GreenOps Transcend Duo: 9-Stage Autonomous Green DevSecOps

Autonomous GitLab Duo Flow Registry v1 agent platform orchestrating all 9 DevSecOps stages, ISO/IEC 21031 SCI carbon math & Google Cloud 94% CFE routing (-94.6% CO2e/req).

Comment

Inspiration

What it does

How we built it

Challenges we ran into

Accomplishments that we're proud of

What we learned

What's next for GreenOps Transcend Duo: 9-Stage Autonomous Green DevSecOps

Inspiration: Life After Code Needs Autonomous 9-Stage GreenOps & DevSecOps

Writing code is no longer the bottleneck—what happens after code is written determines whether software is secure, resilient, and environmentally sustainable. Every day, enterprise engineering teams merge thousands of commits that inadvertently bloat container images by 800+ MB, keep idle cloud instances burning electricity 24/7, and deploy services into coal/gas-heavy datacenters (362–418 gCO2eq/kWh) instead of 94% Carbon-Free Energy (CFE%) Google Cloud regions (42 gCO2eq/kWh).

We built GreenOps Transcend Duo for the Life After Code: GitLab Transcend Hackathon to target Path B (Bring Your Own Application) as well as both Special Prize tracks:

  • Most Stages Covered ($5,000): Automates all 9 official GitLab DevSecOps stages (plan, create, verify, package, secure, release, configure, monitor, govern) in .gitlab-ci.yml and on our live GitLab Runner pipeline.
  • Most Environmentally Impactful ($5,000) + Google Cloud Integration (+0.2 Bonus Points): Implements the Green Software Foundation ISO/IEC 21031:2024 Software Carbon Intensity (SCI) specification (SCI = ((E * I) + M) / R) and automatically routes Google Cloud Run (run.googleapis.com) deployments to europe-north1 (Finland, 94% CFE, 42 gCO2eq/kWh), reducing per-request carbon intensity by 94.62% (177.96 g → 9.58 g CO2eq / 1k requests).

Live Links & Verifiable Proof

What It Does Across All 9 GitLab DevSecOps Stages

  1. Stage 01 — plan (stage_1_plan): Calculates the baseline ISO/IEC 21031:2024 SCI carbon budget (177.96 gCO2eq/1k req in us-east4) and enforces a strict Merge Request carbon ceiling (<= 15.0 gCO2eq/1k req).
  2. Stage 02 — create (stage_2_create): Performs AST diff inspection and generates autonomous MR patches that slim Dockerfiles (python:3.11 1,120 MB → python:3.11-slim 148 MB, -86.8%) and enable scale-to-zero Cloud Run autoscaling (minScale: '0').
  3. Stage 03 — verify (stage_3_verify): Executes our deterministic pytest suite (4/4 passed) and validates .gitlab/duo/flows/greenops-transcend-flow.yml against GitLab's official Flow Registry v1 specification (version: "v1", environment: ambient).
  4. Stage 04 — package (stage_4_package): Compresses OCI layers and emits a signed Green Bill of Materials (stage_4_package_gbom.json) quantifying registry storage and network transfer energy savings.
  5. Stage 05 — secure (stage_5_secure): Runs Zero-Secret SAST scanning (0 leaked tokens, 0 critical CVEs) and verifies .gitlab/duo/agent-config.yml zero-trust network_policy (gitlab.com, registry.gitlab.com, run.googleapis.com).
  6. Stage 06 — release (stage_6_release): Publishes immutable semantic release manifests (v1.0.0-greenops) tagged with verified -94.62% SCI carbon delta notes.
  7. Stage 07 — configure (stage_7_configure · Google Cloud Run CFE% Router): Evaluates Google Cloud's regional Carbon-Free Energy (CFE%), grid carbon intensity, and PUE matrix, routing Cloud Run deployments from us-east4 (39% CFE, 362 gCO2/kWh) to europe-north1 (94% CFE, 42 gCO2/kWh, PUE 1.09).
  8. Stage 08 — monitor (stage_8_monitor): Tracks post-deployment SLOs (p95 = 38ms), FinOps savings, and annual carbon avoidance (20,205.6 kg CO2eq saved/year at 120M requests).
  9. Stage 09 — govern (stage_9_govern): Emits a cryptographic SHA-256 ISO/IEC 21031:2024 Governance Attestation (e8c94b72...) across all 9 stages.

How We Built It

  • 100% Authentic GitLab Duo Flow Registry v1 Schema (.gitlab/duo/flows/greenops-transcend-flow.yml): Uses version: "v1", environment: ambient, typed AgentComponent nodes (plan_and_create_carbon_budget, verify_package_secure_gate, release_configure_monitor_govern_gcp), conditional routers, flow.entry_point, and inline prompts with official GitLab Duo toolsets (get_issue, get_merge_request, list_merge_request_diffs, get_repository_file, create_commit, get_pipeline_errors, create_merge_request_note, create_issue_note).
  • Path B (Bring Your Own Application): Migrates our open-source MIT-licensed FastAPI + MCP security gateway (ClockedOmniGuard) into GitLab's 9-stage autonomous post-code lifecycle.
  • 9-Tool JSON-RPC 2.0 MCP Server (backend/mcp_server.py): Exposes one deterministic MCP tool per DevSecOps stage (gitlab_duo_stage_plan .. gitlab_duo_stage_govern).

Challenges & What We Learned

Auditing existing public entries revealed that many custom flows invent non-existent YAML keys (version: "1.0", workflow:) instead of adhering to GitLab's official Flow Registry v1 contract (version: "v1", environment: ambient, components, routers, flow, prompts, <= 40 KiB). Building a built-in Flow Registry v1 validator inside Stage 3 (verify) ensured 100% specification compliance while automating all 9 stages on our live GitLab project runner.

Built With

Share this project:

Updates

Submission history