CI/CD

102 posts

gitlabJul 16, 20262 min readCurated summary

Bring GitLab Duo Agent Platform to your terminal

GitLab Duo CLI, generally available in GitLab 19.2, brings GitLab Duo Agentic Chat into the terminal. It combines code assistance with project, pipeline, permissions, and agent context from GitLab, helping developers handle failures and multi-step delivery work without leaving the shell. It supports both interactive development and headless automation in CI jobs and scripts. ## Why Terminal AI Needs GitLab Context - Many delivery problems occur after coding: failed pipelines, broken tests, vulnerabilities, dependency issues, and CI configuration problems. - Generic coding agents lack access to GitLab project context, pipeline data, permissions, and organization-wide agent configuration. - Duo CLI connects terminal work to the broader GitLab software lifecycle and provides centralized administration and identity management. ## Capabilities of Duo CLI - Investigate codebases, refactor, troubleshoot pipelines, improve CI/CD, and complete multi-step tasks from the terminal. - Share conversations across Duo CLI, the GitLab web UI, and editor extensions. - Use **Plan mode** to inspect and prepare changes, then **Build mode** to apply them. - Run `/doctor` to diagnose setup issues and `/mcp` to inspect MCP configuration. - Available on GitLab.com, GitLab Self-Managed, and GitLab Dedicated, with instance-level controls for administrators. ## Interactive and Headless Operation - Launch through the GitLab CLI with `glab duo cli`, which handles authentication, or use the standalone `duo` command with a personal access token. - Interactive mode allows users to chat, review proposed actions, and approve tools before execution. - Headless mode supports automation through commands such as: - `glab duo cli run --goal` - `duo run --goal` - A pipeline failure can be investigated directly from the shell, with Duo CLI analyzing the issue and proposing changes for review. ## Customization and Adoption - Duo CLI follows project instructions in files such as `chat-rules.md`, `AGENTS.md`, and `SKILL.md`. - Custom slash commands can extend interactive workflows. - Users can install and authenticate through the Duo CLI documentation, or begin with `glab duo cli`. - GitLab offers Duo Agent Platform trials and includes credits for eligible Premium and Ultimate subscriptions. Duo CLI is positioned as a way to extend AI assistance beyond code editing into the operational parts of software delivery. Teams can start with interactive troubleshooting and gradually use headless mode for repeatable CI and scripting workflows.

CI/CD AI Agents Model Context Protocol DevSecOps+2

gitlabJul 16, 20263 min readCurated summary

When a version bump breaks your build, GitLab fixes it

GitLab’s Dependency Scanning Auto-Remediation aims to reduce security backlogs by automatically upgrading vulnerable dependencies and repairing code when those upgrades break builds. Its AI agent analyzes pipeline errors, changelogs, and code usage, then commits fixes within the same merge request. All changes remain subject to existing reviews, approval gates, and audit controls. ## Why Dependency Backlogs Grow - Transitive dependencies account for a large share of vulnerabilities; one 2025 Maven study found vulnerabilities in about 63% of latest releases through transitive dependencies, compared with 31% through direct dependencies. - Dependency remediation competes with feature work, causing high-severity issues to remain unresolved beyond PCI-DSS and FedRAMP’s 30-day expectations. - Approximately one in eight dependency updates introduces a breaking change, and even “backward-compatible” updates can break builds. - AI-assisted exploit development is also speeding up vulnerability disclosure and weaponization. ## Automated Dependency Upgrades - When SBOM-based dependency scanning identifies a vulnerable package with an available fix, GitLab automatically opens a merge request. - The upgrade targets the nearest fixed version. - If no eligible fix exists, the vulnerability remains in the report until a safe upgrade becomes available. - Each merge request is attributed to a dedicated service account for traceability. - Developers can also start remediation manually for individual findings. ## AI-Powered Breaking-Change Resolution - If the dependency upgrade causes a pipeline failure, GitLab Duo Agent Platform investigates the failure. - It considers: - Pipeline error messages - The dependency’s changelog - How the project uses the dependency - The agent commits necessary application-code changes to the same merge request. - If it cannot restore a passing pipeline, it stops and documents its findings for developers. - Supported ecosystems include Bundler, Maven, Gradle, and major Python and JavaScript/TypeScript package managers; Rust and Go support is planned. ## Safeguards and Governance - Auto-remediation never merges changes automatically. - Merge requests explain the vulnerability, target version, and AI-generated code changes. - Cooldown periods prevent repeated remediation activity from overwhelming projects. - Closed merge requests are not recreated unless a newer fix is available. - Teams can select vulnerability severities and limit upgrades to patch, minor, or major versions. - Remediation runs through the organization’s existing pipelines, access controls, approval gates, and audit trails. - Configuration can be managed at the project or group level through API-based profiles during the beta. ## Availability and Pricing - Dependency Scanning Auto-Remediation is in public beta on GitLab.com, with rollout planned for Self-Managed and Dedicated installations. - Automated version bumping is included with GitLab Ultimate. - Agentic breaking-change resolution is available through a GitLab Duo Agent Platform trial or included GitLab Credits for eligible Ultimate subscribers. GitLab recommends using the feature to turn vulnerable dependencies into reviewable, pipeline-validated merge requests, reducing manual remediation effort without sacrificing developer approval or compliance oversight.

