ReleaseGuard AI

• 

  Actual GitLab Duo recommendation on MR !2: 74 passing tests, scoped evidence and human review required.

• 

  READY: recorded public pipeline 2939886791, 74 passing tests, exact commit and sources visible.

• 

  Synthetic HOLD example: stale tests, an incomplete scan and missing policy require fresh evidence.

• 

  ReleaseGuard AI: a clear release review workspace with traceable evidence and human control.

• 

  Synthetic BLOCK example: failed tests and a high-severity finding surface clear blockers and next actions.

Inspiration

A green pipeline is reassuring, but a release owner still needs to ask: did these results test the commit we are about to ship? Old artifacts, skipped scans and scattered checklists can make that answer surprisingly difficult. We built ReleaseGuard AI for small teams that want an understandable release recommendation grounded in the exact candidate's evidence.

What it does

ReleaseGuard brings tests, security findings and a license policy into one review, bound to a project, full commit and pipeline. It returns READY, HOLD or BLOCK, with reasons, sources and practical next actions. Missing or stale evidence stays on HOLD; verified failures or serious findings block the candidate. READY always leaves the final release decision with a person.

The dashboard retrieves real evidence from a public GitLab pipeline without a token. Reviewers can inspect candidate identity, explore labeled demonstration scenarios, import their own evidence and export the review. Public evidence retrieval and the local application work without an AI key.

How we built it

We started fresh during the hackathon. Python 3.12 powers the deterministic evaluator and local server; HTML, CSS and JavaScript provide the review interface. GitLab CI runs real tests, Bandit source scanning, a pip-audit check of the declared application dependency environment and the MIT policy check. The gate publishes evidence and a report that the dashboard independently evaluates.

A custom GitLab Duo Agent Platform agent performs the supervised review inside a merge request. It resolves the current head, finds its pipeline, examines jobs and complete evidence artifacts, and checks the candidate again before recommending an outcome. Its only write capability is a merge-request note; the demonstrated note actions were explicitly approved.

The latest verified source pipeline passed 74 tests, with zero scanner findings in its declared scope and a passing MIT check. Duo completed three live READY reviews across the initial 70-test candidate and two subsequent 74-test candidates. An unchanged-candidate repeat found the existing recommendation and posted no duplicate.

Challenges and what we learned

Pipeline success alone was not enough. We had to preserve failed gate evidence, reject mismatched provenance, distinguish missing checks from confirmed failures, and adapt to the tools actually available in GitLab. Codex supported implementation, independent boundary review, regression tests and submission materials; the application keeps its decision logic inspectable and deterministic.

This prototype checks Python application code and its explicitly empty third-party dependency inventory; it is not a comprehensive runtime or operating-system security audit. It never merges or deploys. Imported evidence is self-reported, and live results describe a checked snapshot rather than a guarantee about future changes.

What's next

We want to add verified locked dependencies, more live HOLD and BLOCK demonstrations, and richer policy checks while preserving clear evidence, conservative decisions and human release ownership.

Built With

• css
• gitlab
• html
• javascript
• python