EcoSec: Autonomous Green DevSecOps Agent

An autonomous dual-agent ecosystem for GitLab Duo that intercept pipelines and MR to physicaly rewrite security vulnerabilities and optimize carbon-heavy O(N^2) algorithms before they reach the cloud.

Comment

Inspiration

Software development is facing two massive, invisible crises: critical security vulnerabilities effortlessly slipping into production, and massively unoptimized code wasting immense amounts of compute power and generating excess carbon emissions. We wanted to build a futuristic AI teammate that tackles both of these problems natively inside the developer workflow.

What it does

EcoSec is a dual-agent platform native to GitLab Duo that automatically intercepts bad code before it reaches production:

  1. The EcoSec AutoFixer (CI/CD Pipeline): If a developer breaks the build by failing a SAST scan, EcoSec uses Google Gemini 2.5 Flash to read the vulnerable codebase, rewrites the files to fix the security flaw AND optimizes any compute-heavy loops it finds, and completely automates the creation of a Merge Request.
  2. The EcoSec Reviewer (Merge Requests): When an MR is opened, the EcoSec agent acts as an autonomous Senior Engineer. It intercepts the event, grades the diff with a Security Risk Rating and an Eco-Compute Score (A through F), and posts a threaded comment in the GitLab UI with perfectly optimized and secured code.

How we built it

We integrated natively with GitLab Duo's AI Catalog using AGENTS.md to define the "EcoSec" persona. We used .gitlab-ci.yml event triggers (merge_request_event and on_failure) to hook the agents directly into the pipeline. For the "brain", we used Google Gemini 2.5 Flash combined with Pydantic Structured Outputs to force the LLM to return strictly parsable JSON. This allowed our agents to reliably pull out "Security Risks", "Compute Inefficiencies", and "Suggested Fixes". We also built a pytest testing sandbox alongside Bandit SAST scanning to prove that the AI patches actively fix vulnerabilities without breaking the core application logic.

Challenges we ran into

Getting an LLM to reliably return formatted code diffs that a python script can cleanly inject into a GitLab Merge Request comment is notoriously difficult due to Markdown formatting collisions. We overcame this by using Google Gemini's advanced response_schema API feature to force the model into a deterministic JSON format, guaranteeing our pipeline never hallucinates or breaks formatting.

Accomplishments that we're proud of

We are incredibly proud of our agent's ability to specifically target Green Compute inefficiencies. Giving an AI the architectural freedom to look at an O(N^2) Python loop with massive memory allocation, and autonomously rewrite it into a single, efficient database SELECT COUNT(*) query is completely game-changing for cloud computing carbon reduction.

What we learned

We learned the sheer power of natively hooking into GitLab pipelines paired with Google Gemini. By treating the CI runner as the "brain," we transformed an inanimate codebase into an autonomous guardian that actively heals itself.

What's next for EcoSec: Autonomous Green DevSecOps Agent

We want to expand EcoSec to measure literal hardware wattage over time. By hooking it into Kubernetes observability tools or Google Cloud's Carbon Footprint APIs, EcoSec wouldn't just use Big-O notation, it would calculate exactly how many grams of CO2 its automated patch just saved the organization!

Built With

Share this project:

Updates

Submission history