StackRadar Duo Flows

Inspiration

What it does

How we built it

Challenges we ran into

Accomplishments that we're proud of

What we learned

What's next for StackRadar Duo Flows

Inspiration

Writing code is the fast part now. Reviews, red pipelines and security alerts are where teams lose days. StackRadar already scores dev tools 0 to 100 by momentum, so we put that data to work inside GitLab.

What it does

Five Duo flows. MR Reviewer checks new dependencies against live StackRadar scores and flags declining ones with real numbers. Pipeline Doctor reads a failing job log and opens a draft fix. Security Remediator bumps vulnerable packages only in files the commit touched and files the rest as issues. Release Captain drafts release notes and waits for human approval. Incident Responder opens an incident and a draft rollback, also gated. Agents never merge; people do.

How we built it

Custom flow YAML under .gitlab/duo/flows, service accounts that trigger sessions when assigned, calls to the public StackRadar API from the flow sandbox, and GitLab CI with tests, lint, builds and scanners. Seeded demo branches fail on purpose so every flow has something real to fix.

Challenges we ran into

Keeping agents from overreaching. Every flow ends in a draft MR, an issue or a human approval step.

Accomplishments that we're proud of

End to end runs on real MRs, green main pipeline with 841 backend tests, and review notes backed by actual scores.

What we learned

Duo flows work best as narrow specialists with a clear handoff to a human.

What's next

Auto-deploy to Cloud Run once billing is set, and more flows for flaky tests.

What changed since Oct 5

All flows, flow YAML, service-account triggers, demo branches and CI jobs were built after Oct 5, 2026 on top of the existing MIT-licensed StackRadar codebase.

Built With

• docker
• fastapi
• gitlab-ci
• gitlab-duo
• nextjs
• postgresql
• python