Inspiration
AI made writing code fast, but the code still sits in a merge request waiting for review, a red pipeline still waits for someone to read 400 lines of logs, release notes still get written by hand, and nobody posts on the issue to say "this is live". Writing the code was never the slow part. Everything after it is.
What it does
Relay is a crew of four GitLab Duo Agent Platform flows wired into a GitLab CI/CD pipeline that covers all nine DevSecOps stages:
- Plan: Relay Triage (mention trigger) classifies, sizes and de-duplicates an issue, then rewrites it with acceptance criteria.
- Create: Relay Builder (assign trigger) branches, implements the change with tests, commits using Conventional Commits and opens an MR with
Closes #N. - Verify: lint and unit tests with coverage and JUnit reports. When a pipeline fails, a CI job @-mentions Relay Medic, which reads the failing logs and pushes a fix. It is capped at 2 attempts, then escalates to a human.
- Secure: SAST, secret detection and container scanning. Relay Reviewer (assign-reviewer trigger) cross-checks the vulnerability report against the diff and posts a single verdict: ✅ / ⚠️ / 🛑, with evidence.
- Package: the version is derived from commits, the site is built and stamped with version/commit, and a container image is pushed to the GitLab registry.
- Staging: the built image boots as an ephemeral CI service and is smoke-tested before anyone can approve production.
- Release: a semver tag and release notes are generated from the commit history.
- Configure: production environments, container runtime and Cloud Run deploy configuration live in the repo; agent behaviour is configured through
AGENTS.md. - Monitor: after deploy, a health probe confirms the exact version and commit are live, and opens an incident issue if they aren't.
- Govern: a compliance report (license, scan results, release evidence) is published as an artifact and posted back on every issue the release closed.
The one human action in the loop is the manual, protected production deploy. That's the Supervised autonomy level: agents clear every gate, and the human approves the outcome.
How we built it
- GitLab Duo Agent Platform custom flows (YAML, versioned in
.gitlab/duo/flows/), each with a scoped toolset and hard rules: never weaken tests, never touch CI config, never push to main. - Mention, assign and assign-reviewer triggers connect GitLab events to flows.
- A CI → agent bridge: a
.post-stage job uses the API to @-mention the Medic flow's service account on the MR, so a red pipeline starts the fix loop by itself. - GitLab CI/CD with security templates, the container registry, dotenv artifacts passing the version between jobs, the
release:keyword, environments, and Pages. - Zero-dependency Node.js tooling (semver/changelog engine, health evaluator), tested with
node:testat 98% coverage.
Challenges
- Keeping agents useful without letting them get around the guardrails. Each flow has an explicit list of things it must not do, and the pipeline (not the agent) owns the production gate.
- Making version, commit and health checks line up across jobs so the monitor can prove that this build is the one serving traffic.
What we learned
Once code is written, the slow part is the handoffs between stages. Most of the value came from connecting those handoffs: pipeline to agent, agent to MR, release back to issue.
What's next
Hands-off mode, where the Reviewer's ✅ verdict sets auto-merge and the production gate becomes a policy check. Plus automatic rollback when the monitor opens an incident.
Log in or sign up for Devpost to join the conversation.