Orbit Hunter - Semantic Bug Hunter

Built for the GitLab Transcend Hackathon 2026 (Showcase Track).

Inspiration

Every developer knows the drill when a vague bug report comes in - and then the hunt starts: clone the repo, grep through hundreds of files, read git blame, finally figure out who to tag. GitLab Orbit's knowledge graph already has those answers baked in, so I wanted to see if I could skip the clone-and-grep loop entirely and just query the graph instead.

What It Does

Orbit Hunter triages bugs two ways: a CI pipeline stage that statically scans code for known bug patterns and blocks merges on critical findings, and a Duo Chat agent (@bug-hunter) that takes an issue description, semantically searches Orbit's knowledge graph for the relevant files, traces recent MRs and authors, and posts a structured triage report with labels and an assignee - without ever cloning the repo.

How We Built It

Semantic Bug Hunter is a dual-mode GitLab agent. Local mode scans changed JavaScript files for 10 bug patterns in CI pipelines. Orbit mode performs semantic code search, traces related MRs/authors, identifies churn hotspots, auto-triages issues, and updates GitLab. A shared interface and demo fallback enable end-to-end execution.share the same data schema, so the demo works end-to-end even when Orbit isn't reachable.

Challenges We Ran Into

Orbit availability — the Knowledge Graph API needs GitLab 18.10+ with a feature flag I couldn't guarantee on the target instance, so I built a full local fallback that mimics Orbit's output when it's unreachable.
False positives — the analyzer started at roughly 80% false positives. Negation patterns (checking back 10 lines for an if guard), file-scoped filters, and severity tuning brought that down to ~15%.
Git state management — demoing a buggy main vs. clean fix-bugs branch meant fighting untracked files, stash not cooperating, and cherry-pick conflicts; git checkout main -- <path> ended up being the cleanest fix.
Regex limits — string-concatenated SQL got mangled by PowerShell's quote handling, so the SQL-injection pattern had to be broadened to catch generic concatenation rather than exact quote sequences.

Accomplishments That We're Proud Of

Built graceful fallback when Orbit is unavailable, reducing demo risk. Cut false positives from ~80% to ~15% using contextual negation analysis. Enabled live CI enforcement that blocks merges on critical issues and automatically passes once fixes are applied.

What We Learned

Learned the GitLab Duo Agent ecosystem end-to-end: agent configuration, permissions, AI Catalog packaging, workflow orchestration, and CI integration. Most importantly, we discovered that building a detector is easy; making developers trust its results through accuracy and signal quality is harder.

What's Next for Orbit Hunter

Integrate with a live Orbit deployment, expand support beyond JavaScript to Python, Ruby, and Go, and evolve churn analysis into proactive risk detection that flags unstable files before bugs are reported, shifting from reactive triage to preventive engineering.