doc/user/project/_index.md
{{< details >}}
{{< /details >}}
You have different options to create a project. You can create a blank project, create a project
from built-in or custom templates, or create a project with git push.
To create a blank project:
Built-in templates populate a new project with files to help you get started.
These templates are sourced from the project-templates
and pages groups.
Anyone can contribute to built-in project templates.
To create a project from a built-in template:
[!note] If a user creates a project from a template, or imports a project, they are shown as the author of the imported items, which retain the original timestamp from the template or import. This can make items appear as if they were created before the user's account existed.
Imported objects are labeled as By <username> on <timestamp>.
Before GitLab 17.1, the label was suffixed with (imported from GitLab).
The HIPAA Audit Protocol template contains issues for audit inquiries in the HIPAA Audit Protocol published by the U.S Department of Health and Human Services.
To create a project from the HIPAA Audit Protocol template:
{{< history >}}
constrain_group_project_templates.
Disabled by default.{{< /history >}}
Custom project templates are available for your instance and group.
To create a project from a custom template:
{{< details >}}
{{< /details >}}
{{< history >}}
support_sha256_repositories. Disabled by default. This feature is an experiment.{{< /history >}}
[!flag] The availability of this feature is controlled by a feature flag. For more information, see the history. This feature is available for testing, but not ready for production use.
You can select SHA-256 hashing for a project only when you create the project. Git does not support migrating to SHA-256 later, or migrating back to SHA-1.
To create a project that uses SHA-256 hashing:
By default, Git uses the SHA-1 hashing algorithm to generate a 40-character ID for objects such as commits, blobs, trees, and tags. The SHA-1 algorithm was proven to be insecure when Google was able to produce a hash collision. The Git project is not yet impacted by these kinds of attacks because of the way Git stores objects.
In SHA-256 repositories, the algorithm generates a 64-character ID instead of a 40-character ID. The Git project determined that the SHA-256 feature is safe to use when they removed the experimental label.
Federal regulations, such as NIST and CISA guidelines, which FedRamp enforces, have set a due date in 2030 to stop using SHA-1 and encourage agencies to move away from SHA-1 earlier, if possible.