Inspiration
What it does
How we built it
Challenges we ran into
Accomplishments that we're proud of
What we learned
What's next for Pipeline Medic
Inspiration
As a DevOps engineer, the most repetitive part of my day is opening a red pipeline, scrolling a log, finding a one-line cause and walking the fix through review, scans and deploys. "Life after code" should mean agents do that loop, and humans keep the decision to ship.
What it does
When a pipeline fails, an issue labeled pipeline-failure is assigned to (or mentions) the Pipeline Medic
flow. Three agents work in sequence:
- Diagnoser reads failing jobs, logs and security findings and names one root cause with file:line evidence. It handles unit-test failures, leaked secrets, vulnerable dependencies (CVE with a fixed version), failed staging deploys/smoke tests, broken Dockerfile builds, policy violations and CI config.
- Fixer applies a minimal patch from a per-category playbook (e.g. move a leaked token to an env var and tell the human to rotate it; bump a CVE dependency to the fixed version; fix the container port), runs tests and the policy gate, and opens an MR with a Low/Medium/High risk rating, a reason and a merge-safety note.
- Verifier watches the fix MR's pipeline. If it fails, it reads the new error and pushes a second
attempt; after 2 failed attempts it stops, labels the MR and issue
medic-needs-humanand explains what it tried. Every incident is recorded indocs/incidents.md(cause, fix, MR, time to fix, attempts, status). The first live run fixed a broken unit-test pipeline in about 4 minutes, with no human edits. The MR pipeline runs unit tests, SAST, secret detection, dependency and container scanning, a policy gate, builds and pushes an image, deploys to staging and smoke-tests it. Production is a manual job on a protected environment: a human approves.
How we built it
GitLab Duo Agent Platform custom flow (Flow Registry v1, three AgentComponents with GitLab tools), AGENTS.md, GitLab CI/CD with GitLab security templates, GitLab container registry, environments, releases; a small FastAPI service with pytest.
Lifecycle stages
Plan, Create, Verify, Package, Secure, Release, Configure, Monitor, Govern - see README table.
Challenges
Keeping the agent's change minimal and safe: the prompt and AGENTS.md forbid deleting tests, security
templates or the non-root user, and the policy gate enforces it in CI. GitLab's security templates only
report findings, so we added a security-gate job (secret detection report + pip-audit) that blocks the
pipeline, giving the agent a real security failure to fix. Bounding retries (max 2) keeps the agent from
looping on a problem it cannot solve.
What's next
Pipeline events trigger (no issue needed), flaky-test detection, auto-rotation of leaked tokens, real Cloud Run staging.
Built with
gitlab-duo, gitlab-ci, python, fastapi, docker, pytest
Log in or sign up for Devpost to join the conversation.