CI/CD AI Gitlab Python+4

gitlabJul 16, 20262 min readCurated summary

Turn multi-step software delivery into agentic flows you can trust

GitLab Duo Agent Platform’s Custom Flows are now generally available, enabling teams to automate multi-step software delivery rather than relying on chat responses, scripts, or manual runbooks. Flows can start from GitLab events or Agentic Chat, execute tasks across projects, and include human approval checkpoints. The goal is dependable, repeatable automation for work such as implementing issues, repairing pipelines, and reviewing merge requests. ## Why Software Delivery Remains Manual - Real development tasks involve multiple steps: gathering context, changing code, opening a merge request, waiting for CI, and responding to reviews. - Without workflows, people must manually coordinate each handoff and remember undocumented team practices. - Teams previously hesitated to formalize these processes because Custom Flows lacked production readiness and sufficient event coverage. ## What Agentic Flows Provide - Automate trusted sequences triggered by events such as: - Mentions and assignments - Pipeline activity - Merge request lifecycle changes - Work item updates - Run under a composite identity, keeping permissions bounded and actions attributable. - Launch specialist workflows from Agentic Chat, including: - Developer Flow for implementing changes - Code Review Flow for reviewing merge requests - Fix CI/CD Pipeline Flow for diagnosing and repairing failures - Require user approval before handing work from chat to a flow, while displaying progress inline. - Use review exclusions to avoid automatically reviewing bot-authored or branch-pattern merge requests. - Apply custom review instructions so automated reviews match team standards. ## Custom Flow Configuration - Create flows from a project or the AI Catalog. - Set visibility, enable flows for selected projects, and attach GitLab event triggers. - Add human-in-the-loop checkpoints for sensitive operations. - GitLab 19.2 adds: - A “work item status changed” trigger - Bulk enablement of public flows across up to 100 projects - A future Flow Creation Agent is planned to generate runnable flow definitions from plain-language descriptions. ## Costs and Adoption - Event-driven flows consume GitLab credits according to the work they perform. - GitLab recommends testing flows in a small number of projects before broad deployment. - Access is available through a GitLab Duo Agent Platform trial or through included credits for Premium and Ultimate subscribers. Teams should begin by encoding a few well-understood delivery processes as Custom Flows, adding approval gates where necessary, and expanding gradually while monitoring credit usage and automation quality.

