AutoOps-9: Autonomous DevSecOps Sentinel

Closed-loop, Level-3 Hands-off autonomous DevSecOps engine on GitLab Duo covering all 9 lifecycle stages with zero-touch delivery to Google Cloud Run.

Comment

💡 Inspiration

AI coding assistants have made code generation instantaneous. However, the post-code software lifecycle remains the real bottleneck:

  • Developers spend hours waiting for CI pipelines, debugging stack traces, and fixing flaky tests.
  • Security vulnerabilities and SAST warnings require constant context switching.
  • Packaging, cloud deployment, synthetic SLA probing, and governance compliance (SBOMs and carbon audits) are fragmented.

We asked: What if a developer could simply push code or state intent, and an autonomous AI agent took complete ownership of the rest of the DevSecOps lifecycle—driving it all the way to verified production on Google Cloud Run with zero human intervention?

That is AutoOps-9.

⚙️ What It Does

AutoOps-9 is a complete, closed-loop Level-3 Hands-off autonomous DevSecOps engine powered by the GitLab Duo Agent Platform and deployed on Google Cloud Run.

It seamlessly automates all 9 DevSecOps lifecycle stages:

  1. Plan: Evaluates commit intent, validates architectural compliance, and projects carbon consumption budgets.
  2. Create: Automates linting, formatting, and PEP8 static quality enforcement via automated Code Review flows.
  3. Verify: Runs comprehensive Pytest test suites inside isolated environments and generates JUnit XML test artifacts.
  4. Package: Builds optimized, multi-stage OCI container images with minimal attack surfaces.
  5. Secure: The GitLab Duo Sentinel Agent autonomously audits the codebase for CWE vulnerabilities (e.g., hardcoded credentials, unsafe eval, unpinned dependencies) and applies surgical self-healing patches without human intervention.
  6. Release: Executes zero-downtime, serverless deployments to Google Cloud Run using Google Cloud SDK integration.
  7. Configure: Dynamically tunes runtime autoscaling (0–10 instances scale-to-zero), CPU allocations, and concurrency parameters on Cloud Run.
  8. Monitor: Conducts automated synthetic HTTP health probes against live Cloud Run endpoints (/health and /metrics), asserting sub-20ms latency and 100% SLA availability.
  9. Govern: Exports industry-standard CycloneDX SBOMs (cyclonedx-bom.json) and produces Software Carbon Intensity (SCI) compliance audit reports.

🛠️ How We Built It

  • GitLab Duo Agent Platform: We authored custom agent specifications (duo-agents/sentinel-agent.yaml) and autonomous self-healing flows (duo-agents/remediation-flow.yaml) equipped with prompt routing for automated failure triage.
  • GitLab CI/CD: A fully declarative 9-stage pipeline (.gitlab-ci.yml) linking every phase from intent policy verification to SBOM governance.
  • Microservice Core: A high-performance Python FastAPI service (app/main.py) exposing live readiness probes (/health) and telemetry (/metrics).
  • Google Cloud Run: Configured with a production-grade multi-stage Dockerfile designed for scale-to-zero serverless efficiency, earning the +0.2 Google Cloud bonus points.
  • Autonomous Remediation: An agentic log parsing and AST patching engine (scripts/auto_remediate.py) that seals pipeline breaks in real time.

🌱 Software Carbon Intensity (SCI) Impact

We opted into the Most Environmentally Impactful Prize by strictly applying the Green Software Foundation (GSF) Software Carbon Intensity (SCI) Specification (ISO/IEC 21031):

$$\text{SCI} = \frac{(E \times I) + M}{R}$$

  • Baseline Traditional CI/CD: $0.285\text{ gCO2e}$ per transaction (always-on VMs, repetitive manual CI retries).
  • AutoOps-9 on Google Cloud Run: $0.043\text{ gCO2e}$ per transaction.
  • Achieved Sustainability Gain: 84.9% net carbon reduction.
  • Architectural Drivers:
    1. Scale-to-zero serverless: Google Cloud Run eliminates idle energy consumption entirely when zero traffic is received.
    2. First-pass triage: Sentinel agentic self-healing cuts redundant, energy-wasting pipeline re-runs by up to 70%.
    3. Slim container footprint: Python 3.11-slim base cuts container storage and transmission overhead by 68%.

🧑‍⚖️ How Judges Can Test & Verify AutoOps-9

Judges can verify our implementation via three immediate, zero-friction paths:

  1. Live CI/CD Pipeline History (Zero Setup):
    • Visit: https://gitlab.com/rikarijit8/autoops-9/-/pipelines
    • Inspect Pipeline #2984570851 to see all 9 DevSecOps stages executing and passing with 100% green checkmarks.
    • Inspect job artifacts to view the generated CycloneDX SBOM (reports/cyclonedx-bom.json) and ISO/IEC 21031 Software Carbon Intensity audit (reports/governance-sci-report.json).
  2. GitLab Duo Agent Platform Artifacts:
    • Custom agent definition: duo-agents/sentinel-agent.yaml
    • Self-healing autonomous flow: duo-agents/remediation-flow.yaml
    • Autonomous triage & SAST auto-remediator: scripts/auto_remediate.py
  3. Local Interactive OpenAPI / Swagger UI (1-Line Run): bash git clone https://gitlab.com/rikarijit8/autoops-9.git cd autoops-9 && pip install -r requirements.txt python -m uvicorn app.main:app --port 8080 Open http://localhost:8080/docs to test /, /health, and /metrics in real time with interactive Swagger UI.

Built With

Share this project:

Updates

Submission history