Verification Gate

Inspiration

Teams merge on a green checkmark and a quick read of the diff. What happens after the merge (does the change work, does the rollout verify, does the service stay healthy) is checked late, by hand, or by the users.

What it does

A GitLab Duo agent and flow run a fixed verification sequence on a candidate build and stop at the first failure: a self-check that proves the gate rejects a known-bad build, a negative control on the candidate, a live functional run, at least 20 fresh-state scenarios, a staged deploy with automatic rollback when verification fails, and a post-deploy health monitor. The decision (APPROVE or BLOCK) comes with a short table naming the failing stage. Release is a manual job, so a person approves the outcome (Supervised). The deployer and health probe in this demo are in-memory stand-ins; nothing is deployed. A real deployer implements three small methods.

How we built it

Python 3.12 standard library, a custom GitLab Duo agent and flow, and GitLab CI/CD. The pipeline runs the unit tests, a negative-control job that must see the gate block a bad build, a rollback check, and the gate on the real merge request. The Duo flow has run on the project (duo_workflow pipelines #2970514758 and #2970518241), and main pipeline #2972685506 shows the gate approving the good build, blocking the empty build and rolling back a failed deploy.

Challenges

Proving the gate itself works: a gate that always says APPROVE looks the same as one that checks. So the first stage is a self-check against a known-bad build, and the pipeline has a negative-control job. The Duo flow run on MR !3 also found a wording bug in the self-check detail, fixed in commit abfdefc.

What we learned

Every claim in the README is ticked only where the GitLab pipeline history shows it ran; open items stay open.

How it was tested

79 offline tests against an in-memory GitLab, deployer and probe, including negative controls (known-bad builds and broken flows must be detected). Results are in the CI pipeline history.

Sustainability

One gate run uses about 0.04 CPU-seconds (docs/SCI.md lists what was measured and what was assumed).

MIT licence. Built by 3Dogs Nexus.

Built With

• gitlab-ci
• gitlab-duo
• python