Showcase: Autonomous Green DevSecOps

Inspiration

In the era of AI-accelerated development, writing code has become frictionless, but maintaining lifecycle integrity, security, and ecological sustainability after code generation remains a major bottleneck. Many enterprise CI/CD pipelines suffer from "silent masking"—failing tests or security scans suppressed by exit-zero scripts to fake green statuses.

We were inspired to build Showcase to answer a fundamental question: Can GitLab Duo act as an autonomous, honest DevOps engineer that audits broken CI gates, enforces an end-to-end 9-stage DevSecOps lifecycle, and audits software carbon intensity under Green Software Foundation standards?

What It Does

Showcase delivers an autonomous, verifiable DevSecOps loop governed by GitLab Duo and real-time environmental metrics:

1. Autonomous Hands-off Remediation (Best Hands-off Agent):
   GitLab Duo Developer autonomously investigates codebase anomalies. Rather than hallucinating changes, it audited the repository, flagged hidden pipeline failures (npm test || echo ... and simulated build fallbacks), refactored configuration scripts, and generated Merge Request !1 completely hands-off.
2. Comprehensive 9-Stage DevSecOps Lifecycle (Most Stages Covered):
   Covers the complete GitLab DevSecOps lifecycle across 9 continuous stages:
   • plan: Issue & change planning alignment.
   • verify: Strict unit testing and lint validation without masked error codes.
   • test: Automated integration and behavioral verification.
   • secure: Automated SAST scanning and dependency security gating.
   • package: Containerized build artifact creation.
   • release: Version tagging and automated release artifacts.
   • configure: Environment drift inspection and infrastructure governance.
   • monitor: Synthetic health checks and uptime validation.
   • govern: Verifiable compliance, policy audit, and carbon accounting.
3. Verifiable Green CI/CD (Most Environmentally Impactful):
   Embedded directly within the govern stage, our automated govern_sci_carbon_audit calculates real-time Software Carbon Intensity (SCI) based on runtime CPU energy draw and regional grid carbon intensity, outputting a quantifiable footprint of 0.0979 gCO2e/run.

How We Built It

• GitLab Duo Agent Platform: Configured autonomous agent workflows to triage repository issues, perform root-cause analysis on CI/CD masking, and autonomously commit refactored pipelines.
• GitLab CI/CD Engine: Built a unified, all-green 9-stage pipeline enforcing strict fail-fast policies, secret detection, and container security.
• Green Software Foundation (SCI) Standards: Developed custom calculation models (scripts/ci-carbon-calculator.js) using dynamic runner execution timestamps (CI_PIPELINE_CREATED_AT) to deliver honest, measured gCO2e readings instead of arbitrary heuristics.

Challenges We Ran Into

• Eliminating Masked Pipeline Failures: Transitioning from permissive CI scripts to strict zero-tolerance gates required accurate test remediation. The Duo Agent had to recognize that an existing "green" pipeline was hiding silent errors and autonomously fix them without breaking valid dependencies.
• Accurate SCI Carbon Measurement: Runner environments are ephemeral, making real-time energy measurement difficult. We had to design an accurate mathematical model mapping pipeline duration directly into operational emissions ($E \times I$).

Accomplishments That We're Proud Of

• 100% Green Across All 9 Stages: Successfully passed the complete DevSecOps lifecycle in pipeline execution.
• Zero-Touch MR Creation: GitLab Duo independently created and verified Merge Request !1 with zero human prompt engineering required during the fix.
• Quantifiable Green CI/CD: Produced an empirical carbon footprint report showing 0.0979 gCO2e/run, turning pipeline governance into an active sustainability metric.

What We Learned

AI agents in DevOps are only as valuable as their governance framework. Giving an agent the mandate to "keep pipelines honest" and enforce sustainability standards creates far more engineering value than simple code generation.

What's Next for Showcase

• Expanding dynamic carbon-aware scheduling to trigger heavy build and SAST jobs during local grid low-carbon hours.
• Integrating multi-agent rollback protocols triggered automatically by monitor-stage synthetic failures.

Built With

• bash
• docker
• gitlab-ci/cd
• gitlab-duo
• javascript
• node.js
• sast