny6k9qf9z57rfijl54fcq3hnqqf6g31g1m096b2";
+      sha256 = "16hwxc8v0z6gkanckjhx0ffgqmzpc4ywz4dfhxpjlz2mbz8d5m52";
       type = "gem";
     };
-    version = "0.12.2";
+    version = "0.15.3";
   };
   gemojione = {
     dependencies = ["json"];
@@ -84,13 +143,13 @@
     version = "3.3.0";
   };
   gitaly-proto = {
-    dependencies = ["google-protobuf" "grpc"];
+    dependencies = ["grpc"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "15946776v5v8c2jisknjm82s4q3b3q9x2xygjf4bkk4m45n766w1";
+      sha256 = "16b9sdaimhcda401z2s7apf0nz6y0lxs74xhkwlz4jzf6ms44mgg";
       type = "gem";
     };
-    version = "0.116.0";
+    version = "0.123.0";
   };
   github-linguist = {
     dependencies = ["charlock_holmes" "escape_utils" "mime-types" "rugged"];
@@ -144,15 +203,6 @@
     };
     version = "1.6.4";
   };
-  gitlab-styles = {
-    dependencies = ["rubocop" "rubocop-gitlab-security" "rubocop-rspec"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1k8xrkjx8rcny8p0gsp18wskvn1qbw4rfgdp1f6x0p4xp6dlhjf4";
-      type = "gem";
-    };
-    version = "2.0.0";
-  };
   gollum-grit_adapter = {
     dependencies = ["gitlab-grit"];
     source = {
@@ -165,37 +215,28 @@
   google-protobuf = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0s8ijd9wdrkqwsb6nasrsv7f9i5im2nyax7f7jlb5y9vh8nl98qi";
+      sha256 = "134d3ini9ymdwxpz445m28ss9x0m6vcpijcdkzvgk4n538wdmppf";
       type = "gem";
     };
-    version = "3.5.1";
+    version = "3.6.1";
   };
   googleapis-common-protos-types = {
     dependencies = ["google-protobuf"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0yf10s7w8wpa49hc86z7z2fkn9yz7j2njz0n8xmqb24ji090z4ck";
+      sha256 = "01ds7g01pxqm3mg283xjzy0lhhvvhvzw3m7gf7szd1r7la4wf0qq";
       type = "gem";
     };
-    version = "1.0.1";
-  };
-  googleauth = {
-    dependencies = ["faraday" "jwt" "logging" "memoist" "multi_json" "os" "signet"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "08z4zfj9cwry13y8c2w5p4xylyslxxjq4wahd95bk1ddl5pknd4f";
-      type = "gem";
-    };
-    version = "0.6.2";
+    version = "1.0.2";
   };
   grpc = {
-    dependencies = ["google-protobuf" "googleapis-common-protos-types" "googleauth"];
+    dependencies = ["google-protobuf" "googleapis-common-protos-types"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1is4czi3i7y6zyxzyrpsma1z91axmc0jz2ngr6ckixqd3629npkz";
+      sha256 = "0m2wspnm1cfkmhlbp7yqv5bb4vsfh246cm0aavxra67aw4l8plhb";
       type = "gem";
     };
-    version = "1.11.0";
+    version = "1.15.0";
   };
   i18n = {
     source = {
@@ -205,18 +246,18 @@
     };
     version = "0.8.1";
   };
-  json = {
+  ice_nine = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "01v6jjpvh3gnq6sgllpfqahlgxzj50ailwhj9b3cd20hi2dx0vxp";
+      sha256 = "1nv35qg1rps9fsis28hz2cq2fx1i96795f91q4nmkm934xynll2x";
       type = "gem";
     };
-    version = "2.1.0";
+    version = "0.11.2";
   };
-  jwt = {
+  json = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1w0kaqrbl71cq9sbnixc20x5lqah3hs2i93xmhlfdg2y3by7yzky";
+      sha256 = "01v6jjpvh3gnq6sgllpfqahlgxzj50ailwhj9b3cd20hi2dx0vxp";
       type = "gem";
     };
     version = "2.1.0";
@@ -230,30 +271,14 @@
     };
     version = "8.9.2";
   };
-  little-plugger = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1frilv82dyxnlg8k1jhrvyd73l6k17mxc5vwxx080r4x1p04gwym";
-      type = "gem";
-    };
-    version = "1.1.4";
-  };
-  logging = {
-    dependencies = ["little-plugger" "multi_json"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "06j6iaj89h9jhkx1x3hlswqrfnqds8br05xb1qra69dpvbdmjcwn";
