letslab

A website health check for small businesses, run by a GitLab Duo night shift: one issue in, and agents plan, code, review, fix, release and monitor it to production. No human in between.

Comment

Inspiration

Force Studio is a one-person studio whose overnight agents check small-business websites. Across 148 businesses it kept finding the same problems: broken HTTPS, no mobile viewport, slow pages, missing titles and descriptions, and phone numbers that differ from the tap-to-call link. Owners never see these as errors. They show up as customers who never call.

We wanted to give that check away. But in a studio of one, with no reviewer, release manager or on-call person, who ships it? The night shift does.

What it does

The product. letslab takes a website address and returns a 0–100 score and a grade from eight checks: reachable, HTTPS, mobile viewport, speed, title, meta description, link preview (Open Graph), and contact details. Each check says in plain words what is wrong and how to fix it. The night shift built the link-preview check and the fix tips itself. An MCP server lets AI assistants, including GitLab Duo, run the same checks.

The delivery. A person opens an issue and goes to sleep. GitLab Duo agents plan it, code it, review it and repair it; the pipeline tests, scans, previews, merges, releases, deploys and monitors it. In the morning the issue has a report.

The run in the video

The video is one live run, recorded on 27 October. Issue #3 asked for a plain-language fix tip under every failing check. The night shift planned it and opened MR !7. Duo Code Review found three tips misleading or too technical and blocked the merge. The fixer agent rewrote them, Duo approved, and the MR merged itself. Release v1.0.71 reached production 28 minutes after the issue was opened, with no human step after the issue.

What actually happened on the first night

The first delivery pipeline failed. Cloud Run reserves /healthz and answers 404 itself, so our staging smoke test could never reach the app. The owner opened issue #1 and left it. The night shift labelled it a medium-risk bug, posted a plan, changed five files (app, UI, tests and the two CI health scripts) and opened MR !2. The pipeline passed 180 tests at 99.4% coverage and all four scanners. Duo Code Review approved. The MR merged itself on the second try. The delivery pipeline released v1.0.17 to production, and the issue got a delivery note and a "Night shift report". The first bug the night shift fixed was one its own pipeline had found.

Self-healing security scenario

MR !4 adds a form endpoint that needs python-multipart, pinned at 0.0.29, which has a High CVE (CVE-2026-53539). The GitLab Duo reviewer approved the diff, but dependency scanning reported the CVE and security-gate failed the pipeline. CI started the pipeline fixer flow, which read the finding, raised the pin to 0.0.32, ran the tests and pushed. The next pipeline was green, a maintainer-identity verification pipeline re-ran the checks (GitLab will not complete an auto-merge from an agent-started pipeline), and release v1.0.34 went to production. One step of that run was started by hand; ci/auto-merge.sh does it on its own now.

A night with zero human steps

Issue #2 asked for a check that tells owners whether a shared link shows a title and image. Nobody touched anything after opening it. The night shift labelled and planned it in a minute and opened MR !5 three minutes in. The pipeline was green, but Duo Code Review requested changes: duplicate og: tags and whitespace-only content could give the wrong answer. The review gate held the merge and passed the comments to the fixer flow, which pushed a fix with tests. The next pipelines were green, the MR merged 23 minutes after the issue was opened, and release v1.0.51 (191 tests) reached production. The issue had its delivery note and "Night shift report" 30 minutes after it was opened.

How we built it

  • App: Python 3.12, FastAPI, httpx, Beautiful Soup and a vanilla JS page under a strict CSP. An SSRF guard allows public IPs only and re-checks every redirect.
  • Agents: three custom AI Catalog flows (night shift, pipeline fixer, release reporter), a read-only Duo Chat agent for morning audits, and GitLab's foundational Code Review and security flows, all on Claude Haiku 4.5. AGENTS.md holds the rules.
  • Pipeline: .gitlab-ci.yml, small Bash scripts and GitLab's scanner templates.
  • Google Cloud: Cloud Run (preview, staging, production) and Artifact Registry, with keyless GitLab OIDC → Workload Identity Federation.

How GitLab automates the post-code lifecycle

  • Plan: an issue triggers the night shift; the planner labels, plans, or refuses unsafe requests.
  • Create: the developer agent opens a linked MR; CI starts the fixer through the Flows API on failures or review comments.
  • Verify: lint, tests with coverage, a smoke test of the MR's own preview, Duo Code Review as a merge gate.
  • Package: one image build; the digest flows to production.
  • Secure: SAST, secret detection, dependency and container scanning on every MR.
  • Release: auto-merge on the tested commit, then release v1.0.N with generated notes.
  • Configure: per-environment settings and feature flag; previews removed when the MR closes.
  • Monitor: staging smoke test, production health samples with a latency budget; results go back to the issue.
  • Govern: security gate on Critical/High, audit report per release, protected production, a fixer loop limit, stop labels.

Challenges we ran into

  • Pipelines are not people. Triggers react to human actions, and flows cannot see CI secrets. CI starts the fixer and reporter through the Flows API and puts everything they need in the goal text.
  • The flow service is strict. Sessions failed on tool names it does not accept. A flow without a coding environment skips its setup script, so our reporter first failed for lack of curl.
  • A review nobody acts on. When Duo Code Review requested changes, nothing happened. Now auto-merge waits for the review and sends its comments to the fixer.
  • A mention is a trigger. During the recorded run, a CI note @-mentioned an agent account and started an extra session. The agent saw a merge request instead of an issue and stopped. CI notes now name agents without mentioning them.

Accomplishments that we're proud of

  • A real bug went from issue to production with no human in the middle, with evidence for every step in GitLab.
  • An AI reviewer's "request changes" actually stops a merge, and another agent answers it.
  • Issue #2 went from request to production feature in 30 minutes with zero human steps.
  • On camera, issue #3 went through an AI review, an AI fix and a release in 28 minutes.

What we learned

Agents do best on a narrow path: short prompts, explicit "never do" rules, and a pipeline that is the real judge. Hands-off is not unsupervised: the value is in the report, the audit trail and the labels a person can use to step in.

What's next

Automatic rollback, a scheduled production monitor, CODEOWNERS approval for CI paths, and more checks (structured data, opening hours, accessibility basics).

Links

Built With

Share this project:

Updates

Submission history