Ripple

Inspiration

Writing code is no longer the hard part. The hard part is everything after: the app is live, it runs across many repositories, and it is owned by many teams. When one requirement or one line of code changes, nobody can see what it touches, which tests to rerun, or prove what is actually tested. So teams either retest everything or they guess, and that is how bugs reach production. I see this every day on enterprise QA work, and I wanted QA to stop working blind.

What it does

Ripple is an AI QA teammate that lives inside GitLab.

• Knowledge graph: indexes business documents (FRDs, glossary) and the code and tests of every repository, then links them: requirement → function → test, including calls across repos.
• requirement-impact agent (read-only): mention it on an FRD issue. It reads the requirement text and even its flow diagram, marks each change as CHANGED or NEW, maps it to the exact requirements, functions and tests across repos, scores the risk, and posts a test strategy with an impact diagram.
• change-guard agent (supervised): runs on every merge request. CI traces the diff through the graph and runs only the impacted tests plus SAST and secret detection. The agent writes the missing tests and commits them to the branch, opens test-gap issues in other teams' repos, and for high-risk changes it stops and asks a human to approve. It never merges or deploys on its own.
• After approval: dependent services are rebuilt and deployed to Google Cloud Run, release notes are written in business language (what changed, which tests cover it, who signed it off), and the graph is rebuilt.

In the demo, one line changed in a shared library was traced to 5 business features in 3 repos. Only 27 of 64 tests ran, the agent wrote the missing tests, and one human decision stood between the change and production.

How we built it

• GitLab Duo Agent Platform: two custom flows (requirement-impact, change-guard) with event triggers (mention, MR created, MR approved), a dedicated service account, and full session logs.
• GitLab CI/CD: impact analysis, selective tests, SAST, secret detection, a risk gate, container build, staging and production deploys, release notes and graph rebuild.
• Knowledge graph: a Python AST code indexer and a docs indexer produce graph.json, an interactive graph.html and a report. Every edge is marked EXTRACTED or INFERRED with a confidence score.
• Google Cloud: Artifact Registry and Cloud Run (asia-south1) for both services, staging and production, plus the hosted graph viewer.
• Demo system: a loan origination platform split across 3 repos (lending-core shared library, origination-service, collections-service) plus a QA hub (showcase).

Challenges we ran into

• A merge request author cannot approve their own MR, so human approval is given through an explicit approval comment, and the agent records who approved.
• Flow versions are pinned per project, so every consuming project had to be updated after each flow change.
• With a fixed monthly credit budget, the heavy tracing runs as deterministic code in CI, and the agents spend tokens only on judgment: writing tests, test strategy and explanations.
• Business documents never mention code, so linking "co-applicant income" to the right function needed a glossary plus confidence-scored inferred edges.

Accomplishments that we're proud of

• All 9 DevSecOps stages covered in one supervised loop: Plan, Create, Verify, Package, Secure, Release, Configure, Monitor, Govern.
• A plain business FRD with no code references is mapped to exact functions and tests across repos.
• The agent fixes test gaps itself, but a human always makes the final call.

What we learned

Agents are most trustworthy when they are given a map. The knowledge graph turns "guess what to test" into a traceable answer, and keeping a human at the risk gate is what makes it usable in regulated industries.

What's next for Ripple

• Index more document types (HLD, LLD, user stories) and more languages.
• Use production monitoring signals to raise the risk score of busy code paths.
• Publish the flows in the AI Catalog so any team can plug Ripple into their own repos.

Built With

• artifact-registry
• docker
• gitlab
• gitlab-ci
• gitlab-duo
• gitlab-duo-agent-platform
• google-cloud
• google-cloud-run
• knowledge-graph
• mermaid
• pytest
• python
• sast