MR Guardian

Inspiration

The Transcend hackathon asked how much of the software lifecycle after code can be handed to agents while a human still approves outcomes. MR Guardian is this repository's answer.

What it does

MR Guardian is a supervised post-code automation workspace. A GitLab Duo Agent Platform custom agent, configured in this project, reviews every merge request diff for security issues and missing test coverage, posts a summary on the merge request, and opens an issue for human follow-up. It stops before any state-changing action. Around it runs a CI pipeline defined as code covering verify (pytest with JUnit report), secure (GitLab SAST and secret detection), package (wheel build), release (pages deploy), and monitor (job-state log). Release Ranger, a small Python CLI that drafts release notes from a commit range with unit-tested parser logic, gives the pipeline real work to verify.

How I built it

The agent is a Duo Agent Platform custom agent (project > AI > Agents) with a documented system prompt and the Create issue tool; its exact configuration is quoted in docs/agents.md. The pipeline is one .gitlab-ci.yml using GitLab's standard security templates. Release Ranger is pure Python with a pytest suite.

Challenges I ran into

Keeping the agent's scope deliberately narrow: it must never merge, push, or edit code, so every prompt line enforces the stop-and-report boundary that defines the Supervised level.

Accomplishments that I'm proud of

The pipeline went green on its first run with all six jobs passing, and the agent configuration is fully quotable in the repo rather than hidden in a UI.

What I learned

How much of a lifecycle a single well-bounded agent plus plain CI can honestly cover: nine stages touched, with the human gate kept where it belongs.

What's next for MR Guardian

Extending the agent to triage its own findings severity-first, and a flow that schedules remediation MRs for human approval.

Code: https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/41992154/showcase

Built With

• agents
• ci-cd
• devsecops
• gitlab
• python