GitLab Transcend — Life After Code (post-code DevSecOps)

Code complete is not done. Review, security, tests, compliance, build and follow-up are five manual chores after every merge — this pipeline does all of them, automatically, on every merge to main. What it is: sample-app is a tiny quotation service (Node stdlib only). GET /health returns {"ok":true}; POST /quote with 2 items at 499 plus 99 returns total 1097. This is the same quotation maths as the ClickCraft CRM quotations page, shrunk to one service. No fake data. lifecycle-guard: secret scan, licence allowlist, npm-audit parser, release-notes generator and post-merge checklist, all unit-tested. .gitlab-ci.yml: 6 stages / 6 jobs — review:secrets, security:audit, test:unit, compliance:licenses, build:artifact, post-merge:release. Proof: Local run (evidence/local-run.log): 10/10 tests (4 sample-app + 6 guard), secret scan clean, npm audit 0 critical / 0 high / 0 moderate / 0 low, licences MIT allowlisted, artifact built, release notes generated. Hosted run: pipeline #2987029049, all 6 jobs green, 1 min 12 sec, commit e9a973bd. Next plug-in: this same lifecycle for a real small-business CRM, so a merge ships reviewed, tested and followed up without anyone remembering a checklist.