artifact-impact-auditor

• 

  Query to agent

• 

  Response from Agent

Inspiration

The inspiration for this project came from identifying a significant "blind spot" in the current GitLab Orbit ecosystem. While Orbit is excellent at mapping code symbols and SDLC metadata, it currently lacks native parsers for infrastructure manifests like Terraform (HCL), Dockerfiles, or Helm charts. This creates a dangerous gap: a platform team might bump a shared base image or update a common Terraform module without knowing it will break a specific application-level function three repositories away. We wanted to bridge this gap between the infrastructure artifact layer and the application symbol layer to prevent "trial and error" delivery.

What it does

The Artifact-to-Symbol Impact Auditor is a custom skill that enables AI agents to identify the full cross-repo blast radius of an infrastructure change. It discovers references to shared artifacts (like base images or modules) across a GitLab group and maps them directly to the code symbols (functions, classes, methods) and project owners who rely on them. It categorizes risks from "Zero" to "High" based on the environment (e.g., production vs. test) and provides a clear action plan for which owners need to be notified or added as reviewers to a merge request.

How we built it

We built this as a custom skill for the GitLab Duo Agent Platform, living in the skills/ directory of a provisioned GitLab project. The implementation uses a three-step orchestration technique:

1. Infrastructure Discovery: Using standard file-reading tools to find references Orbit doesn't yet natively parse (like FROM in Dockerfiles).
2. Symbol Mapping: Leveraging Orbit's query_graph tool to find "Bridge Symbols"—the code entries in those repositories that interface with the infrastructure.
3. Blast Radius Traversal: Tracing downstream callers of those symbols across repository boundaries using Orbit's graph traversal capabilities.

Challenges we ran into

The primary challenge was navigating the structural limitations of a platform-native graph. Because Orbit doesn't yet have an HCL or Dockerfile parser, we had to design "recipes" that tell the agent how to manually find these missing edges using external file tools before it can return to the structured graph for symbol analysis. Additionally, ensuring the metadata formatting and directory structure for the SKILL.md file was correct was vital for the Duo Agent Platform to successfully "see" and enable the skill.

Accomplishments that we're proud of

We are proud of creating a working solution for a cross-repo coordination problem that previously required hours of manual digging. By unifying the previously isolated "artifact graph" and "symbol graph," we’ve enabled proactive impact analysis. Our solution can identify not just the broken file, but the specific human owners who need to act, turning raw data into prioritized organizational action.

What we learned

We learned that structured context is far superior to retrieval-augmented generation (RAG) for complex tasks; as the sources noted, RAG can sometimes perform worse than no context at all when navigating codebases. We also discovered the power of agentic orchestration, where an agent doesn't just answer a question but follows a multi-step plan to fetch data from different layers (code vs. infra) and synthesizes a solution.

What's next for artifact-impact-auditor

The next step is to move from auditing to automated remediation. We plan to evolve this into a Custom Flow that can automatically create "Downstream Impact" comments on Merge Requests and auto-assign the correct project owners identified by Orbit. We also aim to contribute to the core GitLab Orbit project by helping implement the native HCL and Dockerfile parsers that would eliminate the need for external file tools in this workflow.

Built With

• gitlab
• gitlabduoagentplatform
• gitlaborbit
• markdown