🏆 Devpost Submission Dossier — GitLab Sentinel Agent

Project Title: GitLab Sentinel: Autonomous DevSecOps & Closed-Loop CI/CD Self-Healing Agent
Tagline: Autonomous post-code AI agent that scans AST vulnerabilities, isolates pipeline test failures, and applies surgical self-healing Merge Request patches.
Target Challenge: GitLab Transcend Hackathon: Life After Code
Target Cash Prize: $45,000 Cash Pool
Public Repository: https://github.com/bhomvratrai-glitch/gitlab-sentinel-agent
Live Web Studio: https://bhomvratrai-glitch.github.io/gitlab-sentinel-agent/

1. Inspiration

In 2026, LLMs can generate code in milliseconds—yet engineering velocity remains bottlenecked by the chaotic, manual friction of the post-code lifecycle:

• Security reviews: Developers push vulnerable code containing CWE-78 command injection or CWE-89 SQL injection that traditional linters miss.
• Flaky & broken CI pipelines: Test failures require developers to parse 10,000-line job logs to locate failing assertions.
• PR review latency: Code sits idle waiting for human reviewers to comment trivial syntax or vulnerability fixes.

We asked: What happens when AI takes over the entire DevSecOps lifecycle? What if a GitLab agent could analyze AST code trees, catch vulnerabilities before production, run tests in an isolated sandbox, and autonomously push verified remediation patches directly to the Merge Request?

That is the mission of GitLab Sentinel.

2. What It Does

GitLab Sentinel is an end-to-end autonomous agent automating the "Life After Code":

• Static AST Security Auditing: Scans Abstract Syntax Trees across Python source code to detect critical vulnerabilities (CWE-78 Command Injection, CWE-89 SQL Injection, CWE-94 Code Injection, and CWE-798 Hardcoded Secrets).
• Hermetic CI Runner: Executes pytest suites in an isolated subprocess environment simulating GitLab CI runners, capturing duration metrics and parsing stack traces.
• Closed-Loop Surgical Remediation: Analyzes failures and security findings, applying surgical code refactors (e.g., transforming os.system() to parameterized subprocess.run(shell=False) and SQL concatenation to parameterized tuples).
• GitLab MR Automation: Integrates natively with GitLab API v4, posting inline code review discussions formatted as native GitLab code suggestions (suggestion:-0+0) and opening automated remediation merge requests.
• Interactive Web Studio: A modern dashboard providing real-time simulated DevSecOps pipeline streaming and before/after code diff visualization.

3. How We Built It

• Core Security Engine: Custom Python AST parser (gitlab_sentinel/scanner.py) implementing precise vulnerability node matching.
• Sandboxed Execution: Subprocess-based hermetic test runner (gitlab_sentinel/ci_runner.py) with strict timeouts and pytest traceback tokenizers.
• Autonomous Remediation: Rule-based heuristic repair + LLM interface (gitlab_sentinel/remediator.py) producing minimal diffs.
• GitLab Client: Zero-dependency Python client (gitlab_sentinel/gitlab_client.py) connecting with GitLab REST API v4 for discussions, branch creation, and MR generation.
• GitLab CI Pipeline: .gitlab-ci.yml with dedicated security scanning and auto-remediation stages.
• Testing: 14 automated unit tests running in 0.33 seconds with 100% pass rate.

4. Challenges We Ran Into

• Avoiding Regressions During Auto-Patching: Ensuring that security fixes (such as switching from os.system to subprocess.run) preserve exact function signatures and don't introduce breaking changes to existing test suites. We resolved this through hermetic sandbox re-execution where patches are only committed if the test suite remains 100% green.
• GitLab Inline Suggestion Formatting: Formulating line-level discussion payloads compatible with GitLab's diff position schema (base_sha, start_sha, head_sha).

5. Accomplishments We're Proud Of

• Developed a complete, production-grade agent with 14 automated unit tests passing in 0.33 seconds.
• Fully demonstrated automated remediation across 4 major CWE vulnerability classes.
• Packaged both a rich CLI (gitlab_sentinel.cli) and a responsive Web Studio deployed live on GitHub Pages.

6. What We Learned

• Post-code automation (testing, security auditing, and automated MR suggestions) provides 10x higher enterprise leverage than raw code generation copilots.
• AST analysis combined with sandboxed execution eliminates false positives and ensures secure, verifiable self-healing.

7. What's Next for GitLab Sentinel

• Native integration with GitLab Duo Agent Platform MCP servers.
• Expansion to multi-language AST auditing (TypeScript, Go, Rust).

Built With

• ai-agents
• ci-cd
• devsecops
• github
• gitlab
• pytest
• python