Shipwright

Inspiration

Traditional software delivery often suffers from fragmented handoffs between coding, testing, security, deployment, and auditing. With the GitLab Transcend "Life After Code" Hackathon, our goal for Shipwright was to eliminate these silos by demonstrating a complete, agent-driven workflow that covers all nine post-code DevSecOps stages using GitLab Duo and GitLab CI/CD.

What It Does

Shipwright is an automated Spring Boot microservice designed to track system status and uptime. Through GitLab Duo and CI/CD automation, it demonstrates full lifecycle execution:

• Plan: Captures plain-English user stories, automated acceptance criteria, and task decomposition on Issue #1.
• Create: GitLab Duo autonomous agent inspected the issue, generated UptimeController.java, created MockMvc tests, and opened Merge Request !1.
• Verify: Automated Maven test suite executes five unit and integration tests with zero failures.
• Package: Automated Docker-in-Docker CI jobs package and push multi-architecture containers to the GitLab Container Registry.
• Secure: Integrated GitLab SAST and Secret Detection templates audit every commit for vulnerabilities.
• Release: Automated v1.0.0 milestone creation with immutable GitLab Evidence Collection JSON snapshots.
• Configure: Automatic staging deployments paired with a supervised, manual human approval gate for production.
• Monitor: Post-deployment synthetic health checks verify service readiness and report status.
• Govern: An end-to-end audit scoreboard posted on Issue #1 mapping all nine lifecycle stages directly to live GitLab artifacts.

How We Built It

• Language & Framework: Java 17, Spring Boot 3.3.5, and Apache Maven.
• AI Automation: GitLab Duo Agent Platform for autonomous code synthesis, test authoring, and merge request generation.
• CI/CD Pipeline: Custom .gitlab-ci.yml defining strict stage progression: test -> secure -> package -> deploy -> monitor.
• Packaging & Artifacts: GitLab Container Registry for Docker images and GitLab Releases for evidence collection.

Challenges We Ran Into

• Aligning continuous agent generation with strict CI validation: Ensuring Duo's generated mock MVC tests adhered to the exact API contracts without manual intervention.
• Implementing human-in-the-loop supervised governance: Balancing full agent autonomy with safe enterprise deployment practices using GitLab manual job approvals.

Accomplishments We're Proud Of

• Achieving verifiable evidence across all 9 DevSecOps lifecycle stages.
• Autonomous zero-to-merge implementation executed entirely by GitLab Duo on Issue #1.
• Zero vulnerabilities detected across SAST and secret scans.

What We Learned

How powerful the GitLab Duo Agent Platform is when combined with native DevSecOps primitives. Instead of treating AI as just a code-completion tool, Duo functions as an active participant across planning, implementation, and review.

What's Next for Shipwright

• Implementing automated incident ticket creation triggered directly from failed synthetic monitor checks.
• Expanding multi-cloud production targets using GitLab environments.

Built With

• devsecops
• docker
• gitlab-ci/cd
• gitlab-duo
• java
• maven
• sast
• secretdetection
• spring-boot