ShipLoop

ShipLoop is a task-manager app (Flask) with projects, tasks with todo/doing/done workflow, priorities, due dates, tags, subtasks, filters/sort/pagination, /stats, /activity, /export, and a web UI — backed by an 11-job GitLab CI/CD pipeline (plan, create, verify, package, sbom, sast, secure, release, configure, monitor, govern).

The demo, shown in the video with real session screens:

1. One bad push breaks a test and pins requests==2.19.1 (CVE-2018-18074). Pipeline #2989825795 fails at verify.
2. GitLab Duo's Fix CI/CD Pipeline flow (session 10055391) diagnoses the failure as a test failure, explains it, and posts the fix as an inline suggestion on the merge request; revert the assertion from 202 back to 201. Duo explicitly declines the security pin — a security decision for a human.
3. The same push surfaces 19 real dependency findings in the merge request's Security tab (dependency scanning).
4. The fixed pipeline passes (#2990107828), and the govern job confirms "LICENSE CHECK PASSED: MIT license present at repo root."
5. SAST arc: a planted eval-injection flaw (/calc with eval()) is caught by the semgrep SAST job (High, app/risky_demo.py:16); Duo's Security Analyst "Resolve SAST Vulnerability" flow (session 10102821) proposes a safe ast-based evaluator; the fix (MR!3) is merged to main on Oct 27, 10:55 IST, and main's pipeline passes.
6. Latest main pipeline #2993148107: all 11 jobs green, 29 tests passing. Live demo deployed and verified: /health ok, /calc?expr=1/0 returns a clean 400 error (no 500).

How it uses GitLab Duo Agent Platform

• Fix CI/CD Pipeline flow 1.0.4, run live against a real failed pipeline (session 10055391, Finished). Supervised autonomy: Duo diagnoses and suggests; a human applies.
• Resolve SAST Vulnerability flow via Security Analyst (session 10102821), supervised: Duo proposes the safe-evaluator fix; a human merges.
• Duo Code Review on MR!2 (session 10102107, 4 inline comments, changes requested).
• Duo agent and flow specs live in the repo (.gitlab/duo/agents-and-flows.md): Review, Secure, and Release specs.

Honest limit (stated in the submission, not hidden)

Supervised, not hands-off: Duo diagnoses, suggests, and proposes; humans apply and merge. MR!1 and MR!2 remain open and unmerged by design (MR!2 is merge-blocked by Duo's own requested changes); MR!3 (the SAST fix) is merged. One Medium SAST finding remains open (Semgrep flask app-run host in app/main.py:351) — the entry does not claim a clean security slate.

Built With

• ci
• duo
• flask
• gitlab
• python
• vercel