CI/CD AI Agents Gitlab Duo Agent Platform Agentic Workflows+3

gitlabJul 9, 20263 min readCurated summary

Green DevOps: Why carbon measurement belongs in your CI/CD pipeline

CI/CD pipelines consume energy and generate emissions that standard pipeline metrics do not reveal. The post argues that measuring this impact is the first step toward reducing it, recommending Eco CI for job-level measurements and Carmen for infrastructure and application-level analysis. Both tools integrate with GitLab pipelines with minimal effort and can improve sustainability, performance, and cloud costs. ## Why CI/CD Carbon Measurement Matters - Modern teams run hundreds of jobs daily, including increasingly resource-intensive AI-assisted testing and automation. - Each job has an energy and carbon cost that is usually absent from pipeline logs and architecture diagrams. - Green DevOps involves measuring emissions per pipeline, service, and Kubernetes workload to guide engineering decisions. ## Measuring Emissions at Different Layers ### Pipeline-level measurement with Eco CI - Eco CI measures energy consumption and carbon emissions for individual CI/CD jobs. - It runs as lightweight Bash scripts without additional servers or databases. - Teams can identify expensive jobs, track emissions over time, and add a carbon badge to a project README. - Because it works within existing pipelines, it is a practical starting point. ### Infrastructure and application measurement with Carmen - Carmen, the Carbon Measurement Engine, uses the Green Software Foundation Impact Framework. - It measures emissions from virtual machines, Kubernetes pods, and application workloads. - Reports are provided per component in CSV format and distinguish: - Operational carbon from energy consumption - Embodied carbon from hardware manufacturing and disposal - Outputs such as `EnergykWh` and `TotalCarbonGramsCO2eq` can be imported into Grafana, FinOps dashboards, or custom tools. - Carmen helps teams compare emissions across services, such as an API gateway versus a data-processing layer. ## Adding Carbon Reports to GitLab - Both tools can be integrated through `.gitlab-ci.yml`. - A Carmen job can: - Use a Python 3.12 image - Install Node.js, npm, Git, and the Impact Framework toolchain - Clone and install the Carmen project - Run `carbon-daemon` - Store generated reports as GitLab artifacts - Carmen can run as a separate, non-blocking job, keeping carbon measurement outside the critical delivery path. ## Turning Visibility into Engineering Improvements - Eco CI may reveal that integration tests produce unusually high emissions because dependencies are reinstalled on every run. - Adding dependency caching can reduce runtime, emissions, and CI costs without architectural changes. - Carmen can expose idle infrastructure, such as deprecated services still running in a staging Kubernetes cluster. - Decommissioning unused workloads eliminates both their operational and embodied carbon costs. ## Business and Regulatory Benefits - Emissions data creates a baseline for future reporting requirements, even when a company’s absolute footprint is relatively small. - Carbon-efficient systems are often faster and cheaper because they use fewer compute resources. - Caching, right-sizing runners, and removing idle services support both sustainability and FinOps goals. - Regulations such as the EU’s CSRD, along with enterprise procurement requirements, are increasing pressure for supply-chain and cloud-emissions reporting. Teams can start with Eco CI on one GitLab pipeline, then add Carmen for infrastructure-level visibility. Measuring carbon alongside runtime and cost makes sustainability a practical part of everyday engineering rather than a separate initiative.

CI/CD Kubernetes Gitlab DevOps+4

lineJun 25, 20264 min readCurated summary

What If AI Agents Debated Each Other? Redesigning the Development Process Through Multi-Agent Collaboration

