ReturnReady Guardian — AI-Powered DevSecOps

GitLab Duo agents transform an existing returns-management app with AI-powered development, code review, automated testing, and security-verified delivery.

Comment

ReturnReady Guardian — From Working Code to AI-Powered DevSecOps

Inspiration

Writing an application is only part of delivering reliable software. The difficult work often begins after the code is written: reviewing changes, validating functionality, catching security issues, managing merge requests, and preparing safe releases.

I wanted to explore a practical question:

What if AI agents could take responsibility for the engineering work that happens after an application has already been built?

I started with ReturnReady, an existing MIT-licensed household returns management application, and transformed its software delivery process using GitLab Duo Agent Platform.

The goal was not to build another AI chatbot. It was to demonstrate how genuine AI agents can improve the way an existing application is developed, verified, reviewed, and delivered.

What ReturnReady Does

ReturnReady helps households manage product returns without losing track of deadlines or responsibilities.

Its existing capabilities include:

  • Tracking return deadlines and item statuses.
  • Managing packing checklists and missing accessories.
  • Assigning return responsibilities to household members.
  • Providing contextual, rule-based conversational assistance.
  • Saving progress through Supabase PostgreSQL.
  • Protecting individual sessions using Row Level Security.

ReturnReady Guardian retains this functional application while introducing AI-assisted DevSecOps workflows around its delivery lifecycle.

What We Built for GitLab Transcend

For Path B — Bring Your Own, I imported the existing ReturnReady source code into a public GitLab repository, retained the MIT license, and introduced a new GitLab Duo-powered engineering workflow.

1. GitLab Duo Developer Flow

I assigned GitLab Duo the objective of transforming a security-only CI pipeline into a complete application validation pipeline.

The Developer Flow inspected the existing repository, analyzed npm scripts, investigated GitLab security templates, and implemented an improved .gitlab-ci.yml.

It created a feature branch and opened Merge Request !2 containing the proposed changes.

2. Automated Application Validation

The new pipeline performs six real jobs:

  • TypeScript typechecking.
  • ESLint code validation.
  • Vitest unit testing with JUnit reporting.
  • Vite production build.
  • Semgrep Static Application Security Testing.
  • GitLab Secret Detection.

All six jobs passed, including 24 automated unit tests.

The implementation preserves GitLab's native security analyzer containers while isolating Node.js installation and caching to application jobs.

3. GitLab Duo Code Review Flow

After the Developer Flow created the merge request, I initiated GitLab Duo's Code Review Flow.

The agent examined the proposed CI configuration, validated the separation of application jobs and security scanners, reviewed pipeline triggering rules, and assessed the changes.

The review completed without identifying genuine issues, published its findings on the merge request, and recorded an approval.

4. Human-Governed Integration

I reviewed the completed agent work and successful pipeline before manually merging the change into GitLab's main branch.

The resulting main-branch pipeline also passed.

This is a supervised workflow: the AI agents performed substantive engineering and review tasks, while the human retained control over the final integration decision.

5. Public Deployment

The updated ReturnReady Guardian application was deployed separately to Vercel, with Supabase providing the database and application persistence.

The live application demonstrates that the original product remains functional after its delivery workflow transformation.

How We Built It

The original application uses React 19, TypeScript, Vite, Supabase PostgreSQL, and Vercel. Its automated testing infrastructure uses Vitest and Playwright.

For the hackathon, the key technologies were GitLab Duo Agent Platform, GitLab CI/CD, merge requests, SAST, and Secret Detection.

Google Antigravity supported local development and independent validation. GitLab Duo performed the actual agentic development and code review demonstrated in the submission.

The implementation maintains an auditable sequence of agent sessions, code changes, pipeline results, review findings, and the final human merge decision.

Challenges We Faced

Preserving existing security scanning: Introducing application build jobs could have broken GitLab's specialized security analyzer containers. We addressed this through a scoped Node.js job template rather than global installation commands.

Merge-request pipeline compatibility: GitLab's security templates required careful handling of merge-request rules. The Developer Flow configured the relevant settings so SAST and Secret Detection continued executing.

Agent execution and validation: The Developer Flow encountered local npm registry restrictions. Instead of claiming unverified results, we relied on actual GitLab runner execution and independently checked the application locally.

Preserving the existing application: We kept the functional ReturnReady architecture and created a separate Vercel deployment rather than replacing the original live application.

Accomplishments We're Proud Of

  • Two genuine GitLab Duo Agent Platform flows completed.
  • An AI-generated merge request was created and successfully reviewed.
  • Six GitLab CI jobs passed.
  • All 24 unit tests passed.
  • Native SAST and Secret Detection remained operational.
  • GitLab Duo published its code review and approved the merge request.
  • Human approval remained the final integration gate.
  • A working ReturnReady Guardian application was publicly deployed.

These results are backed by actual GitLab sessions, merge requests, pipelines, and the deployed application.

What We Learned

The most valuable use of an AI engineering agent is not simply producing more code. It is performing meaningful engineering tasks while preserving verification, traceability, and human accountability.

GitLab Duo demonstrated how AI-assisted development and review can work alongside deterministic CI/CD checks in a real existing codebase.

What's Next

Future improvements could include automated regression investigation, pipeline failure remediation, broader dependency scanning, staging deployment gates, release evidence reports, and production monitoring.

These are future directions rather than features claimed as completed in this submission.

Project and Evidence Links

Live application: https://returnready-guardian.vercel.app/

GitLab project: https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43775292/returnready-guardian

Original MIT-licensed project: https://github.com/ensuredesign/returnready

Developer Flow session: https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43775292/returnready-guardian/-/automate/agent-sessions/10118219

Code Review Flow session: https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43775292/returnready-guardian/-/automate/agent-sessions/10120008

AI-generated Merge Request !2: https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43775292/returnready-guardian/-/merge_requests/2

Passing main pipeline: https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43775292/returnready-guardian/-/pipelines/2993974901

ReturnReady Guardian demonstrates Life After Code: real AI agents doing meaningful development and review work, real pipelines validating the results, and a human retaining control of the final release decision.

Built With

Share this project:

Updates

Submission history