PatchPilot: Security Triage with GitLab Duo

Inspiration

Security findings can be difficult to act on when they're buried in pipeline logs or disconnected from code review. Developers need more than a scanner: they need actionable findings, clear CI feedback, and help understanding why a change is risky.

What it does

PatchPilot is a Python security-triage tool that combines AST-based scanning, configurable severity thresholds, GitLab CI enforcement, and GitLab Duo Agent Platform workflows.

It detects selected risky patterns, including eval(), exec(), subprocess calls using shell=True, and hard-coded credential-like strings. Findings include a rule identifier, severity, source location, and remediation recommendation.

Its configurable severity gate lets teams decide when findings should fail a pipeline. GitLab Duo workflows assist with code review and pipeline-failure investigation, while developers retain control over security-sensitive decisions.

How we built it

PatchPilot uses Python AST-based checks, a CLI, automated tests, and GitLab CI/CD. Its pipeline includes verification, security checks, triage, and reporting.

We integrated GitLab Duo Agent Platform workflows to review a controlled security finding and investigate a failed pipeline. The demonstration uses an isolated draft merge request containing an intentionally unsafe eval() call.

What makes it useful

PatchPilot connects several steps of the post-code development lifecycle:

• Verify: Automated tests and lint checks.
• Secure: Python security checks and dependency auditing.
• Review: Actionable findings and severity-based pipeline enforcement.
• Investigate: GitLab Duo-assisted code review and pipeline-failure analysis.
• Govern: Human review of security-sensitive decisions.

Challenges we faced

A key challenge was making security findings actionable without encouraging unsafe automated changes. We designed the demonstration so that the investigation workflow can explain a security-sensitive failure and comment on it instead of blindly modifying the vulnerable code.

What we learned

A useful developer agent needs more than the ability to generate code. It needs context, integration with the existing development workflow, and appropriate boundaries around sensitive actions.

What's next

Future improvements could include broader rule coverage, richer reports, additional test scenarios, and a more complete review-and-remediation workflow with explicit approval gates.

Built with

Python, GitLab CI/CD, GitLab Duo Agent Platform, AST-based analysis, automated testing, and security-scanning tools.

Built With

• ast-based-analysis
• automated-testing
• gitlab-ci/cd
• gitlab-duo-agent-platform
• python
• security-scanning-tools