SortSmart Ship-It Loop takes an existing waste-sorting advisor app (SortSmart) and wraps it in a supervised-autonomy agent loop built on the GitLab Duo Agent Platform. Every push or merge request triggers the loop: tests run, a Bandit security scan hunts for vulnerabilities, the build packages the app, and a custom 'SortSmart Reviewer' Duo agent reviews the change like a senior engineer — checking bugs, security, and Python best practices. With the review green, the loop deploys to Google Cloud and runs smoke tests against the live service, verifying the deployed commit is exactly what was reviewed. The human approves the outcome, not every individual step.
The problem: code generation is solved — but everything after the code still eats developer hours daily. For solo developers and small teams, the post-code DevSecOps lifecycle is pure toil. The Ship-It Loop hands that toil to agents: 8 of the 9 DevSecOps lifecycle stages (verify, secure, package, review, release, configure, monitor, govern) run automatically on every change.
How GitLab automates it: the .gitlab-ci.yml pipeline (pytest, Bandit, packaging) covers verify/secure/package with full visible history; the custom Duo agent 'SortSmart Reviewer' (AI Catalog, public) covers review — demoed reviewing a real merge commit with verdict Approve; CI deploy to Google Cloud with /health SHA verification covers release/configure; post-deploy smoke tests cover monitor; MR-based approvals cover govern.
What was added during the submission period (on/after Oct 5, 2026): the entire CI pipeline, deploy poller + Cloudflare tunnel plumbing, deploy/ GCP deployment code, the custom Duo agent definition and system prompt, AGENTS.md project rules, .gitlab/duo/mcp.json, and the Google Cloud deployment itself. The underlying SortSmart advisor is the pre-existing MIT-licensed project.
Log in or sign up for Devpost to join the conversation.