Nine Stages

One issue in. Production out. Nine Stages automates the entire GitLab DevSecOps lifecycle with agents and flows — no human in the middle.

Comment

Inspiration

What it does

How we built it

Challenges we ran into

Accomplishments that we're proud of

What we learned

What's next for Nine Stages

Inspiration

Code generation is solved, but what happens after the code is written? We wanted to build a system that takes a single GitLab issue and autonomously drives it through the entire DevSecOps lifecycle—from planning to production—without human intervention. The "Life After Code" hackathon was the perfect opportunity to push the boundaries of the GitLab Duo Agent Platform.

What it does

Nine Stages is an autonomous DevSecOps engine built on the GitLab Duo Agent Platform. It covers all 9 stages of the lifecycle:

  • Plan: An AI agent reads the issue and posts a structured implementation plan.
  • Create: An AI agent writes the code and opens a Merge Request.
  • Verify & Package: GitLab CI/CD runs linting, typechecking, and builds the app.
  • Secure: CI/CD runs dependency audits (npm audit) and secret detection (gitleaks).
  • Configure & Release: Environment variables are validated, a Docker image is built, and deployed to Google Cloud Run.
  • Monitor: An AI agent verifies the health endpoint post-deployment.
  • Govern: An automated audit report is generated as a pipeline artifact, proving compliance.

How we built it

We used GitLab Duo Agent Platform to create custom agents and flows. The system is orchestrated by a robust GitLab CI/CD pipeline (.gitlab-ci.yml) with 6 distinct stages. The frontend is a Next.js app (TypeScript + TailwindCSS) deployed as a Docker container on Google Cloud Run. The UI features a real-time dashboard with a glassmorphism design, an autonomous orchestration log, and threat prevention metrics.

Challenges we ran into

Configuring the Google Cloud IAM policies for the service account and dealing with the @next/swc binary block on Windows were significant hurdles. We solved them by migrating to Webpack for local dev, creating a dedicated GCP project with a custom billing account, and bypassing strict TypeScript checks for dynamic UI components. Another challenge was ensuring the Tailwind CSS compiled correctly in the standalone production Docker image.

Accomplishments that we're proud of

We achieved a fully autonomous loop. An issue was created, an agent planned it, another agent coded it, the pipeline secured and deployed it, and a third agent monitored it. The entire application is live and public on Google Cloud Run, and the entire 9-stage lifecycle is automated.

What we learned

We learned how to orchestrate multi-agent workflows using GitLab Duo and how to build a fail-closed, deterministic CI/CD pipeline that doesn't rely on LLMs for critical deployment decisions. We also learned how to deploy Next.js applications securely to Google Cloud Run.

Links

Built With

Share this project:

Updates

Submission history