AI coding’s main bottleneck is no longer code generation but the human coordination surrounding it: clarifying intent, validating assumptions, testing implementations, and preparing trustworthy pull requests. LY Corporation proposes an AI-native pipeline in which specialized “proposer” and “challenger” agents debate across three stages—specification, build, and delivery—while an orchestrator decides whether to revise, escalate, or proceed. The goal is for AI to substantiate its own work before human engineers review and approve it. ## Human Coordination as the Bottleneck - Traditional AI-assisted development speeds up individual tasks but leaves handoffs between requirements, implementation, verification, and review to humans. - Engineers still need to: - Write or refine specifications - Review AI-generated drafts - Transfer failed tests and feedback between steps - Inspect diffs - Prepare PR descriptions - Decide whether the result is trustworthy - The proposed solution is not to remove human judgment, but to automate repetitive coordination while preserving human ownership and final approval. ## Proposer–Challenger Collaboration - AI responsibilities are divided between two opposing groups: - **Proposers** develop specifications, implementations, and delivery materials. - **Challengers** validate them from specialized perspectives. - The separation prevents one general-purpose assistant from combining design, implementation, testing, and review into a single unchallenged response. - Specialized roles may include: - `requirements-synthesizer` - `security-analyst` - `test-coverage-reviewer` - `technical-writer` - `evidence-verifier` - An **orchestrator** mediates disagreements, redirects discussions, resolves deadlocks, and determines whether to revise, escalate, or advance. ## The Spec–Build–Deliver Pipeline ### Specification - The specification acts as a contract for all later stages. - It records: - Goals and constraints - Interpreted requirements - Explicit assumptions - Open questions - Proposed approach - Definition of done - Agents use evidence from the workspace and external sources such as Jira, Confluence, design documents, APIs, tests, dependencies, and existing conventions. - Ambiguous but low-risk and reversible issues can be documented as assumptions. - Unsafe, destructive, externally constrained, or hard-to-reverse uncertainties are escalated instead of guessed. ### Build - The approved specification is converted into a test-first verification plan before production code is changed. - The proposer identifies expected behavior, edge cases, required tests, and execution commands. - Challengers can dispute the verification design before or during implementation. - Proposers must support rejected objections with concrete evidence such as: - Execution paths - Compiler or linter output - Failing tests - Other workspace evidence - This prevents a simple green CI result from hiding missing or inadequate validation. ### Delivery - The final output is a review-ready PR package rather than merely a diff summary. - It explains: - What changed - Where reviewers should look first - Which checks passed - Remaining risks - Which challenges were already investigated - At this stage, the orchestrator acts more like a jury, judging whether sufficient evidence exists for release. ## Structured Debate Protocol - Each agent receives stage-specific context and returns structured JSON rather than a free-form essay. - Agents do not share one live context window. Shared state consists of: - Workspace files - Generated artifacts - The orchestrator’s accumulated transcript - Each round includes a proposer response, challenger response, and orchestrator decision. - The protocol distinguishes manageable uncertainty from blocking risk. - Consistent schemas make agent outputs easy to parse, compare, and feed into subsequent rounds. - For example, a challenger can identify an unclear scope boundary, explain why it matters, assign severity and confidence, and indicate whether user input is required. ## Overall Impact - Issues move through a continuous chain: debated specification, branch, tested implementation, and review-ready PR. - Humans intervene mainly to define intent, approve the final result, or resolve explicitly escalated decisions. - The central leverage comes not from generating code faster, but from requiring AI to explore, challenge, verify, and package its work before asking engineers to pay attention. The practical recommendation is to redesign AI development around explicit artifacts, specialized adversarial roles, evidence-based decisions, and automated handoffs. Human engineers should remain the final decision-makers, while AI handles the intermediate coordination and proof-building work.