-      type = "gem";
-    };
-    version = "2.2.2";
-  };
-  memoist = {
+  memoizable = {
+    dependencies = ["thread_safe"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0pq8fhqh8w25qcw9v3vzfb0i6jp0k3949ahxc3wrwz2791dpbgbh";
+      sha256 = "0v42bvghsvfpzybfazl14qhkrjvx0xlmxz0wwqc960ga1wld5x5c";
       type = "gem";
     };
-    version = "0.16.0";
+    version = "0.4.2";
   };
   mime-types = {
     dependencies = ["mime-types-data"];
@@ -288,14 +313,6 @@
     };
     version = "5.9.1";
   };
-  multi_json = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1rl0qy4inf1mp8mybfk56dfga0mvx97zwpmq5xmiwl5r770171nv";
-      type = "gem";
-    };
-    version = "1.13.1";
-  };
   multipart-post = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -322,30 +339,22 @@
     };
     version = "1.5.0";
   };
-  os = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1llv8w3g2jwggdxr5a5cjkrnbbfnvai3vxacxxc0fy84xmz3hymz";
-      type = "gem";
-    };
-    version = "0.9.6";
-  };
   parallel = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0qv2yj4sxr36ga6xdxvbq9h05hn10bwcbkqv6j6q1fiixhsdnnzd";
+      sha256 = "01hj8v1qnyl5ndrs33g8ld8ibk0rbcqdpkpznr04gkbxd11pqn67";
       type = "gem";
     };
-    version = "1.12.0";
+    version = "1.12.1";
   };
   parser = {
     dependencies = ["ast"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "130rfk8a2ws2fyq52hmi1n0xakylw39wv4x1qhai4z17x2b0k9cq";
+      sha256 = "1zp89zg7iypncszxsjp8kiccrpbdf728jl449g6cnfkz990fyb5k";
       type = "gem";
     };
-    version = "2.4.0.0";
+    version = "2.5.1.2";
   };
   posix-spawn = {
     source = {
@@ -358,35 +367,35 @@
   powerpack = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1fnn3fli5wkzyjl4ryh0k90316shqjfnhydmc7f8lqpi0q21va43";
+      sha256 = "1r51d67wd467rpdfl6x43y84vwm8f5ql9l9m85ak1s2sp3nc5hyv";
       type = "gem";
     };
-    version = "0.1.1";
+    version = "0.1.2";
   };
-  public_suffix = {
+  proc_to_ast = {
+    dependencies = ["coderay" "parser" "unparser"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1x5h1dh1i3gwc01jbg01rly2g6a1qwhynb1s8a30ic507z1nh09s";
+      sha256 = "14c65w48bbzp5lh1cngqd1y25kqvfnq1iy49hlzshl12dsk3z9wj";
       type = "gem";
     };
-    version = "3.0.2";
+    version = "0.1.0";
   };
-  rainbow = {
-    dependencies = ["rake"];
+  procto = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "08w2ghc5nv0kcq5b257h7dwjzjz1pqcavajfdx2xjyxqsvh2y34w";
+      sha256 = "13imvg1x50rz3r0yyfbhxwv72lbf7q28qx9l9nfbb91h2n9ch58c";
       type = "gem";
     };
-    version = "2.2.2";
+    version = "0.0.3";
   };
-  rake = {
+  rainbow = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0mfqgpp3m69s5v1rd51lfh5qpjwyia5p4rg337pw8c8wzm6pgfsw";
+      sha256 = "0bb2fpjspydr6x0s8pn1pqkzmxszvkfapv0p4627mywl7ky4zkhk";
       type = "gem";
     };
-    version = "12.1.0";
+    version = "3.0.0";
   };
   rdoc = {
     source = {
@@ -399,10 +408,10 @@
   rouge = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0h79gn2wmn1wix2d27lgiaimccyj8gvizrllyym500pir408x62f";
+      sha256 = "1digsi2s8wyzx8vsqcxasw205lg6s7izx8jypl8rrpjwshmv83ql";
       type = "gem";
     };
-    version = "3.2.1";
+    version = "3.3.0";
   };
   rspec = {
     dependencies = ["rspec-core" "rspec-expectations" "rspec-mocks"];
@@ -440,56 +449,47 @@
     };
     version = "3.7.0";
   };
-  rspec-support = {
+  rspec-parameterized = {
+    dependencies = ["binding_of_caller" "parser" "proc_to_ast" "rspec" "unparser"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1nl30xb6jmcl0awhqp6jycl01wdssblifwy921phfml70rd9flj1";
