Inspiration
What it does
How we built it
Challenges we ran into
Accomplishments that we're proud of
What we learned
What's next for Issue-to-Prod Autopilot
What it does
A custom GitLab Duo Agent Platform flow ("Issue to Prod Autopilot") fires when a work item is created or the flow is mentioned. A triage agent labels the issue and posts acceptance criteria and a branch plan. An implement agent creates an autopilot/* branch, writes code and tests and opens a merge request. A review agent comments, checks risk and labels the MR autopilot::ready or autopilot::needs-human.
CI then takes over deterministically: ruff + pytest with coverage, SAST, secret detection, pip-audit and container scanning. scripts/policy_gate.py reads that evidence and returns merge, escalate or block. After merge, main builds the image with a CycloneDX SBOM, cuts a versioned GitLab release and posts a change passport (tests, scans, release tag) back on the original issue.
Lifecycle stages touched
Plan (triage agent), Create (implement agent), Verify (lint/test + review agent), Secure (SAST, secrets, pip-audit, container scan; Chainguard runtime image with 0 known vulns), Package (image + SBOM), Govern (policy gate: block/escalate/merge), Release (tagged releases), Configure (agent-config.yml, AGENTS.md), Monitor (scheduled uptime check), plus Report (change passport).
How we built it
Flow registry v1 YAML created via GraphQL in the AI Catalog; triggers: Mention + Work item created. Payload app is LeadFlow, a FastAPI lead-intake API for small businesses. Real issues went through the loop: telegram +10 score (MR !1), DELETE /leads/{id} (MR !2), filter GET /leads by source (MR !3), all merged with green MR pipelines in the CI/CD history. When main moved and MR !3 conflicted, a single mention made the flow rebase it, keep both features and push; the gate then said merge (39 tests, 0 high/critical findings).
Challenges
Only human actions fire flow triggers, so the chain is human issue -> flow -> deterministic CI. The default python slim image has no git (switched to the default flow image). Container scan found High Debian CVEs (moved to Chainguard). The hackathon role (Developer) cannot create project access tokens, so the gate's auto-merge call is wired but merges are triggered by a one-click auto-merge after the gate says merge.
What's next
Cloud Run staging/prod deploy with rollback, auto-merge token, escalation demo for pipeline-file changes.
Testing instructions
pip install -r requirements-dev.txt && pytest -q ; uvicorn app.main:app --reload ; open an issue in the project (or mention @ai-issue-to-prod-autopilot-gitlab-ai-hackathon on an issue) and watch the flow session, MR and pipeline.
Repo: https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43172050/showcase Demo video: https://youtu.be/0oc4bTMvG2E
Log in or sign up for Devpost to join the conversation.