Gerrit (software)

Gerrit (software)
Name	Gerrit
Developer	Google, GerritForge, Android Open Source Project contributors
Released	2010
Programming language	Java
Operating system	Cross-platform
Platform	JVM
Repository	Android Open Source Project, Google
License	Apache License

Gerrit (software) Gerrit is a web-based code review and project management tool built on Git that facilitates collaborative development across organizations such as Google, the Android Open Source Project, and enterprise teams. It combines a review-centric workflow with a server-side repository model used by projects like Chromium and companies including Qualcomm, Sony, and Intel. Gerrit emphasizes gatekeeping, continuous integration, and fine-grained access control to coordinate contributions from distributed teams working on large codebases.

Overview

Gerrit originated to connect Git repositories with a web-driven review process, providing a central server where contributors submit changes for peer review before merging into branches used by projects such as Android, OpenStack, and OpenJDK. The platform exposes an interface for reviewers to comment on commits, vote on change approval, and track dependencies between changes, integrating with systems like Jenkins, Zuul, and GitLab CI/CD. Gerrit’s model contrasts with pull request workflows implemented by platforms such as GitHub, Bitbucket, and GitLab, by treating each change as an independent review attached to a commit reference.

History and Development

Gerrit was initially developed at Google by Shawn Pearce and others to support the Android Open Source Project and other internal workflows, before being released to the open source community. Early stewardship involved contributors from Google and maintainers affiliated with GerritForge and independent developers from projects like OpenStack and Eclipse. Over time Gerrit adopted a plugin architecture and evolved through major releases that introduced a modern web UI, a REST API consumed by clients including Eclipse, IntelliJ IDEA, and Visual Studio Code, and integration features used by organizations such as Red Hat, Mozilla, and SAP. Governance has involved community events at conferences like FOSDEM and All Hands meetings hosted by industry stakeholders.

Features and Architecture

Gerrit implements a server-side architecture based on Git repositories, the Java Virtual Machine, and a web frontend served by a servlet container. Core features include per-change reviews with inline comments, vote labels such as Code-Review and Verified, change dependencies, and automated submit rules enforced by a submit pipeline. The architecture supports a REST API and SSH interfaces used by clients including Eclipse JGit, command-line tools, and IDE integrations from JetBrains. The event system publishes hooks for CI systems like Jenkins and Zuul, while authentication and replication use protocols supported by LDAP, OAuth, and Kerberos. Gerrit’s plugin framework enables extensions for UI customization, authentication backends used by enterprises like Microsoft Active Directory, and repository replication to mirrors hosted by providers such as GitHub and GitLab.

Workflow and Usage

Typical workflows center on contributors pushing topic branches to Gerrit for review rather than pushing directly to mainline branches used by projects such as Android or Chromium. A developer creates a change, uploads it for review, and reviewers from teams at organizations like Google or Intel add Code-Review votes and Verified statuses produced by CI systems such as Jenkins or GitLab Runner. Gerrit supports cherry-pick, rebase, and merge strategies and models submit rules as part of project configuration that may involve project owners from entities like Eclipse Foundation or Linux Foundation. Change tracking, reviewer assignment, and email notifications integrate with tools used by teams at ARM, Nokia, and Qualcomm.

Integrations and Plugins

Gerrit’s ecosystem includes plugins and integrations with continuous integration servers, issue trackers, and IDEs. Popular integrations include connectors for Jenkins, Zuul used by OpenStack, issue links to JIRA maintained by Atlassian, and ticketing hooks for Bugzilla used by Mozilla. IDE plugins exist for Eclipse, IntelliJ IDEA, and Visual Studio Code, while authentication plugins support LDAP and OAuth providers such as Google Accounts and GitHub Enterprise. The plugin marketplace and community contributions from organizations like GerritForge and independent contributors provide extensions for code owners, change metrics used by teams at Red Hat, and repository-level replication strategies favored by companies like Canonical.

Performance and Scalability

Gerrit is designed for scalable operation on repositories with millions of commits and thousands of contributors common in projects such as Android and Chromium. Scalability strategies used by large deployments include horizontal replication, sharding of repositories, and optimized caching layers integrated with services from Redis and reverse proxies like NGINX or HAProxy. Performance tuning often involves JVM tuning, garbage collection configuration familiar to operations teams at Netflix and Google Cloud, and database optimizations when using backends like MariaDB or PostgreSQL. Large organizations such as Intel and Sony operate high-availability Gerrit clusters with CI farms coordinated by Jenkins and pipeline orchestrators like Kubernetes.

Security and Access Control

Gerrit provides fine-grained access control lists (ACLs) enabling project maintainers to grant permissions for branches, tags, and plugin-specific capabilities to groups managed in systems such as LDAP or Google Workspace. Authentication options include OAuth, SAML, and Kerberos, which enterprises like Microsoft and IBM integrate for single sign-on and compliance. Security hardening practices used by operators include audit logging, SSH key management, and integration with vulnerability scanners used by teams at Red Hat and Canonical. Role-based controls and signed commits are commonly enforced by open source projects and corporations to protect release branches and audit provenance for distributions such as Debian and Fedora.

Category:Version control systems Category:Software review tools