TRANSCEND-FLOW

SDLC Panacea

Comment

Inspiration

AI can now write code in seconds, but the work that comes after the code is still slow and manual: reviewing it, testing it, scanning it for security problems, merging it and releasing it. As a computer science student, I kept seeing the same pattern: code waits in a queue for people. The "Life After Code" theme described exactly that gap, so I built TRANSCEND FLOW ("SDLC PANACEA"), a set of GitLab agents and automated checks that carry work from an issue toward production.

What it does

TRANSCEND FLOW takes a GitLab issue through the delivery pipeline:

  • Plan and Create: an issue created from a template is picked up by a GitLab Duo developer agent, which opens a merge request with code and unit tests.
  • Verify: CI runs the unit tests and requires at least 80% coverage of the app code.
  • Secure: GitLab SAST, secret detection and dependency scanning run on every change. A custom security-gate job reads the scanner reports, prints each finding (file, line, rule, severity) and blocks the merge if any exist.
  • Fix: a second Duo agent reads a failed gate, pushes a fix, and explains it in plain English.
  • Govern: a merge gate applies a written policy (docs/policy.md), leaves an audit note, and enables auto-merge only for safe agent merge requests.
  • Release and Monitor: deploy jobs for Google Cloud Run with staging, health checks, promotion, rollback and an incident issue.
  • Report: a summary comment on the original issue.

How I built it

The project is a small Python web service (standard library only) that the agents build, test and ship. I wrote the system in stages and tested each one before moving on.

  • GitLab Duo Agent Platform: two custom flows, issue-to-mr and security-fix, with triggers and a shared AGENTS.md file of rules for the agents.
  • GitLab CI/CD: the scanner templates, the security-gate job, the coverage gate, and build, deploy and report jobs.
  • Python scripts: a merge gate, a summary reporter and an incident opener that use the GitLab API, all tested with fake API responses (40 unit tests).
  • Sustainability: a script that estimates pipeline carbon intensity with the Software Carbon Intensity formula, $$SCI = ((E \times I) + M) \text{ per } R$$ where $R$ is one pipeline run. It is included but I make no claim about measured savings.

What actually ran

  • [EDIT] The developer agent opened a real merge request from an issue (adding GET /api/tasks/<id>).
  • [EDIT] I seeded a fake token and a risky shell=True call in a test branch. The scanners caught both, and the security agent pushed a fix with plain-English explanations. A secret that has entered git history keeps the gate red until it is revoked, which is correct behaviour.
  • The gate also caught a real finding in my own new code (Bandit B310 in scripts/gitlab_api.py). I fixed it by replacing urllib with http.client, and the pipeline turned green.

Challenges

  • The trigger I assumed did not exist. GitLab has no "issue created" trigger, and triggers need a human action. I worked around it with an issue template that assigns the agent.
  • My own rules blocked my own agent. AGENTS.md forbade edits under scripts/ while the security rules told the agent to fix findings there. The agent correctly refused to act. I fixed the conflict instead of loosening the gate.
  • Credits ran out. Duo credits ended mid-build, so I moved the code between projects with git, wrote the remaining automation outside Duo, and kept the agents for the parts that must run on Duo.
  • Time. I started late and cut scope to a working core instead of claiming everything.

What I learned

  • Agents need precise, non-conflicting rules. Ambiguity makes them stop, which is the safe behaviour.
  • A gate that reads machine-readable reports works on any GitLab tier and gives agents a clear, testable target.
  • Honest scope beats big claims: the auto-merge, deployment and summary steps are built and unit-tested, but [EDIT: say whether you ran them live].

What's next

Run the full issue-to-production loop end to end, deploy to Google Cloud Run, measure the real SCI savings, and replace the personal token used by the merge gate with a project-scoped one.

Repository: https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43140565/showcase

Built With

Share this project:

Updates

Submission history