CI/CD AI Agents Code Review Json+3

gitlabJun 24, 20263 min readCurated summary

GitLab Patch Release: 19.1.1, 19.0.3, 18.11.6 | GitLab Docs

GitLab released patch versions **19.1.1, 19.0.3, and 18.11.6** on June 24, 2026, addressing important bugs and security vulnerabilities in CE and EE. Self-managed installations should upgrade immediately; GitLab.com is already patched, and GitLab Dedicated customers need no action. The release fixes issues ranging from cross-site scripting and information disclosure to authorization bypasses and improper access controls. ## Release Guidance - The patches apply to GitLab Community Edition and Enterprise Edition. - GitLab recommends upgrading all affected self-managed installations to the latest supported patch release. - GitLab publishes scheduled patch releases twice monthly, with additional critical releases when necessary. - Vulnerability details are generally made public 30 days after the fixing release. - Unless otherwise specified, all deployment types—including Omnibus, source installations, and Helm charts—are affected. ## High-Severity Cross-Site Scripting Vulnerabilities - **CVE-2026-10086 — Analytics Dashboard** - A developer-level authenticated user could execute arbitrary client-side code in another user’s session through insufficient input sanitization. - Affects GitLab EE versions before 18.11.6, 19.0.3, and 19.1.1. - **CVSS: 8.7** - **CVE-2026-10712 — Web IDE Workbench Asset Handler** - Improper path validation could allow an unauthenticated attacker to execute JavaScript in a victim’s browser session. - Affects CE and EE versions before 18.11.6, 19.0.3, and 19.1.1. - **CVSS: 8.0** ## Information Disclosure and Authorization Issues - **CVE-2026-12053 — Duo Workflows** - Insufficient output filtering could expose sensitive information previously committed to a project. - Affects GitLab EE 19.1 versions before 19.1.1. - **CVSS: 7.7** - **CVE-2026-5309 — Virtual Registry Cleanup Policy API** - Authenticated users could read or modify another group’s cleanup policy settings. - Affects EE versions before 18.11.6, 19.0.3, and 19.1.1. - **CVSS: 5.4** - **CVE-2026-2238 — Rapid Diffs** - Unauthenticated users could view confidential issue references on public projects. - Affects CE and EE versions before 18.11.6, 19.0.3, and 19.1.1. - **CVSS: 5.3** - **CVE-2026-11379 — DAST Site Profile Management** - Developer-level users could potentially extract DAST site profile secrets due to incorrect authorization. - Affects EE versions before 18.11.6, 19.0.3, and 19.1.1. - **CVSS: 5.3** ## Additional Security Fixes - **CVE-2026-8330 — CI/CD API** - Sensitive data could be written to application logs because of insufficient filtering. - **CVSS: 4.4** - **CVE-2026-1606 — Snippets** - Authenticated users could conceal content within snippets through improper input validation. - **CVSS: 4.3** - **CVE-2026-5952 — Maven Package Registry** - Developers could bypass package protection rules and overwrite protected Maven package metadata. - **CVSS: 4.3** - **CVE-2026-5796 — Group Packages API** - Reporters could view package metadata from projects where the Package Registry was disabled. - **CVSS: 4.3** ## Recommended Action Administrators of affected self-managed GitLab instances should upgrade to **18.11.6, 19.0.3, or 19.1.1**, depending on their supported release branch, as soon as possible. Updating promptly is particularly important because several vulnerabilities permit code execution, sensitive-data exposure, or unauthorized access.

CI/CD Gitlab Api Security Cross Site Scripting+4

lineJun 22, 20264 min readCurated summary

From Automation to AI with Infrastructure as Code (IaC): Adopting OpenTofu and ChatOps

