Autopilot — Agentic DevSecOps

The problem. After the code is written, the DevSecOps lifecycle is still manual: triage the issue, write the code, get a review, check security findings, fix the pipeline, stage, get approval, deploy, verify production, close the loop. Every handoff waits on a human.

What it does. TasteRoute Autopilot wires four custom GitLab Duo Agent Platform flows into a single supervised pipeline around the TasteRoute project (an MIT-licensed food-discovery app). A human creates an issue — that is the only required touch. From there:

1. Triage + Developer — triggered when the flow's service account is assigned to the issue. The triage agent posts an implementation plan (or one clarifying question); the developer agent implements it on an autopilot/ branch, runs Vitest + build, and opens a merge request.
2. Reviewer + Security — triggered on MR creation / reviewer assignment. The reviewer agent posts line-level findings and approves only when clean and green; the security agent judges SAST findings as true positive or noise, and @-mentions the fix flow when action is needed.
3. Fix — triggered by a failed pipeline or the security agent's mention. Applies the minimal fix on the MR branch (3-attempt limit, then escalates to a human), re-verifies, and pushes.
4. Release + Monitor — triggered by a green pipeline on main. Reports deploy readiness, then pauses for one human approval before production. After approval it verifies production health, posts a full summary, and closes the issue.

How GitLab automates the post-code lifecycle. Everything runs on GitLab: the four flows are registered in the AI Catalog and enabled on the project with event triggers (assign, reviewer, pipeline, mention); the .gitlab-ci.yml pipeline runs verify → secure (SAST) → package → release → monitor; each flow runs under a scoped service account with least-privilege toolsets.

What goes beyond the standard automation examples:

• Security signal vs noise: the security agent doesn't just report SAST findings — it judges each as true positive or noise, and only escalates real issues to the fix flow. This eliminates the alert-fatigue problem that plagues automated security scanning.
• Self-healing production: a dedicated monitor watches production health every 10 minutes. On outage, it autonomously files an issue, assigns the Autopilot service account, and the full loop (diagnose → fix → test → review → deploy) heals production without human intervention.
• Scoped autonomy: each flow runs under a least-privilege service account with only the tools it needs. The 4-flow chain passes context via GitLab-native mechanisms (issue comments, MR descriptions, pipeline triggers) — no external orchestration.

Autonomy level: Supervised. The human approves the outcome (production deploy), not the individual steps — exactly one gate in a fully autonomous loop.

Proven in production. A deliberate production outage (broken health probe) was detected by the self-heal monitor, diagnosed, fixed with a regression test, reviewed, merged, and deployed — all autonomously — in 51 minutes with zero human touches except the designed approval gate.

Built With

• agent
• ci/cd
• docker
• duo
• express.js
• gitlab
• next.js
• platform
• sast
• typescript