+      sha256 = "0arynbr6cfjhccwc8gy2xf87nybdnncsnmfwknnh8s7d4mj730p0";
       type = "gem";
     };
-    version = "3.7.1";
+    version = "0.4.0";
   };
-  rubocop = {
-    dependencies = ["parallel" "parser" "powerpack" "rainbow" "ruby-progressbar" "unicode-display_width"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1hpd7zcv4y9y750wj630abvmcjwv39dsrj1fjff60ik7gfri0xlz";
-      type = "gem";
-    };
-    version = "0.50.0";
-  };
-  rubocop-gitlab-security = {
-    dependencies = ["rubocop"];
+  rspec-support = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0aw9qmyc6xj6fi0jxp8m4apk358rd91z492ragn6jp4rghkqj5cy";
+      sha256 = "1nl30xb6jmcl0awhqp6jycl01wdssblifwy921phfml70rd9flj1";
       type = "gem";
     };
-    version = "0.1.0";
+    version = "3.7.1";
   };
-  rubocop-rspec = {
-    dependencies = ["rubocop"];
+  rubocop = {
+    dependencies = ["parallel" "parser" "powerpack" "rainbow" "ruby-progressbar" "unicode-display_width"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1hf48ng67yswvshmv4cyysj1rs1z3fnvlycr50jdcgwlynpyxkhs";
+      sha256 = "106y99lq0fg62k3vk1w5wwb4vq16pnh4l61skc82xck627z0h8is";
       type = "gem";
     };
-    version = "1.17.0";
+    version = "0.54.0";
   };
   ruby-progressbar = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "029kv0q3kfq53rjyak4ypn7196l8z4hflfmv4p5787n78z7baiqf";
+      sha256 = "1cv2ym3rl09svw8940ny67bav7b2db4ms39i4raaqzkf59jmhglk";
       type = "gem";
     };
-    version = "1.8.3";
+    version = "1.10.0";
   };
   rugged = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1y6k5yrfmhc1v4albbpa3xzl28vk5lric3si8ada28sp9mmk2x72";
+      sha256 = "1jv4nw9hvlxp8hhhlllrfcznki82i50fp1sj65zsjllfl2bvz8x6";
       type = "gem";
     };
-    version = "0.27.4";
+    version = "0.27.5";
   };
   sanitize = {
     dependencies = ["crass" "nokogiri" "nokogumbo"];
@@ -509,15 +509,6 @@
     };
     version = "2.7.2";
   };
-  signet = {
-    dependencies = ["addressable" "faraday" "jwt" "multi_json"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0js81lxqirdza8gf2f6avh11fny49ygmxfi1qx7jp8l9wrhznbkv";
-      type = "gem";
-    };
-    version = "0.8.1";
-  };
   stringex = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -534,6 +525,14 @@
     };
     version = "0.3.6";
   };
+  timecop = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0d7mm786180v4kzvn1f77rhfppsg5n0sq2bdx63x9nv114zm8jrp";
+      type = "gem";
+    };
+    version = "0.9.1";
+  };
   tzinfo = {
     dependencies = ["thread_safe"];
     source = {
@@ -546,9 +545,18 @@
   unicode-display_width = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "12pi0gwqdnbx1lv5136v3vyr0img9wr0kxcn4wn54ipq4y41zxq8";
+      sha256 = "0040bsdpcmvp8w31lqi2s9s4p4h031zv52401qidmh25cgyh4a57";
+      type = "gem";
+    };
+    version = "1.4.0";
+  };
+  unparser = {
+    dependencies = ["abstract_type" "adamantium" "concord" "diff-lcs" "equalizer" "parser" "procto"];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0rh1649846ac17av30x0b0v9l45v0x1j2y1i8m1a7xdd0v4sld0z";
       type = "gem";
     };
-    version = "1.3.0";
+    version = "0.2.8";
   };
 }
\ No newline at end of file
diff --git a/pkgs/applications/version-management/gitlab-shell/default.nix b/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
index 69c4b9a255e..c9f21047e5b 100644
--- a/pkgs/applications/version-management/gitlab-shell/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
@@ -1,14 +1,14 @@
 { stdenv, ruby, bundler, fetchFromGitLab, go }:
 
