-
-
Homepage
Inspiration
Generating code is becoming easier. The harder question is what happens next: how do we review it, test it, secure it, release it, and know it is working in production?
AgentWallet gave us a concrete problem where those steps matter. It lets AI agents request paid APIs within user-defined spending rules. A mistake could mean unauthorized spending or a duplicate payment, so generating working code alone is not enough.
Our hackathon focus is using GitLab to connect development with the evidence and controls needed to ship responsibly—from planning and merge request review through deployment and monitoring.
What it does
AgentWallet gives AI agents a budget, with users retaining control over spending rules and a kill switch. Its x402 payment engine validates payment requests and checks policy and available funds before signing. The current payment experience uses simulated services; live payments remain disabled.
Around that application, we built a GitLab CI/CD workflow that tests changes, checks dependencies, scans for security issues, packages releases, and deploys to Google Cloud Run.
Our intended GitLab Duo workflow extends that lifecycle: help turn requirements into scoped tasks, review merge requests against those requirements, and help investigate pipeline failures. Automated checks provide the evidence, while humans retain approval over production deployment.
How we built it
We built the application with Rust and a React dashboard, then made GitLab the central place for validation, releases, and deployment.
The pipeline covers several layers:
- Verify: Formatting, compilation, strict linting, workspace tests, API schema validation, frontend checks, and Terraform validation catch problems before release. Coverage reports expose untested lines, while advisory mutation testing helps identify tests that miss behavioral changes.
- Secure: The pipeline integrates GitLab security scanner templates for source code, secrets, dependencies, infrastructure, containers, and API testing. Rust dependency audits and license policies add explicit checks, while parser fuzzing exercises malformed payment inputs. A dedicated merge request fuzz job acts as a blocking gate.
- Package and release: Version tags trigger release packaging. Keyless signatures and provenance records connect release artifacts to their source commit and pipeline.
- Deploy: With cloud configuration in place, GitLab builds and pushes the container to Google Artifact Registry. The pipeline scans the image and deploys that same immutable image digest to Cloud Run through Terraform. Staging deployment is automatic; production requires manual approval.
- Monitor: Post-deployment smoke checks verify health and the expected release version. OpenTelemetry supports traces and application logs in GitLab Observability, while Cloud Monitoring alerts can feed GitLab incidents.
GitLab authenticates to Google Cloud through OIDC and Workload Identity Federation, avoiding long-lived cloud service-account keys in CI.
We used GitLab Duo throughout planning and code creation, turning requirements into scoped tasks and implementing changes through merge requests. GitLab CI/CD then supplied the checks needed to evaluate those changes: compilation, linting, tests, dependency audits, security scans, and fuzzing.
The application uses Rust for the backend and React for the dashboard. Versioned releases move through packaging, keyless signing, and container scanning before deployment to Google Cloud Run. The pipeline deploys the scanned image by its immutable digest, with automatic staging deployment and manual production approval.
Post-deployment checks verify health and the expected release version. OpenTelemetry supports application traces and logs in GitLab Observability, while Cloud Monitoring alerts can feed GitLab incidents.
Challenges we ran into
One practical constraint was Duo’s one-hour task limit. Larger tasks could run out of time before completing implementation and validation, so we had to break work into smaller pieces with clear boundaries and acceptance criteria.
That changed how we planned. Each task needed a focused outcome, enough context to work independently, and a verification step that could finish within the limit. Task size became part of the engineering process.
We also learned that including security scanners does not automatically guarantee coverage. Pipeline rules, language support, and GitLab tier requirements determine whether checks actually run. We had to distinguish blocking gates from advisory reports and ensure the image scanned by the pipeline was the exact image deployed.
Accomplishments that we're proud of
We’re proud of building a workflow that continues beyond a successful build. It connects a change to test results, security reports, signed release artifacts, a Cloud Run deployment, and post-release health checks.
The deployment checks verify the release version as well as availability, so an old revision cannot pass simply because it is still responding.
We also kept security controls concrete: isolated signing, deterministic failure tests, dependency policies, short-lived cloud authentication, and explicit production approval. These provide reviewable evidence rather than relying on an AI-generated assurance that the code is safe.
What we learned
Working with Duo taught us that effective AI-assisted development starts with well-scoped work. Smaller tasks made it easier to stay within the execution limit, review changes, and connect each requirement to concrete test evidence.
We also learned to treat CI/CD as part of the product. Duo helped us plan and create code; GitLab pipelines provided repeatable validation, release controls, and deployment evidence. Both were necessary to move from generated changes to something we could confidently review and release.
What's next for AgentWallet
We want to extend our existing Duo planning and code creation workflow into automated merge request review and pipeline troubleshooting. The next step is to have agents assess changes against security requirements, investigate failed jobs, and propose fixes backed by test results.
We also want to connect GitLab incidents back to small, actionable development tasks, closing the loop between monitoring and improvement. Our target is supervised automation, with agents handling repeatable work and humans reviewing outcomes and approving production deployments.
Log in or sign up for Devpost to join the conversation.