SoloDuo DevSecOps Autonomous 9-Stage Autopilot on GitLab Duo

🔗 Public GitLab Repository: https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43484591/showcase
📜 License: MIT License (Open Source)
🏆 Category: Path A (Start Fresh) — Hands-off Autonomy Level
🎯 Target Special Prize: "Most Stages Covered" (All 9 DevSecOps Lifecycle Stages)

Inspiration & Problem

Building production-grade software requires far more than writing code. After code is written, engineering organizations must navigate linting, unit testing, container packaging, SBOM generation, SAST, secret detection, dependency scanning, infrastructure validation, multi-stage deployment, uptime monitoring, and license compliance audits.

For solo developers, non-profits, academic teams, and small engineering startups, this operational overhead is overwhelming. Security scans are skipped, documentation lags, and releases become fragile manual events. SoloDuo DevSecOps was built to democratize enterprise-grade DevSecOps: giving single developers an autonomous, hands-off platform powered natively by the GitLab Duo Agent Platform.

What it Does (Hands-Off Autopilot)

SoloDuo DevSecOps delivers a genuine "Hands-off" autonomy workflow:

1. Single Human Trigger: A developer opens an issue (Work Item) requesting a feature (e.g., adding priority filtering) and mentions the autopilot service account (@ai-devsecops_autopilot-gitlab-ai-hackathon).
2. Autonomous Agent Execution: The GitLab Duo custom ambient flow triggers automatically. It formulates an implementation plan, creates a feature branch (feat/auto-task), updates FastAPI Python code (app/main.py), generates pytest test suites (tests/test_main.py), and opens a Merge Request targeting main with auto-merge enabled.
3. 9-Stage Deterministic Verification: GitLab CI/CD takes over to execute all 9 lifecycle stages without burning LLM tokens. Once verified, the MR merges automatically, deploys to Staging, validates uptime via live HTTP smoke tests against /healthz and /metrics, promotes to Production, and posts an audit certificate back to the issue.

The 9 DevSecOps Stages Covered

SoloDuo DevSecOps explicitly touches and verifies all 9 lifecycle stages defined by GitLab:

1. PLAN: Work item requirements analysis, acceptance criteria formulation, and project specification validation.
2. CREATE: Automated Python feature coding and strict static analysis via Ruff.
3. VERIFY: Pytest test suite execution with JUnit XML reporting and Cobertura line coverage integrated into MR diffs.
4. PACKAGE: Multi-stage, non-root Alpine container build pushed to GitLab Container Registry + CycloneDX SBOM via Syft.
5. SECURE: Official GitLab Security Templates: SAST, Secret Detection, and Dependency Scanning.
6. CONFIGURE: Declarative validation of infrastructure definitions (Docker Compose and Google Cloud Run Knative YAML).
7. RELEASE: Automated release packaging, environment rollouts to Staging and Production.
8. MONITOR: In-pipeline automated HTTP smoke testing against live /healthz and /metrics endpoints.
9. GOVERN: OSI license compliance verification via pip-licenses and automated compliance audit reporting.

How We Built It

• GitLab Duo Custom Flows (v1 YAML): Built strictly using the official Flow Registry schema in an ambient environment, coordinating native GitLab tools (get_work_item, create_work_item_note, read_file, create_branch, edit_file, create_commit, create_merge_request).
• Hybrid Efficiency: Agentic supervisor for cognitive tasks (planning and code generation) paired with deterministic GitLab CI/CD runners for builds and scans, ensuring complete sustainability well within the 500 monthly credit budget.
• Python / FastAPI & Docker: Clean, typed REST architecture running non-root multi-stage Alpine containers.
• Licensing & Governance: 100% open source under the MIT License with permissive OSI dependencies.

Challenges Overcome

• Designing within the platform constraint where non-human bot accounts cannot trigger cascaded automated triggers, solved by engineering an ambient supervisor architecture that hands off to deterministic CI/CD pipelines.
• Aligning strict YAML v1 flow schemas and component input bindings with GitLab's Flow Registry validator.

Accomplishments

• Achieving a genuine, verifiable Hands-off level of autonomy proven by a completed session in under 2 minutes.
• Touching and proving all 9 distinct stages of the GitLab DevSecOps lifecycle with visible artifacts in the pipeline history.

Built With

• agents
• ai
• devsecops
• docker
• fastapi
• gitlab-ci
• gitlab-duo
• pytest
• python
• sast
• sbom
• yaml