CarbonZero Duo: The GreenOps DevSecOps Autopilot

Autonomous GreenOps autopilot for GitLab Duo: re-routes CI/CD to 94% clean-energy GCP regions, right-sizes K8s fleets, and certifies Green Bills of Materials.

Comment

🌿 CarbonZero Duo: The GreenOps DevSecOps Autopilot

Autonomous post-code environmental intelligence powered by the **GitLab Duo Agent Platform, **Anthropic Model Context Protocol (MCP), and **Google Cloud Run.

💡 Inspiration

In traditional software development, the conversation around sustainability usually ends when developers step away from the keyboard. But in reality, life after code is intensely carbon-heavy. Continuous integration test suites, automated builds, and multi-replica Kubernetes clusters run 24 hours a day in data centers often powered by fossil-fuel grids.

When we reviewed the GitLab Transcend Hackathon: Life After Code theme, we asked a fundamental question:
What if our automated path to production wasn't just fast, but completely carbon-conscious?

We built CarbonZero Duo to make GreenOps an autonomous first-class citizen across the post-code DevSecOps lifecycle. By combining the GitLab Duo Agent Platform with Anthropic's Model Context Protocol (MCP) and Google Cloud, CarbonZero Duo takes over the moment code is pushed to autonomously eliminate compute waste, re-route runners to clean energy, and certify environmental impact.

🌿 What It Does

CarbonZero Duo closes the loop between repository events, grid energy telemetry, and cloud deployment:

  1. Dynamic Grid Carbon Scheduling: When a Merge Request is opened or a pipeline is triggered, the agent queries real-time regional carbon intensity ($g\text{CO}_2\text{eq}/\text{kWh}$) and Carbon-Free Energy (CFE%) across Google Cloud regions. It autonomously re-routes heavy CI/CD test and build jobs from carbon-heavy regions to ultra-clean regions like Hamina, Finland (europe-north1) running on 94% Carbon-Free Energy.
  2. Autonomous Container & Kubernetes Right-Sizing: The Duo Agent audits Dockerfiles to eliminate bloated base images (e.g., refactoring full Python/Node images to lightweight -slim distributions) and inspects Kubernetes Deployment manifests to detect idle CPU/RAM over-allocation, generating one-click right-sizing patches.
  3. Cryptographically Signed Green Bill of Materials (GBOM): CarbonZero Duo publishes a verifiable audit report and badge directly into the GitLab Merge Request discussion thread, complete with carbon savings percentages, equivalent car kilometers avoided, and an SLSA-compliant JSON-LD attestation digest.
  4. Google Cloud Run Zero-Idle Architecture: Practicing what it preaches, CarbonZero Duo is deployed serverless on Google Cloud Run with automatic scale-to-zero, eliminating idle standby emissions.

⚙️ How We Built It

1. Mathematical Modeling & Energy Formulations

To ensure high-fidelity carbon accounting, our engine models server power consumption ($P_{\text{total}}$) based on allocated vCPUs, RAM, and the Google Cloud average Power Usage Effectiveness ($\text{PUE} = 1.10$):

$$P_{\text{total}} = (N_{\text{vCPU}} \times 12.5\,\text{W}) + (M_{\text{RAM_GB}} \times 0.38\,\text{W})$$

Energy consumed in kilowatt-hours ($E_{\text{kWh}}$) over pipeline duration $t_{\text{hours}}$ is:

$$E_{\text{kWh}} = \frac{P_{\text{total}} \times t_{\text{hours}} \times \text{PUE}}{1000}$$

Total lifecycle carbon emissions ($\text{Emissions}{\text{gCO}_2\text{eq}}$) are derived using the target region's real-time grid intensity factor ($I{\text{grid}}$):

$$\text{Emissions}{\text{gCO}_2\text{eq}} = E{\text{kWh}} \times I_{\text{grid}}$$

2. GitLab Duo Custom Flows & Event Triggers

We defined an event-driven flow (.gitlab/duo/flows/carbonzero-autopilot.yml) that triggers on merge_request.created, merge_request.updated, and scheduled audits (0 2 * * *).

3. Model Context Protocol (MCP) Server

We developed a compliant Model Context Protocol server (mcp_server.py) exposing 5 standardized tools:

  • get_grid_carbon_intensity: Returns live CFE% and carbon intensity for cloud regions.
  • list_all_gcp_regions_carbon: Returns a ranked list of cleanest deployment targets.
  • optimize_pipeline_schedule: Computes runner emissions and clean-region savings.
  • audit_container_and_k8s: Detects image bloat and over-provisioned pod limits.
  • generate_gbom_attestation: Produces signed Green Bill of Materials markdown.

4. Frontend & Deployment

  • Built a modern, dark glassmorphism web dashboard featuring live regional telemetry, an interactive carbon savings calculator, and a live GitLab Duo Flow simulator.
  • Implemented automated continuous deployment to both Vercel (carbonzero-duo.vercel.app) and GitHub Pages.
  • Packaged multi-stage containers for Google Cloud Run in europe-north1 to qualify for the +0.2 Google Cloud bonus.

🧗 Challenges We Ran Into

  • Balancing Telemetry Precision with Latency: Querying live external carbon APIs during fast CI/CD pipeline runs could introduce latency or rate limits. We resolved this by building a localized regional carbon modeling engine with diurnal solar/wind variance curves, allowing sub-millisecond MCP tool responses.
  • Synthesizing Safe Resource Patches: Automated Kubernetes changes risk causing out-of-memory (OOM) kills if pods are under-provisioned. We designed our right-sizer to enforce a strict 2x burst limit safety buffer above audited baselines.
  • Cross-Platform Static & Dynamic Hosting: Ensuring the interactive dashboard functioned with 100% fidelity on both server-backed containers (Cloud Run) and static edge CDNs (GitHub Pages, Vercel) required crafting resilient client-side fallbacks.

🏅 Accomplishments That We're Proud Of

  • 5 Complete DevSecOps Stages Automated: We cover Code Review, Testing, Infrastructure Configuration, Deployment, and Compliance/Audit post-commit.
  • Pioneering the Green Bill of Materials (GBOM): Bringing cryptographic proof of sustainability directly into pull requests.
  • Zero External Runtime Dependencies: The Python backend utilizes standard libraries, ensuring instant, lightweight execution on any machine or runner.
  • 100-Second Broadcast-Quality Demo Video: Produced with custom AI voice narration, graphical telemetry visuals, and synchronized subtitles.

🧠 What We Learned

  • How Anthropic's Model Context Protocol (MCP) transforms AI agents from chat interfaces into autonomous systems engineers capable of interrogating cloud infrastructure.
  • The massive environmental delta between data centers: simply shifting a runner from a fossil-heavy grid (545 gCO2/kWh) to Hamina, Finland (24 gCO2/kWh) cuts CI emissions by up to 85% with zero impact on build performance.

🔮 What's Next for CarbonZero Duo

  • Kubernetes Dynamic Admission Webhooks: Integrating CarbonZero Duo as a validating webhook to block deployments whose containers lack a certified GBOM.
  • GitLab Security Center Synergy: Co-optimizing security vulnerability patch urgency with clean energy execution windows.
  • Grid-Aware Spot Bidding: Dynamically bidding on spot instances synchronized with peak renewable energy generation hours.

Built With

Share this project:

Updates

Submission history