 stdenv.mkDerivation rec {
-  version = "8.3.3";
+  version = "8.4.1";
   name = "gitlab-shell-${version}";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-shell";
     rev = "v${version}";
-    sha256 = "1qapw0yvlw1nxjik7jpbbbl3yx299sfvdx67zsd5ai7bhk1gd8xl";
+    sha256 = "00jzrpdfqgrba2qi5ngc0g07p7gmip7my563hw542gg8l88d27xq";
   };
 
   buildInputs = [ ruby bundler go ];
diff --git a/pkgs/applications/version-management/gitlab/gitlab-shell/remove-hardcoded-locations.patch b/pkgs/applications/version-management/gitlab/gitlab-shell/remove-hardcoded-locations.patch
new file mode 100644
index 00000000000..6d29f5f9e6c
--- /dev/null
+++ b/pkgs/applications/version-management/gitlab/gitlab-shell/remove-hardcoded-locations.patch
@@ -0,0 +1,45 @@
+diff --git a/go/internal/config/config.go b/go/internal/config/config.go
+index 435cb29..078c1df 100644
+--- a/go/internal/config/config.go
++++ b/go/internal/config/config.go
+@@ -2,7 +2,6 @@ package config
+ 
+ import (
+ 	"io/ioutil"
+-	"os"
+ 	"path"
+ 
+ 	yaml "gopkg.in/yaml.v2"
+@@ -26,16 +25,13 @@ type Config struct {
+ }
+ 
+ func New() (*Config, error) {
+-	dir, err := os.Getwd()
+-	if err != nil {
+-		return nil, err
+-	}
++	dir := "/run/gitlab"
+ 
+ 	return NewFromDir(dir)
+ }
+ 
+ func NewFromDir(dir string) (*Config, error) {
+-	return newFromFile(path.Join(dir, configFile))
++	return newFromFile(path.Join(dir, "shell-config.yml"))
+ }
+ 
+ func newFromFile(filename string) (*Config, error) {
+diff --git a/lib/gitlab_shell.rb b/lib/gitlab_shell.rb
+index 57c70f5..700569b 100644
+--- a/lib/gitlab_shell.rb
++++ b/lib/gitlab_shell.rb
+@@ -187,7 +187,8 @@ class GitlabShell # rubocop:disable Metrics/ClassLength
+ 
+     args = [executable, gitaly_address, json_args]
+     # We use 'chdir: ROOT_PATH' to let the next executable know where config.yml is.
+-    Kernel.exec(env, *args, unsetenv_others: true, chdir: ROOT_PATH)
++    # Except we don't, because we're already in the right directory on nixos!
++    Kernel.exec(env, *args, unsetenv_others: true)
+   end
+ 
+   def api
diff --git a/pkgs/applications/version-management/gitlab-workhorse/default.nix b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
index 3fab965bf54..e77dbc323a3 100644
--- a/pkgs/applications/version-management/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
@@ -3,18 +3,18 @@
 stdenv.mkDerivation rec {
   name = "gitlab-workhorse-${version}";
 