LY Corporation’s LINE Plus SRE team migrated Verda cloud infrastructure and IMON monitoring resources from scattered, manual management into an Infrastructure as Code (IaC) and GitOps workflow. Using OpenTofu and Terragrunt, they now manage roughly 1,500 resources across seven services through pull requests, CI/CD, and daily drift detection. The migration required careful automation for importing existing resources, normalizing state, and handling provider limitations and resource dependencies. ## Why IaC Was Needed - Teams previously managed infrastructure through different methods: - Verda’s web dashboard - Scripts - Wiki-based procedures - Personal documents and GitHub repositories - As the number of services and resources grew, this caused: - Inconsistent management practices - Difficult-to-track configuration changes - Greater risk of manual errors - Poor reproducibility and reviewability - The team adopted GitOps so that: - Desired infrastructure state is declared in Git. - All changes go through pull requests. - Infrastructure history is versioned and auditable. - CI/CD applies approved changes automatically. - Their goal was to manage infrastructure with the same engineering standards as application code: reviewable, version-controlled, and reproducible. ## Choosing OpenTofu and Terragrunt - OpenTofu was selected as an open-source Terraform fork. - It retains: - Terraform’s HCL syntax - Provider compatibility - Familiar module and configuration patterns - The team created reusable modules for: - Virtual machines - Load balancers - Monitoring alerts - Modules were versioned so updates could be adopted explicitly rather than affecting every environment immediately. - Terragrunt was added to reduce repetition in environment configuration. - Shared settings are defined once in a parent `root.hcl`. - Individual environments contain only their differing inputs. - OpenTofu reduces duplication in resource definitions, while Terragrunt reduces duplication in environment and backend configuration. ## Planning the Migration - The most difficult part of introducing IaC into an existing environment was importing resources that were already running. - Manual import was considered impractical for hundreds of VMs, load balancers, and DNS records because it would be slow and error-prone. - The migration was split into two phases: - **Phase one:** Automate imports, select one service for a pilot, and establish the complete OpenTofu/Terragrunt pipeline. - **Phase two:** Reuse the validated modules and import scripts to roll the approach out to the remaining services. ## Designing the Import Process - Import scripts were designed to: - Query existing resources - Decide which resources should be managed by IaC - Convert resource data into the desired code structure - Generate Terragrunt configuration - Connect resources to OpenTofu state - Run `plan` to verify that no unintended changes would occur - A key requirement was keeping three representations aligned: - Configuration code - OpenTofu state - Actual cloud resources - Normalization was added because equivalent values could be represented differently—for example, network or image IDs—causing OpenTofu to report misleading differences after import. ## Resource-Specific Import Strategies - Resources could not all be imported using the same procedure. - Different resource types have different identifiers, dependencies, and ownership models: - **VMs:** Imported individually, while distinguishing manually created instances from Kubernetes-managed instances. - **Load balancers:** Imported together with related listeners and pools. - **DNS:** Imported while preserving zone and record relationships. - **Kubernetes:** Structured around clusters and node pools. - **IMON:** Imported according to its hierarchy of teams, alert groups, alert rules, and monitors. - Each resource followed the same broad five-step process, but its implementation was adapted to the resource’s characteristics. ## Problems Discovered During Migration ### Kubernetes-Managed VMs - OpenStack contained both manually created VMs and VMs automatically created by Kubernetes. - Importing Kubernetes-managed VMs into IaC could cause conflicts between OpenTofu and Kubernetes. - The scripts excluded these VMs using naming patterns and metadata. ### IMON’s Hierarchical Structure - IMON alerts are organized as: `Team → Alert Group → Alert Rule → Monitor` - A flat import would lose these relationships. - The team mirrored the hierarchy in the directory structure so ownership and relationships were visible from the file layout. ### Provider and Regional Identifier Issues - The actual cloud platform allowed both hyphens and underscores in load balancer names, but the provider validation logic rejected underscores. - The team fixed this by modifying the provider’s validation logic and contributing the change upstream. - Resource UUIDs such as `flavor_id`, `image_id`, and `network_id` differed by region. - This produced unnecessary changes in `plan`. - The modules added regional mapping logic, allowing users to specify readable names while resolving them to region-specific IDs. The migration demonstrates that successful IaC adoption requires more than writing configuration files: existing infrastructure must be filtered, normalized, modeled according to its dependencies, and validated against real provider behavior. OpenTofu and Terragrunt provided the foundation for scalable GitOps management, while custom import automation and provider improvements made the transition safe for production resources.

CI/CD Kubernetes Infrastructure As Code Gitops+3

gitlabJun 18, 20262 min readCurated summary

AI Catalog updates for governance and operations

GitLab 19.1 expands the AI Catalog from a manually triggered tool into a governed automation platform. New event-driven Duo Flow triggers, configuration validation, agent restrictions, and model allowlists help enterprises run AI workflows continuously while maintaining security and operational control. The release is designed to make agentic automation safer and more reliable at production scale. ## Event-Driven Duo Flow Automation - Four new triggers let flows respond automatically to GitLab events: - Merge request code conflicts - Draft merge requests becoming ready for review - Merge request approvals - New work item creation - These triggers enable automated conflict summaries, compliance checks, deployment readiness checks, notifications, triage, labeling, and routing. - Pipeline triggers can now filter for specific states: failure, success, or cancellation. - Conflict-detected and draft-to-ready triggers are enabled by default. - A beta pattern-based approval tier lets developers approve repeated tool uses for an entire session instead of approving each invocation individually. ## Governance for Agents and Flows - Instance administrators and top-level group owners gain controls over which AI content users can run. - **Disable custom agents and flows** prevents users from creating or enabling custom-built content. - **Restrict the AI Catalog to your group hierarchy** blocks AI Catalog items from outside the organization’s namespace, including community and third-party contributions. - These controls help prevent unapproved agents and workflows from entering regulated or production environments. ## Pre-Save Flow Configuration Validation - GitLab now validates AI Catalog flow configurations against the Duo Workflow Service before saving them. - Errors such as missing inputs or invalid tool parameters appear directly in the UI. - This moves troubleshooting to configuration time, reducing the risk of broken or overly active flows running in production. ## Approved AI Model Controls - A public beta lets administrators define an allowlist of approved AI models. - Organizations can also set an organization-wide default model. - Teams retain flexibility within approved boundaries while meeting provider, compliance, or data-residency requirements. - The first version applies to GitLab Duo Agentic Chat, with broader coverage planned. Overall, GitLab 19.1 recommends treating AI workflows like production automation: trigger them from real events, validate them before deployment, and govern both the agents and models they use. Enterprises adopting the AI Catalog should configure the new restrictions and model policies before enabling widespread automated flows.

