Clipper v2: a video clipper that ships itself

Inspiration

Turning a one-hour talk, stream, or podcast into a handful of good 30–60 second clips is slow work. Creators, educators, and small teams spend hours scrubbing timelines. Open-source tools exist for this, but they usually stop at the code. They have no regression safety net, no security scanning, and no repeatable deploy, so every change is a gamble and "it worked on my laptop" is as far as they get.

The hackathon's question, "code generation is solved, so what happens next?", described that gap exactly. We took a working open-source clipper and asked how much of its life after code we could hand to GitLab Duo agents and pipelines.

What it does

The product. Clipper v2 turns a long video into short, captioned highlight clips:

1. Ingest: upload a video in the web UI. URL input is turned off in the public demo.
2. Transcribe: locally with faster-whisper.
3. Pick the best moments: an LLM picks strong, self-contained segments. There is a single-pass mode and an agentic propose-then-critique mode. Every plan goes through hard validation: finite timestamps, inside the source, within min/max length, no overlaps, chronological order.
4. Score for audience fit: an optional Qloo-powered scorer ranks candidate moments by taste affinity for a chosen audience and location.
5. Render: ffmpeg cuts vertical clips with burned-in captions. Each clip gets a sidecar JSON with a title, description, and hashtags per platform.

The automation (the "life after code" part). Each merge request and each push to main goes through:

lint ──► test ──► build ──► security ──► deploy-staging (+smoke) ──► deploy-production (manual gate, +smoke)

• Lint: ruff (published as a GitLab Code Quality report) and a config linter that validates the Duo agent and flow YAML.
• Test: 122+ unit tests (JUnit report in the MR), golden-clip regression tests that render the sample video and diff the clip plan against a checked-in golden plan, and a Whisper smoke test.
• Build: Docker image built and smoke-tested in CI. The container must boot in public-demo mode and answer /healthz before it is pushed to the GitLab Container Registry.
• Secure: three GitLab security scanners: Semgrep SAST, Secret Detection, and Container Scanning on the exact image that ships.
• Deploy: one-click deploys to Railway staging and production, using GitLab environments, environment-scoped project tokens, and resource_group locks. An automated smoke test runs the full pipeline against the deployed URL after each deploy.

GitLab Duo Agent Platform (.gitlab/duo/):

How we built it

• Core: Python 3.12, faster-whisper, ffmpeg/libass, and a small web server with a drag-and-drop UI.
• Pluggable LLM layer: one interface, several providers.
  • GLM (hosted, OpenAI-compatible): the hosted demo's default picker.
  • NVIDIA Nemotron via Nebius Token Factory: used for the agentic propose-then-critique picker.
  • Ollama: local option that needs no key.
  • Offline heuristic picker: the automatic fallback when no API key is set. This lets every CI job run deterministically with no network calls and no secrets, and it is what makes the golden-clip tests reproducible.
• Audience fit: Qloo Taste API, which re-ranks candidate moments by audience and location affinity.
• GitLab: .gitlab-ci.yml with included SAST, Secret Detection, and Container Scanning templates moved into a dedicated security stage. Code Quality and JUnit reports show inline on MRs. Container Registry. Environments with deploy and verify actions. Environment-scoped, masked, protected CI/CD variables. Duo Agent Platform custom flows, custom agents, and review instructions.
• Deploy: Railway CLI (railway up --ci) from GitLab jobs. railway.json sets the /healthz health check and the restart-on-failure policy.
• Guardrails as code: scripts/check_duo_configs.py lints the agent configs, scripts/golden_check.py handles regression, and scripts/smoke_test.py checks deployed environments end to end.

What's new for this hackathon

Everything below was built during the Submission Period (on or after Oct 5, 2026). The core clipping engine already existed as the MIT open-source-clipper project.

• GitLab Duo Agent Platform automation: Clip-QA, Test-Writer, and Release-Notes flows, three custom chat agents, project-specific Duo Code Review instructions, and agent-config.yml with a locked-down network policy.
• Full GitLab CI/CD pipeline: lint, unit tests, golden-clip regression, Docker build with in-CI container smoke test, Container Registry publishing.
• Security stage: Semgrep SAST, Secret Detection, Container Scanning.
• Railway deployment: staging and production environments, one-click promotion, post-deploy smoke tests, health checks.
• Demo-safety mode (PUBLIC_DEMO=1): no arbitrary YouTube/URL input, no browser cookies, capped upload size and duration, keys only from environment variables and never echoed by /api/config or /healthz. The demo uses original or Creative Commons footage only.
• Clipper v2 features: pluggable provider layer (GLM, Nemotron/Nebius, Ollama, heuristic fallback), agentic propose-then-critique picker, Qloo audience-fit scorer.

Before: clone it, run it on your laptop, hope nothing broke. No tests in CI, no scans, no deploy. After: every change is linted, tested against a golden clip plan, scanned three ways, reviewed by project-aware Duo agents, and deployable to a live URL in one click.

DevSecOps lifecycle stages covered

Challenges we ran into

• Testing an AI feature deterministically. LLM output varies, and CI should not hold API keys. We built the offline heuristic picker plus a golden clip plan, so the pipeline checks real rendering behaviour with no network and no secrets. Real-model behaviour stays a provider-level concern.
• Making a public demo safe. A clipper that accepts any YouTube URL is a copyright and terms-of-service problem. We added a demo mode enforced in code, checked by /healthz in CI, and guarded by Duo review rules, so it can't regress quietly.
• Environment-scoped deploy tokens. Railway project tokens are bound to one environment. We mapped them onto GitLab environment-scoped variables so staging and production can never cross.
• Getting agents to do useful work. Generic "review this MR" prompts produced noise. Grounding Clip-QA in a runnable artifact (the golden check) and giving Duo Code Review file-scoped project rules made the feedback specific and actionable.

Accomplishments that we're proud of

• A green, six-stage pipeline with three security scanners. The deployed image is the same one that was scanned and smoke-tested.
• Golden-clip regression tests for an AI video product, catching behaviour drift and not just broken code.
• Duo agents that do work and not only comment: Test-Writer commits tests, Release-Notes opens an MR, Clip-QA runs the regression check before giving a verdict.
• Zero-secret CI: 122+ tests and the full render path run with no API keys.
• A live, public demo that is responsible by design.

What we learned

• Agents are most useful when they can run something. A golden check or a test suite gives the agent ground truth to reason from.
• Review instructions scoped to file paths are a lightweight but effective form of policy-as-code.
• A deterministic fallback for every AI dependency improves both CI and the user experience: the app still works with no key.
• Moving a project onto GitLab's full lifecycle turned a script into something we'd be comfortable letting others ship changes to.

What's next for Clipper v2

• Let Clip-QA approve or block production promotion automatically and post a deploy summary on the MR.
• Issue-to-MR flow: open an issue like "clips are too long for TikTok", and an agent proposes the config or code change, opens the MR, and runs the pipeline.
• Auto-remediation of SAST and container-scan findings with a Duo flow.
• Optional Google Cloud (Cloud Run) deployment target.
• Measuring energy and carbon per clip rendered (SCI). The heuristic picker and small-model planner are natural starting points.

Built With

• docker
• ffmpeg
• gitlab-ci/cd
• gitlab-duo
• glm
• python
• railway
• whisper