Depramate

AI agent that detects silent portfolio downtime from expired API keys, billing holds, and webhook failures—before your users notice.

Comment

Depramate

Inspiration

As a developer managing multiple portfolio projects, I've experienced the frustration of discovering my live apps were down—not because of a code bug, but because of trivial post-deployment issues I had overlooked. An expired API key here, a $0.20 Google Cloud billing hold there, a misconfigured webhook somewhere else. These silent failures don't trigger traditional monitoring alerts, and by the time users notice, the damage to credibility is done.

I built Depramate to solve this problem: an AI-powered DevSecOps agent that continuously monitors the post-code lifecycle and catches the easy-to-miss infrastructure issues that cause sudden downtime.

What it does

Depramate is an autonomous AI agent built on the GitLab Duo Agent Platform that detects silent portfolio downtime caused by post-code failures:

  • Expired or revoked API keys (HTTP 401/403 responses)
  • Failing webhooks (timeouts or non-2xx responses)
  • Google Cloud billing holds (disabled billing or closed accounts)
  • Outdated dependencies (software rot)

The autonomous workflow:

  1. Monitor: Runs on a schedule (every 30 minutes) via GitLab CI/CD, polling health endpoints and checking cloud status APIs
  2. Detect: Identifies failures and categorizes them by severity (low, medium, high, critical)
  3. Plan: Automatically creates one GitLab issue per failing check with:
    • Title: [Depramate] <check name>: <short symptom>
    • Labels: depramate and severity::<level>
    • Remediation steps in the description
  4. Deduplicate: Searches for existing open issues to avoid creating duplicates
  5. Govern: Applies guardrails—never rotates keys, changes billing, or modifies cloud resources. Only reports and recommends.

Supervised autonomy: Depramate executes the full monitoring and issue-creation workflow without human intervention. Developers only review the created issues and approve fixes. No approval needed for individual monitoring steps.

DevSecOps stages covered: Monitor, Govern, Configure, Verify, Plan

How I built it

Tech stack:

  • Python 3.12 with FastAPI for the status API
  • GitLab CI/CD for scheduled pipeline execution
  • GitLab Duo Agent Platform for autonomous workflow orchestration
  • Google Cloud Run for deploying the status component (0.2 bonus)
  • httpx for HTTP probing with retry logic
  • pytest + respx for mocked testing
  • ruff for linting and formatting

Architecture:

  1. Checker modules (depramate/checks/): Each checker (endpoints, webhooks, billing, dependencies) returns a CheckResult with status (ok/warn/fail), severity, and remediation. All checkers timeout after 10 seconds and never raise exceptions.

  2. CLI scripts:

    • scripts/healthcheck.py: Runs all checks, writes JSON reports, appends to history, exits non-zero on failure
    • scripts/create_issues.py: Uses the GitLab REST API to create issues, searches for duplicates by title

  3. GitLab CI/CD pipeline (.gitlab-ci.yml):

    • verify stage: Runs ruff linting and pytest
    • monitor stage: Runs healthcheck.py, saves reports as artifacts (30-day retention)
    • report stage: Runs create_issues.py only when healthcheck fails

  4. Status API (depramate/api.py): FastAPI app with /health and /status endpoints, deployed to Cloud Run

  5. Agent instructions (AGENTS.md): Documents the mission, conventions, detection rules, workflow, and guardrails for the Depramate agent

Development process:

I used GitLab Duo Chat to scaffold the initial implementation, then iterated with the Developer flow to generate the checker modules, tests, and deployment configuration. The entire codebase was built in 7 days using GitLab's AI-powered development tools.

Challenges I ran into

  1. Short-lived GCP tokens: The Google Cloud Billing API requires an OAuth token that expires in ~1 hour. For scheduled pipelines, I need workload identity federation or a service account key exchange, which I'll implement post-hackathon. For now, the billing check returns warn without credentials.

  2. Balancing autonomy and safety: Billing and credential issues require human oversight. I chose Supervised autonomy over Hands-off to ensure Depramate never touches payment methods or rotates keys without approval.

  3. Deduplication logic: Preventing duplicate issues required searching GitLab's API by title and label. I had to handle edge cases like retries (a transient failure shouldn't create an issue) and exact title matching.

  4. Time constraint: With a 7-day hackathon window, I prioritized the core monitoring workflow over nice-to-haves like a status page frontend and depramate.yml configuration files.

Accomplishments that I'm proud of

  • Full CI/CD integration: Depramate runs entirely within GitLab CI/CD, requiring zero external infrastructure beyond the optional Cloud Run status component.

  • Production-ready code quality: 100% test coverage with mocked HTTP calls, ruff-clean formatting, type hints throughout, and comprehensive error handling.

  • Real-world utility: I tested Depramate against my own portfolio projects (CineFiles backend) and it correctly detected a 404 endpoint and created actionable issues.

  • DevSecOps breadth: Depramate touches 5 stages of the post-code lifecycle (Monitor, Govern, Configure, Verify, Plan), demonstrating deep integration with GitLab's platform.

  • Guardrails-first design: The agent never modifies protected resources. It only reports and recommends, ensuring safety in production environments.

What I learned

  • GitLab Duo Agent Platform capabilities: I learned how to use AGENTS.md to define agent behavior, how the Developer flow scaffolds multi-file implementations, and how to orchestrate autonomous workflows in CI/CD.

  • Supervised autonomy design patterns: Building an agent that runs multi-step workflows without human approval for each step, while still requiring approval for the outcome, taught me how to balance automation and control.

  • Post-code monitoring gaps: Traditional monitoring focuses on uptime and performance. I learned that expired API keys, billing holds, and webhook failures are a blind spot that causes real downtime but isn't covered by standard tools.

  • GitLab REST API for issue automation: I learned how to programmatically create, search, and label issues, which is critical for autonomous agent workflows.

What's next for Depramate

Post-hackathon improvements:

  1. Status page frontend: A simple HTML dashboard showing green/yellow/red cards per check, last run time, and recent history. No build step, deployed in the same Cloud Run container.

  2. Configuration file: Move endpoint and webhook URLs from environment variables to a depramate.yml file, so one Depramate instance can monitor multiple projects. Only secrets stay in CI/CD variables.

  3. Workload identity for GCP billing: Replace the short-lived GCP_ACCESS_TOKEN with workload identity federation or a service-account key exchanged for a token inside the CI job, so scheduled pipelines can run the billing check reliably.

  4. Automated fix MRs: For certain failures (outdated dependencies, configuration drift), Depramate could create draft MRs with suggested fixes, not just issues.

  5. SSL certificate expiry checker: Warn when certificates are within 30 days of expiration.

  6. Dependency CVE scanning: Integrate with a vulnerability database to flag dependencies with known CVEs, not just outdated versions.

  7. Slack/Discord notifications: Post a summary to a webhook when checks fail, in addition to creating GitLab issues.

  8. Multi-project monitoring: Allow one Depramate instance to monitor endpoints across multiple GitLab projects or external services.

Built With

Share this project:

Updates