https://about.gitlab.com/blog/secure-by-design-principles-meet-devsecops-innovat...
The problem with 2fa is that it has a long history of being used by dataminers and bad faith actors. it can also and frequently does result in account lockouts. I do not care what some random security organization (CISA) that I've never interacted with has to say, developers shouldn't have to worry about 2fa/mfa and it should never be mandatory. you the developer should have the right to protect your code how you see fit, especially if you paying for CI/CD services. Github has already done this before gitlab and it has ended poorly for many developers, it is one of the reasons I left github to begin with. I know a lot of you are developers who might also use these tools and you deserve to be made aware.