Incident-to-Fix Agent

An agent that turns a failed CI log into a verified fix: it finds the culprit commit, asks NVIDIA Nemotron on Nebius for a patch, and only commits it after tests pass.

Comment

Inspiration

When CI breaks, someone has to read the log, find the failing file, work out which commit caused it, search for the error, write a fix and re-run the tests. It interrupts focus and always seems to happen at the worst time. Most of it is mechanical, so we built an agent that does the whole loop and shows its work.

What it does

Give Incident-to-Fix Agent a failed CI log and a git repository. It:

  1. Parsesthe stack trace and finds the failing file and line (Python, JavaScript/TypeScript, Go, Ruby, Java).
  2. Blames that line with git blame to find the commit that introduced the bug.
  3. Asks an NVIDIA Nemotron model on Nebius Token Factory** for the smallest root-cause fix.
  4. Verifies the fix by applying it on a fix/<commit> branch and re-running the project's own tests. If they still fail, it reverts and says so. It never claims a fix it has not verified. 5.Delivers a commit that names the regression commit and, through the GitHub Action, a pull request for a human to review. Nothing is merged automatically. We ship two live demos, both run on Nebius with nvidia/nemotron-3-super-120b-a12b:
  5. Python: a "perf" commit removed an empty-list guard and broke average() with ZeroDivisionError. The agent found that exact commit, restored the guard, and the tests passed.
  6. JavaScript: a "refactor" commit removed a null check and Node threw TypeError. The agent found the refactor commit, restored the check, and the tests passed.

How we built it

  • Nebius Token Factory serves inference through its OpenAI-compatible chat completions API.
  • NVIDIA Nemotron (nemotron-3-super-120b-a12b) does the reasoning.
  • The agent is plain Python standard library plus git**: about 150 lines and nothing to install.
  • A GitHub Action triggers on failed CI and runs three separate jobs, so that no job holds both untrusted code and a secret:
    • propose has the model key but runs no repository code;
    • verify runs your tests with no secrets and a read-only token;
    • pr pushes from a fresh checkout and runs no tests.

Challenges we ran into

  • Stack traces differ by language. Python's innermost frame is last, JavaScript's is first. Our first parser got JavaScript wrong until a real Node trace exposed it.
  • CI logs are untrusted input. A crafted log could point the agent at .git/hooks or a workflow file, so the agent only edits git-tracked files inside the repo and re-validates its own proposal files.
  • Running model-written code next to API keys is dangerous.** Scrubbing environment variables is not a sandbox, so we redesigned the Action around separate jobs instead.

Accomplishments that we're proud of

  • A closed loop (parse, blame, reason, verify, deliver), not a single prompt.
  • Verified end to end on Nebius Token Factory with an NVIDIA model, in two languages.
  • Two automated security reviews found real issues, and we fixed them before launch. ## What we learned Trust boundaries matter more than prompts. The hard part of an agent that edits code is deciding what it may touch and who may see its secrets.

What's next for Incident-to-Fix Agent

  • Diff-based patching and multi-file fixes (today it rewrites one whole file).
  • A confidence score and flaky-test detection before attempting a fix.
  • Multi-failure triage and a PR comment that explains the regression.

Built With

Share this project:

Updates

Submission history