Cheminformatics Explorer: Agentic Release Guard

A keyless chemistry web app, now released by GitLab Duo agents: they review changes, test against PubChem reference data, scan for risks, deploy to Pages and watch for API drift.

Comment

Inspiration

Undergraduate chemistry education and early pharmaceutical research demand accessible tools to explore 3D molecular conformations, compute oral bioavailability criteria (Lipinski Rule of 5 and Veber rules), screen structural alerts (PAINS/Brenk), and inspect chemical safety data. However, commercial molecular modeling suites are cost-prohibitive and proprietary, while command-line Python workflows impose steep programming barriers. Furthermore, educational scientific applications typically suffer from critical post-code software lifecycle deficiencies:

  • No automated regression testing: Changes to chemical descriptor math or safety parsing are tested manually or not at all.
  • Silent upstream schema drift: Relying on public APIs (like NIH PubChem) without automated contract testing means unannounced schema changes can silently break frontend depictions.
  • Data integrity & hazard inflation: Public vendor chemical hazard submissions often include exaggerated worst-case notifications; without automated tests, algorithms can easily merge minority vendor claims and mislead students with false hazard classifications.
  • Lack of supply-chain security and governance: CDN dependencies are frequently unpinned, and scientific provenance labels or citation metadata risk being removed during rapid iteration.

What it does

Cheminformatics Explorer is a keyless, client-side chemical space workbench. Running entirely in the browser with zero server backend and zero API tokens, it integrates:

  • Hardware-accelerated 3D conformers (3Dmol.js) with spin and zoom controls.
  • In-browser 2D vector depictions and SMARTS functional group highlighting (RDKit.js WebAssembly).
  • Oral drug-likeness & medicinal chemistry alerts (Lipinski Rule of 5, Veber rules, PAINS, and Brenk filters).
  • Authoritative laboratory safety classifications (UN GHS via PubChem PUG View) using primary consensus filtering rather than inflated vendor merging.
  • Dual-audience learning toggle: Student Mode (conceptual explanations and PPE advice) vs. Researcher Mode (formal descriptors and SMARTS strings).

How we built it

For Path B of the GitLab Transcend Hackathon, the repository was re-engineered to span the complete GitLab software development lifecycle (SDLC). Pure domain logic was decoupled into cheminformatics-core.js, enabling sub-second offline unit testing via Node's built-in test runner without any external npm packages. Every code change is governed by an automated, multi-stage GitLab CI/CD pipeline (.gitlab-ci.yml) completing in under 1 minute with zero cache overhead.

Challenges we ran into

  • Zero-Dependency Constraint in CI/CD: We committed to maintaining a lean, audit-friendly codebase with zero npm dependencies. Building a complete testing, security, and governance suite required authoring custom test suites and linters (tests/pure-logic.test.mjs, tests/data-contract.test.mjs, scripts/check-governance.mjs, scripts/check-pinned-scripts.mjs) relying strictly on Node.js built-in standard modules (node:test, node:assert, node:fs).
  • Chemical Hazard Data Inflation & Integrity: Public repositories like NIH PubChem aggregate crowdsourced chemical safety sheets. Naively merging minority supplier entries results in exaggerated worst-case GHS classifications (e.g. labeling harmless or mild compounds with lethal "Danger" ratings). Designing and enforcing an automated consensus-filtering algorithm required strict anti-regression test assertions to prevent hazardous misinformation from reaching students.
  • Demonstrating Red-to-Green Anti-Regression in CI: To prove that our pipeline genuinely protects production rather than acting as a rubber stamp, we engineered a dedicated anti-regression branch (demo/safety-regression, MR !3). The pipeline catches the deliberate hazard inflation bug in 13 seconds, halts deployment, and turns green upon applying the consensus fix.
  • Constraining AI Agents to Domain Boundaries: Guiding GitLab Duo's Developer Flow to generate boundary-value tests required clear instructions in AGENTS.md and .gitlab/duo/ so Duo modified only tests/ files, maintained our zero-npm architecture, and produced 25 passing assertions for Lipinski and Veber limits.

Accomplishments that we're proud of

  • Full 9-Stage DevSecOps Lifecycle Automation: Transformed a standalone client-side web application into an enterprise-grade GitLab repository covering all nine stages: Plan (issue templates), Create (MR templates & Duo review), Verify (offline unit & contract tests), Package (MR staging previews), Secure (Semgrep SAST, Secret Detection, CDN pinning audit), Release (manual production gate for GitLab Pages), Configure (pinned Alpine containers), Monitor (weekly upstream API drift schedule), and Govern (MIT & CITATION.cff provenance audits).
  • Autonomous GitLab Duo Developer Flow Integration: Issue #2 ("Add unit tests for Lipinski and Veber boundary values") was autonomously executed by GitLab Duo, which authored 25 unit tests in tests/boundary-values.test.mjs, created branch duo/feature/2-lipinski-veber-boundary-tests, opened MR !4, and merged into main.
  • Ultra-Lean, Sub-75-Second Pipelines: Engineered an 8-job CI/CD pipeline that completes in under 75 seconds (< 2 compute minutes per commit) on Alpine Linux without heavy, unmanaged caches—minimizing computational carbon footprint.
  • Production Deployment with Human-in-the-Loop Governance: Hosted live on GitLab Pages with an explicit manual approval gate (when: manual), balancing autonomous speed with scientific human review (Assisted Autonomy).

What we learned

  • Post-Code Lifecycle is the Real Moat: AI can write code quickly, but ensuring code is scientifically correct, secure, and resilient against third-party API drift requires robust, automated post-code pipelines.
  • Agent Governance Requires Strict Project Context: GitLab Duo performs best when given precise repo-level rules. Defining explicit guidelines in .gitlab/duo/mr-review-instructions.yaml and AGENTS.md prevented hallucinated npm installs and kept test generation strictly scoped.
  • Green Architecture by Design: Moving computational chemistry descriptors (LogP, Lipinski, Veber) into browser WebAssembly (RDKit.js) and WebGL (3Dmol.js) eliminates 24/7 cloud server emissions entirely, while lean Alpine CI pipelines dramatically cut cloud energy consumption.

What's next for Cheminformatics Explorer: Agentic Release Guard

  • Registering the "Chem Data Steward" Agent in the GitLab AI Catalog: Promoting our custom agent definition (docs/duo/chem-data-steward.md) to the GitLab Duo Agent Catalog so scientific organizations can automate chemical literature provenance and CID verification across repositories.
  • Multi-Repository Contract Testing: Expanding our weekly scheduled API drift monitor beyond NIH PubChem to European chemical databases including ECHA CHEM and ChEMBL REST.
  • Automated Client-Side WebGL Regression Testing: Adding headless browser visual snapshot comparison into the CI pipeline to catch 3D molecular rendering regressions automatically before release.

Built With

Share this project:

Updates

Submission history