LifecycleAgent

Inspiration

In the world of AI coding assistance, every real team hits the same wall: writing code is fast, but everything after the commit is slow. Reviews sit for hours, deploys wait on a human "looks good to me", and nobody notices a regression until production is already burning. We wanted to see how much of that post-code lifecycle an AI agent could genuinely own, not as a chatbot bolted onto CI, but as an automated gatekeeper with real authority.

What it does

LifecycleAgent watches every merge request and runs a five-stage post-code pipeline: AI code review → build → staging deploy → monitoring → lifecycle report. The review stage scores the diff (0-100), flags secrets, injection patterns, and dangerous changes, and writes its findings as MR comments. Deploys are hard-gated on the review score: a failing review literally refuses to ship. Once deployed, the monitor probes the staging environment and the final lifecycle report rolls everything up for the team.

How we built it

Pure Python standard library, no heavy frameworks, the CI pipeline had to be self-contained and fast. The review engine uses pattern + heuristic analysis on diffs; the pipeline is orchestrated with GitLab CI/CD across five stages (review, build, deploy_staging, monitor, report), with the deploy stage reading the review verdict as a gate. The whole flow is exercised by a 10-test unit suite, and the live pipeline runs green on every push. We designed the architecture against the GitLab Duo Agent Platform model so the flow can adopt Duo agents natively.

Challenges we ran into

• Making the review gate a real gate, not theater: the deploy stage had to consume the review verdict as a hard dependency and fail closed.
• Designing the monitor to never crash the pipeline on an unreachable environment, a monitor that kills builds is worse than none.
• Keeping the project dependency-free while still producing human-readable artifacts (review comments, deploy manifests, lifecycle reports).

Accomplishments that we're proud of

• A review gate with real teeth: a HIGH-severity finding on a merge request blocks the deploy stage outright, proven in the pipeline, not just promised in a README.
• 10/10 on our own test suite covering the exact failure modes that matter: blocked reviews stay blocked, clean diffs ship, monitors never crash the pipeline.
• A fully green five-stage pipeline running live on GitLab's infrastructure
• Zero-dependency architecture: the entire agent runs on the Python standard library, so the pipeline is portable, fast, and honest about what it needs. ## What we learned How to structure an agent so its judgment is auditable, every decision (block, pass, deploy) leaves an artifact a human can inspect. And how GitLab's CI model is a genuinely good host for agentic workflows: stages, gates and artifacts map one-to-one onto an agent's plan-act-report loop. ## What's next for LifecycleAgent Deeper GitLab Duo Agent Platform integration, pluggable review policies per team, and production rollouts (the deploy stage currently writes a staging manifest; the cloud rollout is the next milestone). https://gitlab.com/domina9193/lifecycle-agent/-/pipelines/2990308023

Built With

• ai-code-review
• ci/cd
• devops
• gitlab
• gitlab-ci/cd
• gitlab-duo-agent-platform
• python