-  version = "7.0.0";
+  version = "7.1.0";
 
-  srcs = fetchFromGitLab {
+  src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-workhorse";
     rev = "v${version}";
-    sha256 = "1mmfb7h5sbva2kv9h9cxfg7dyksxrwwikq7jwggfawqaadzwm677";
+    sha256 = "1jq28z2kf58wnbv8jkwfx2bm8ki22hpm9ssdy2ymza22gq0zx00g";
   };
 
   buildInputs = [ git go ];
 
-  patches = [ ./remove-hardcoded-paths.patch ./deterministic-build.patch ];
+  patches = [ ./remove-hardcoded-paths.patch ];
 
   makeFlags = [ "PREFIX=$(out)" "VERSION=${version}" ];
 
diff --git a/pkgs/applications/version-management/gitlab-workhorse/remove-hardcoded-paths.patch b/pkgs/applications/version-management/gitlab/gitlab-workhorse/remove-hardcoded-paths.patch
index d8313ecb433..d8313ecb433 100644
--- a/pkgs/applications/version-management/gitlab-workhorse/remove-hardcoded-paths.patch
+++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/remove-hardcoded-paths.patch
diff --git a/pkgs/applications/version-management/gitlab/update.py b/pkgs/applications/version-management/gitlab/update.py
new file mode 100755
index 00000000000..765f984fba5
--- /dev/null
+++ b/pkgs/applications/version-management/gitlab/update.py
@@ -0,0 +1,234 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -i python3 -p bundix common-updater-scripts nix nix-prefetch-git python3 python3Packages.requests python3Packages.lxml python3Packages.click python3Packages.click-log
+
+import click
+import click_log
+import os
+import re
+import logging
+import subprocess
+import json
+import pathlib
+from typing import Iterable
+
+import requests
+from xml.etree import ElementTree
+
+logger = logging.getLogger(__name__)
+
+
+class GitLabRepo:
+    def __init__(self, owner: str, repo: str):
+        self.owner = owner
+        self.repo = repo
+
+    @property
+    def url(self):
+        return f"https://gitlab.com/{self.owner}/{self.repo}"
+
+    @property
+    def tags(self) -> Iterable[str]:
+        r = requests.get(self.url + "/tags?format=atom", stream=True)
+
+        tree = ElementTree.fromstring(r.content)
+        return sorted((e.text for e in tree.findall(
+            '{http://www.w3.org/2005/Atom}entry/{http://www.w3.org/2005/Atom}title')), reverse=True)
+
+    def get_git_hash(self, rev: str):
+        out = subprocess.check_output(['nix-prefetch-git', self.url, rev])
+        j = json.loads(out)
+        return j['sha256']
+
+    def get_deb_url(self, flavour: str, version: str, arch: str = 'amd64') -> str:
+        """
+        gitlab builds debian packages, which we currently need as we don't build the frontend on our own
+        this returns the url of a given flavour, version and arch
+        :param flavour: 'ce' or 'ee'
+        :param version: a version, without 'v' prefix and '-ee' suffix
+        :param arch: amd64
+        :return: url of the debian package
+        """
+        if self.owner != "gitlab-org" or self.repo not in ['gitlab-ce', 'gitlab-ee']:
+            raise Exception(f"don't know how to get deb_url for {self.url}")
+        return f"https://packages.gitlab.com/gitlab/gitlab-{flavour}/packages" + \
+               f"/debian/stretch/gitlab-{flavour}_{version}-{flavour}.0_{arch}.deb/download.deb"
+
+    def get_deb_hash(self, flavour: str, version: str) -> str:
+        out = subprocess.check_output(['nix-prefetch-url', self.get_deb_url(flavour, version)])
+        return out.decode('utf-8').strip()
+
+    @staticmethod
+    def rev2version(tag: str) -> str:
