RCode.ai

Inspiration

What it does

How we built it## Inspiration

Writing code is no longer the slow part. Deciding whether a change is safe to ship still is. To answer that, a developer has to open the pipeline, the security scans, the review threads and the AI agents' comments, and add it all up in their head. We built RCode.ai, an AI release engineer for GitLab, to do that adding up and give one answer: GO, REVIEW or BLOCK, with a risk score and every reason behind it.

What it does

• Reads the evidence for every merge request: pipeline and job results, security scans, changed files, approvals, review discussions and the verdicts of the GitLab Duo agents.
• Reviews the code itself: it reads the lines a merge request adds and flags leaked secrets, injection, unsafe calls, disabled TLS, skipped tests and leftovers, with file and line.
• Decides: GO, REVIEW or BLOCK, with a risk score from 0 to 100. Every point is tied to a reason a person can read and argue with. A critical finding or a failed scan always blocks.
• Shows the agents' work: seven check cards and the agent pipeline (Plan, Create, Verify, Govern, Release), built from the agents' real comments.
• Watches what shipped: deployment history and live health checks for each project, with alerts.

How we used GitLab to automate the post-code lifecycle

Agents run the workflow and a person approves the outcome (Supervised).

• Plan: a custom Duo flow, RCode Triage, turns each new issue into acceptance criteria, a test plan and labels, grounded in the code.
• Create: the Duo Developer agent builds the merge request from the assigned issue.
• Verify: CI runs lint and the test suite on SQLite and PostgreSQL. Duo Code Review reviews the change, and Fix CI/CD Pipeline repairs failed pipelines.
• Secure: SAST, secret detection and dependency scanning run on every merge request, and RCode's own code review blocks leaked secrets.
• Package: the pipeline builds the container image.
• Govern: a custom Duo flow, RCode Gatekeeper, judges release readiness and stops at a human approval gate. RCode only trusts verdicts from verified project members, tied to the exact pipeline they judged.
• Release: after the merge, the main pipeline deploys to staging and runs a smoke test. A custom Duo flow, RCode Release Manager, then writes the release dossier and opens follow-up issues.
• Monitor: RCode tracks each deployment and checks the health of the running service.

All flows, triggers and the setup script are in the repository (flows/, scripts/duo_setup.py, .gitlab-ci.yml).

Challenges we ran into

Accomplishments that we're proud of

What we learned

What's next for RCode.ai

Built With

• agents
• docker
• duo
• fastapi
• gitlab
• gitlab-ci/cd
• javascript
• postgresql
• pytest
• python
• sqlalchemy
• sqlite
• traefik