CI/CD AI Agents Gitlab DevSecOps+3

gitlabJun 18, 20263 min readCurated summary

GitLab 19.1 release notes | GitLab Docs

GitLab 19.1, released June 18, 2026, focuses heavily on AI governance, security scanning, and compliance automation. The release adds AI-assisted false-positive detection for secrets, centralized controls for GitLab Duo, stronger approval guardrails for agents, and broader secret detection in feature branches. It also streamlines code review and compliance setup through automatic Code Owner assignment and framework templates. ## Security and Secret Detection - **GitLab Duo secret false-positive detection** is generally available for Ultimate users. - Automatically analyzes critical and high-severity secret detection findings after scans. - Provides reasoning and confidence scores directly in vulnerability reports. - Supports manual analysis from individual vulnerability pages. - Helps security teams prioritize real threats and reduce alert fatigue. - **Improved feature branch secret detection** scans every commit from the branch’s divergence point from the default branch through the latest commit. - Previously, new branches or existing branches could leave secrets in earlier commits undetected. - The broader scan helps identify leaked credentials before they reach shared branches or production. ## GitLab Duo Administration and AI Governance - **Always-on availability mode** lets instance and top-level group administrators require GitLab Duo to remain enabled. - Project, subgroup, and group owners cannot disable Duo when this policy is active. - This complements the existing “always off” setting and supports centralized governance. - **Tool approval guardrails for Duo agents** introduce three policy modes for individual tools: - **Allow:** execute without user interaction. - **Ask:** require inline human approval. - **Deny:** block the tool entirely. - Approval decisions generate audit events. - The beta applies to Agentic Chat, IDE integrations, and flows. - **Custom and external AI feature controls** allow administrators and top-level group Owners to: - Prevent users from creating or enabling custom agents and flows. - Block agents and flows owned outside the organization’s group hierarchy. - **Custom flow YAML validation** checks configurations when flows are saved or updated. - Errors such as missing inputs or invalid tool parameters are reported before runtime. - This avoids discovering configuration problems only after a CI job begins. - **Pattern-based tool approval for Agentic Chat** is also introduced in the Agentic Core updates, extending administrative control over how agent tools can be used. ## Code Review and Compliance - **Automatic Code Owner reviewer assignment** removes the need to manually select reviewers for merge requests. - GitLab assigns all Code Owners matching the changed files. - Assignment occurs when a merge request is created as ready or when a draft becomes ready. - Existing reviewer selections are preserved. - **Compliance framework templates** are available in beta for Ultimate users. - Teams can create frameworks from predefined requirements and controls. - Templates can be previewed and customized before being applied. - Nineteen templates are available, including ISO 27001:2022, SOC 2, FedRAMP, NIST, CIS, and TISAX. ## Contributor Recognition - GitLab recognizes **Pishel65** as the month’s Notable Contributor. - The Level 3 contributor had 19 merged merge requests and nine additional open merge requests since joining in October 2025. GitLab 19.1 is particularly valuable for organizations adopting AI at scale: enable centralized Duo policies, require approval for sensitive agent actions, validate flows before execution, and use the expanded security and compliance features to reduce operational risk.

