BOLT Release Guardian

Inspiration

AI-assisted development can make code move faster, but a passing build alone does not mean a change is ready to ship. BOLT Release Guardian explores a bounded, auditable release decision with humans retaining approval authority.

What it does

The project evaluates CI pipeline status, code coverage, test failures, critical/high security vulnerabilities and change risk, returning one of three explicit results: READY, APPROVAL_REQUIRED or BLOCK. A structured Markdown audit report summarizes the inputs, blocking reasons and whether human approval is needed. It does not automatically merge or deploy.

How it was built

Built from October 2026 in the GitLab Transcend hackathon workspace using GitLab Duo Developer and GitLab's merge-request and CI pipeline workflow. The JavaScript implementation includes release-policy evaluation, audit report generation and automated Node.js tests. The public GitLab repository includes an MIT license, source code, tests, and visible merge-request/pipeline history. A GitLab Duo-generated change added the audit-report function through merge request !1, linked to issue #2, and was merged after its pipeline passed.

Verification and learning

16 tests passed (0 failed) for policy decisions and report generation, including missing inputs and blocking conditions. We learned to separate an AI-generated recommendation from permission to act: even a READY result is an assessment, not an authorization to deploy.

Challenges

Keeping a release verdict both interpretable and restrictive was more important than hiding uncertainty. The implementation makes critical findings and failed pipeline states visible and retains a manual authority boundary. The demonstration video walks through the project and its working tests.

Future work

Integrate richer policy inputs, evidence provenance, GitLab Duo flow orchestration, and review gates across additional DevSecOps stages. These are planned improvements, not existing features.

Path: Start Fresh. Autonomy: Supervised. Entrant: Omar Baró / Unfire.

Built With

• ci/cd
• devsecops
• gitlab
• gitlab-duo
• javascript
• node.js
• security