CodeGuard AI

Inspiration ("Life After Code")

Writing code has gotten ten times faster with AI, but what happens after code is complete? Merge requests still wait hours or days for test triage, security review, and release verification. We built CodeGuard AI for the GitLab Transcend Hackathon (Path A: Start Fresh) as an autonomous release engineering agent that deterministically governs the path from code completion to safe deployment.

What CodeGuard AI Does

1. Live GitLab Ingestion & AST Analysis: Connects via authenticated REST API to fetch merge requests, parses the AST diff, and calculates an isolated blast radius and risk index (demonstrated with low risk on MR !1).
2. Deterministic Fail-Closed Policy Gating: Evaluates release readiness against policy rules. Even when feature test pipelines pass (e.g., Pipeline #2933699545), CodeGuard returns BLOCKED if mandatory production build evidence is missing, preventing premature deployment.
3. Supervised Remediation Studio: Formulates targeted unified diffs for security vulnerabilities with mandatory human review before any commit or deployment.
4. Verifiable Audit Ledger: Records all lifecycle events in an append-only SHA-256 hash chain with canonical JSON serialization and independent cryptographic verification.
5. GitLab Duo Flow Integration: Implements a custom Duo flow specification (gitlab-duo/release-guardrails.flow.yml) designed to operate alongside GitLab Duo reviewers.

How We Built It

• Frontend & API: Next.js 14 App Router, TypeScript, and TailwindCSS with dark-mode engineering console.
• GitLab Integration: Authenticated REST API client, webhook ingestion, and GitLab Duo custom flow definition.
• Testing & Verification: 115 automated Vitest unit and integration tests across 19 test files, with 0 ESLint warnings, 0 TypeScript errors, and a 577-package fail-closed security audit gate.
• Cryptographic Engine: SHA-256 hash chaining with canonical JSON ordering and an independent verification script (scripts/verify-audit-export.mjs).

Truthful Boundaries & Disclosures

• Duo Custom Cloud Flow: Flow YAML is verified in the repository; custom flow execution in the cloud requires GitLab group catalog registration.
• Audit Event Provenance: The demo video demonstrates genuine hash chaining and independent verification using curated sample events (CURATED_SAMPLE_EVENTS) with real AuditLedger.verifyChain() logic.
• Cloud KMS & Deployment: The KMS signing provider interface and Cloud Run dispatch endpoints are implemented, with signing explicitly labeled SIGNING_UNCONFIGURED pending active Google Cloud KMS credentials.

Built With

• crypto-sha256
• gitlab-api
• gitlab-duo
• next.js
• node.js
• tailwindcss
• typescript
• vitest