AfterCode: Post-code loop on GitLab Duo + CI

Deterministic CI plus Duo Fix CI & Code Review on the MR; a human still applies the fix and approves merge.

Comment

Inspiration

What it does

How we built it

Challenges we ran into

Accomplishments that we're proud of

What we learned

What's next for AfterCode: Post-code loop on GitLab Duo + CI

Inspiration

Generating code is easy. The work after the commit still burns time: review comments, red pipelines, SAST findings, and a release decision someone can trust. Full auto-merge is risky. Full manual babysitting is slow. We wanted “Life After Code” — keep CI deterministic, let Duo assist, and leave the merge gate with a human.

What it does

AfterCode is a small Node 20 / TypeScript / Express service (/health, /version, /echo) with a full post-code loop on GitLab:

  1. plan → test → sast → package → release CI stages (deterministic).
  2. Duo Code Review (@GitLabDuo) on the MR.
  3. Fix CI/CD Pipeline flow on failed pipelines — recommends a fix; human applies it.
  4. Custom Automate agents registered: MR Shepherd (1019798), SAST Remediator (1019799), Release Gate (1019800).
  5. Human gate: release-summary.md + merge approval; no agent production deploy.

Featured judge MR !2 shows durable Changes plus Assistive Fix CI: intentional VERSION regression → red pipeline 2988857366 → Duo suggestion (session 10040835 / note 4089104745) → human commit f8a2f7b → green pipeline 2988947878. Historical !1 red→green: 2988810735 → 2988816491.

How we built it

  • Fresh Path A project on Showcase with MIT license and protected main.
  • Express service + Jest unit tests; VERSION constant exercised by /version and CI.
  • .gitlab-ci.yml stages: plan_brief, unit_test, Semgrep/SAST template, package_artifact, release_notes.
  • Duo Agent Platform: enabled Fix CI/CD Pipeline and related flows; registered three custom agents from in-repo prompts (.gitlab/duo/, skills/).
  • Demo MR !2 (demo/supervised-loop-v2): intentional VERSION = "0.0.0-buggy" to trigger Fix CI; human applied Duo’s VERSION 0.1.1 suggestion.
  • Docs for judges: README, SETUP.md, EVIDENCE.md, DEVPOST.md, docs/DEMO.md, docs/GOVERN.md.

Challenges we ran into

  • Official Supervised needs an agent-authored gate-clearing commit. Fix CI completed and posted a suggestion-only recommended fix — it did not push. We stayed honest and claim Assistive.
  • Automate agent/session detail URLs often 404 when logged out even if marked Public; we rely on public MR notes, pipeline URLs, and screenshots.
  • Box Google SSO is passkey-only, so YouTube upload and some Devpost/Google logins need a phone/laptop session.
  • Keeping durable non-empty MR Changes for judges while still demonstrating a real red→green Fix CI assist took a careful VERSION regression + human apply.

Accomplishments that we're proud of

  • End-to-end Assistive story with public proof: Duo Code Review + Fix CI suggestion + human-applied green commit on featured MR !2.
  • Clear red→green pipeline IDs judges can open logged-out: !2 2988857366 → 2988947878; historical !1 2988810735 → 2988816491.
  • Deterministic CI covering plan, verify, secure (SAST), package, and human-gated release.
  • Honest autonomy labeling — Assistive, not inflated Supervised.

What we learned

  • Duo Fix CI is powerful as an assistant (recommend + suggestion) but suggestion-only does not satisfy Supervised authorship; commit author identity matters.
  • Judges need public HTTP 200 artifacts: MR notes and pipelines beat private Automate deep links.
  • Separating deterministic CI from agentic assist makes the human gate credible and demos safer.

What's next for AfterCode

  • Pursue a true Supervised proof where a Duo/bot identity authors the gate-clearing commit.
  • Wire SAST remediator on a live finding (template already enabled).
  • Optional Path A deploy + package consumers; richer release dossier UX.
  • Harden agent prompts so Fix CI can optionally open an MR with an agent-authored patch under human approval.

Path and autonomy

Path A — Start Fresh. Autonomy: Assistive (not Supervised). Duo flows and custom agents assist on review and failed pipelines. Deterministic GitLab CI is the backbone. A human applies Duo’s recommended fix when needed, reviews release-summary.md, and approves merge. Agents do not merge to main or ship production. Fix CI on !2 posted a suggestion only; commit f8a2f7b is human-authored.

Stages: plan (plan_brief), create (MRs + @GitLabDuo Code Review / MR Shepherd), verify (unit_test + Fix CI assist), package (package_artifact), secure (SAST + Semgrep; remediator registered), release (release_notes + human gate). Govern is documented (protected main, MIT, no agent merge/deploy). Configure and monitor are not claimed.

Links:

Built With

Share this project:

Updates

Submission history