Inspiration
After code changes, a failing CI pipeline can leave a team with two separate problems: how to diagnose the failure and how to prove that a fix is reviewable and safe. A green test is not sufficient evidence to deploy. We built a small, original, human-gated release assurance workflow for the GitLab Life After Code hackathon.
What it does
Release Assurance Agent combines a synthetic CI incident classifier, a real GitLab Duo Agent Platform workflow, human-approved source fixes, and a deterministic Release Passport.
- Classifies sanitized CI incidents and prepares evidence for a human review.
- Demonstrates a genuine GitLab Duo Fix CI/CD Pipeline Flow, which read a failed Runner job and opened a minimal repair Merge Request in a private organizer rehearsal.
- Separately proves real GitLab Duo tool use on this public Showcase project: official Duo CLI Session 9989028 performed six read-only GitLab API requests against actual public CI evidence.
- Generates a cryptographically auditable Release Passport. A complete evidence record never automatically authorizes deployment.
How we built it
Independent Python 3.12 standard-library code, JSON schemas, synthetic fixtures, simple loopback-only demonstration UIs, a manually gated GitLab CI/CD configuration, and the official GitLab Duo Agent Platform. We used the Assisted autonomy level: human review before merging any proposed repair.
Authentic provider evidence
A private controlled red/green rehearsal used failed Runner Pipeline 2980919301, GitLab Duo Fix CI/CD Pipeline Flow v1.0.4 Session 9954268, a human-reviewed Duo-created MR !2, and passing Pipeline 2980934879. This private project's URLs are not anonymously accessible, so we do not present them as public judging links.
A separate genuine public project Duo CLI Session 9989028 inspected Pipeline 2982978002 and its two jobs via six recorded GitLab GET tool calls. It did not modify the repository and did not itself read complete Runner traces; we verified those independently. Public provider evidence and limitations.
The latest public GitLab CI Pipeline 2983001024 passed both real Runner jobs. The unit job ran 138 tests, and Release Passport uploaded its three JSON artifacts. Before the fix: BLOCKED; after the fix: REVIEW_EVIDENCE_COMPLETE_NOT_AUTHORIZED; migration rollback unverified: BLOCKED. All scenarios prohibit deployment.
Challenges and lessons
We distinguished a CI configuration syntax failure from a genuine Runner test failure; verified that an AI-created patch must be approved by a human; and avoided mixing mocked fixture truth with actual GitLab Duo provider activity. We also discovered that some GitLab Agent Session pages require sign-in, even when the host project is public. Our public evidence is explicit about that access limitation.
What's next
Improve public, judge-accessible evidence of the full red → Duo repair → human merge → green sequence, add broader incident evaluations, and preserve fail-closed deployment policy. These are future improvements, not claims about work already completed.
Links
All demo inputs are synthetic. No production deployment or real payment operations were performed.
Built With
- agentic-ai
- devsecops
- gitlab-ci
- gitlab-duo
- python
Log in or sign up for Devpost to join the conversation.