+        """
+        normalize a tag to a version number.
+        This obviously isn't very smart if we don't pass something that looks like a tag
+        :param tag: the tag to normalize
+        :return: a normalized version number
+        """
+        # strip v prefix
+        version = re.sub(r"^v", '', tag)
+        # strip -ee suffix
+        return re.sub(r"-ee$", '', version)
+
+    def get_file(self, filepath, rev):
+        """
+        returns file contents at a given rev
+        :param filepath: the path to the file, relative to the repo root
+        :param rev: the rev to fetch at
+        :return:
+        """
+        return requests.get(self.url + f"/raw/{rev}/{filepath}").text
+
+    def get_data(self, rev, flavour):
+        version = self.rev2version(rev)
+
+        passthru = {v: self.get_file(v, rev).strip() for v in ['GITALY_SERVER_VERSION', 'GITLAB_PAGES_VERSION',
+                                                               'GITLAB_SHELL_VERSION', 'GITLAB_WORKHORSE_VERSION']}
+        return dict(version=self.rev2version(rev),
+                    repo_hash=self.get_git_hash(rev),
+                    deb_hash=self.get_deb_hash(flavour, version),
+                    deb_url=self.get_deb_url(flavour, version),
+                    owner=self.owner,
+                    repo=self.repo,
+                    rev=rev,
+                    passthru=passthru)
+
+
+def _flavour2gitlabrepo(flavour: str):
+    if flavour not in ['ce', 'ee']:
+        raise Exception(f"unknown gitlab flavour: {flavour}, needs to be ce or ee")
+
+    owner = 'gitlab-org'
+    repo = 'gitlab-' + flavour
+
+    return GitLabRepo(owner, repo)
+
+
+def _update_data_json(filename: str, repo: GitLabRepo, rev: str, flavour: str):
+    flavour_data = repo.get_data(rev, flavour)
+
+    if not os.path.exists(filename):
+        with open(filename, 'w') as f:
+            json.dump({flavour: flavour_data}, f, indent=2)
+    else:
+        with open(filename, 'r+') as f:
+            data = json.load(f)
+            data[flavour] = flavour_data
+            f.seek(0)
+            json.dump(data, f, indent=2)
+
+
+def _get_data_json():
+    data_file_path = pathlib.Path(__file__).parent / 'data.json'
+    with open(data_file_path, 'r') as f:
+        return json.load(f)
+
+
+def _call_update_source_version(pkg, version):
+    """calls update-source-version from nixpkgs root dir"""
+    nixpkgs_path = pathlib.Path(__file__).parent / '../../../../'
+    return subprocess.check_output(['update-source-version', pkg, version], cwd=nixpkgs_path)
+
+
+@click_log.simple_verbosity_option(logger)
+@click.group()
+def cli():
+    pass
+
+
+@cli.command('update-data')
+@click.option('--rev', default='latest', help='The rev to use, \'latest\' points to the latest (stable) tag')
+@click.argument('flavour')
+def update_data(rev: str, flavour: str):
+    """Update data.nix for a selected flavour"""
+    r = _flavour2gitlabrepo(flavour)
+
+    if rev == 'latest':
+        # filter out pre and re releases
+        rev = next(filter(lambda x: not ('rc' in x or x.endswith('pre')), r.tags))
+    logger.debug(f"Using rev {rev}")
+
+    version = r.rev2version(rev)
+    logger.debug(f"Using version {version}")
+
+    data_file_path = pathlib.Path(__file__).parent / 'data.json'
+
+    _update_data_json(filename=data_file_path.as_posix(),
+                      repo=r,
+                      rev=rev,
+                      flavour=flavour)
+
+
+@cli.command('update-rubyenv')
+@click.argument('flavour')
+def update_rubyenv(flavour):
+    """Update rubyEnv-${flavour}"""
+    if flavour not in ['ce', 'ee']:
+        raise Exception(f"unknown gitlab flavour: {flavour}, needs to be ce or ee")
+
+    r = _flavour2gitlabrepo(flavour)
+    rubyenv_dir = pathlib.Path(__file__).parent / f"rubyEnv-{flavour}"
+
+    # load rev from data.json
+    data = _get_data_json()
+    rev = data[flavour]['rev']
+
+    for fn in ['Gemfile.lock', 'Gemfile']:
+        with open(rubyenv_dir / fn, 'w') as f:
+            f.write(r.get_file(fn, rev))
+
+    subprocess.check_output(['bundix'], cwd=rubyenv_dir)
+
+
+@cli.command('update-gitaly')
+def update_gitaly():
+    """Update gitaly"""
+    data = _get_data_json()
+    gitaly_server_version = data['ce']['passthru']['GITALY_SERVER_VERSION']
+    r = GitLabRepo('gitlab-org', 'gitaly')
+    rubyenv_dir = pathlib.Path(__file__).parent / 'gitaly'
+
+    for fn in ['Gemfile.lock', 'Gemfile']:
+        with open(rubyenv_dir / fn, 'w') as f:
+            f.write(r.get_file(f"ruby/{fn}", f"v{gitaly_server_version}"))
+
+    subprocess.check_output(['bundix'], cwd=rubyenv_dir)
+    # currently broken, as `gitaly.meta.position` returns
+    # pkgs/development/go-modules/generic/default.nix
+    # so update-source-version doesn't know where to update hashes
+    # _call_update_source_version('gitaly', gitaly_server_version)
+    gitaly_hash = r.get_git_hash(f"v{gitaly_server_version}")
+    click.echo(f"Please update gitaly/default.nix to version {gitaly_server_version} and hash {gitaly_hash}")
+
+
+
+@cli.command('update-gitlab-shell')
+def update_gitlab_shell():
+    """Update gitlab-shell"""
+    data = _get_data_json()
+    gitlab_shell_version = data['ce']['passthru']['GITLAB_SHELL_VERSION']
+    _call_update_source_version('gitlab-shell', gitlab_shell_version)
+
+
+@cli.command('update-gitlab-workhorse')
+def update_gitlab_workhorse():
+    """Update gitlab-shell"""
+    data = _get_data_json()
+    gitlab_workhorse_version = data['ce']['passthru']['GITLAB_WORKHORSE_VERSION']
+    _call_update_source_version('gitlab-workhorse', gitlab_workhorse_version)
+
+
+@cli.command('update-all')
+@click.pass_context
+def update_all(ctx):
+    """Update gitlab ce and ee data.nix and rubyenvs to the latest stable release"""
+    for flavour in ['ce', 'ee']:
+        ctx.invoke(update_data, rev='latest', flavour=flavour)
+        ctx.invoke(update_rubyenv, flavour=flavour)
+    ctx.invoke(update_gitaly)
+    ctx.invoke(update_gitlab_shell)
+    ctx.invoke(update_gitlab_workhorse)
+
+
+if __name__ == '__main__':
+    cli()
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index fd7fb972286..15f765dde11 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2890,11 +2890,11 @@ with pkgs;
 
   gitlab-runner = callPackage ../development/tools/continuous-integration/gitlab-runner { };
 
-  gitlab-shell = callPackage ../applications/version-management/gitlab-shell { };
+  gitlab-shell = callPackage ../applications/version-management/gitlab/gitlab-shell { };
 
-  gitlab-workhorse = callPackage ../applications/version-management/gitlab-workhorse { };
+  gitlab-workhorse = callPackage ../applications/version-management/gitlab/gitlab-workhorse { };
 
-  gitaly = callPackage ../applications/version-management/gitaly { };
+  gitaly = callPackage ../applications/version-management/gitlab/gitaly { };
 
   gitstats = callPackage ../applications/version-management/gitstats { };