CI/CD AI Agents Gitlab Yaml+4

awsJun 17, 20263 min readCurated summary

AWS DevOps Agent adds release management capabilities to assess code changes before production (preview) | Amazon Web Services

AWS DevOps Agent’s new preview release-management features extend its role from post-deployment incident response to pre-production review and testing. It evaluates code changes against production requirements, organizational standards, dependency risks, and access-control practices, then performs targeted tests in isolated or production-like environments. The goal is to help teams safely handle the growing volume of AI-generated code without sacrificing review quality or delivery speed. ## Release Readiness Reviews - Reviews changes for: - Production and dependency risks - Cross-repository impacts - AWS access-control changes and Well-Architected best practices - Compliance with organization-specific standards - Teams can provide standards in plain English, such as: - Encryption and network-access rules - Logging and observability requirements - Sensitive-data classification practices - Without custom instructions, the agent applies general best practices. - It runs lightweight user-journey tests in an AWS-managed isolated environment to confirm that the software builds, runs, and passes basic functional checks. - Findings are available in: - The AWS DevOps Agent console - GitHub or GitLab pull-request comments - IDE workflows through the Kiro power or Claude Code plugin ## Autonomous Release Testing - Generates test plans based on the specific code change rather than relying only on static test suites. - Tests web and API applications in customer-provisioned, production-like environments before merging. - Covers: - Functional correctness - Behavioral regressions - Integration scenarios - Produces structured artifacts for every run, including metrics, logs, traces, and execution summaries. ## Configuring and Running Reviews - At least one GitHub or GitLab repository must be connected to an AWS DevOps Agent Space. - The agent indexes connected code and builds a knowledge graph of cloud and cross-repository dependencies. - Reviews can be triggered by: - Submitting a pull request - Starting an on-demand chat request, such as “Perform a production risk analysis on my repository branch” - The target can be specified using a branch name, pull-request number, or commit SHA. - Reviews can also be initiated from supported development environments. ## Reviewing Results - The **Changes** section lists review executions and supports filtering by category or status. - The **Timeline** records the agent’s tools, consulted dependencies, observations, and timestamped reasoning steps. - The **Report** includes: - Recommended action: **BLOCK**, **Proceed with Caution**, or **Safe to Release** - Number of critical issues - Commit revision and changed-file count - Evidence supporting the recommendation - Severity-ranked findings - Actionable remediation steps - A file-by-file summary of modifications - Developers can ask follow-up questions about affected downstream consumers, impacted files and line numbers, and recommended fixes. AWS DevOps Agent’s preview release-management capabilities provide an automated layer of change analysis and targeted testing before production. Teams should configure organization-specific instructions, connect their repositories, and use the generated reports and test artifacts as an additional safety gate for AI-assisted development.

CI/CD Observability Gitlab Github+4

gitlabJun 17, 20263 min readCurated summary

GitLab named a Leader in the 2026 Gartner® Magic Quadrant™ for DevSecOps Platforms

GitLab says Gartner named it a Leader in the 2026 Magic Quadrant for DevSecOps Platforms for the fourth consecutive year. The company argues that AI agents have accelerated coding but shifted bottlenecks to pipelines, security, deployments, governance, and costs. GitLab positions its unified platform as the control layer that turns agent-generated code into secure, compliant, production-ready software. ## AI Requires a Control Layer - Enterprises increasingly use multiple coding agents, but often lack centralized governance over: - Which agents can run - What data they can access - Which actions they can take - How their activity is audited - GitLab combines source control, CI/CD, security, deployment, policies, and planning in one platform. - Changes made by developers or agents can be evaluated against existing code, pipelines, and organizational policies before reaching production. ## Enterprise-Scale DevSecOps - GitLab highlights customer examples: - Ericsson reportedly cut deployment time in half. - Southwest uses GitLab for mission-critical airline operations. - Barclays and other regulated organizations use it while maintaining security and compliance requirements. - The platform supports multi-tenant SaaS, single-tenant SaaS, self-managed, and air-gapped environments. - Customers can use self-hosted AI models and integrate existing tools and AI services while maintaining a unified governance boundary. ## Reliability and Availability - Gartner recognized GitLab’s strengthened service-level agreements. - GitLab offers Ultimate customers on GitLab.com and GitLab Dedicated a 99.9% monthly availability commitment. - Eligible customers can receive service credits when availability falls below that threshold. ## New Capabilities for Speed and Governance GitLab announced five innovations intended to coordinate developers, agents, and software delivery: - **Next-generation source code management:** Claimed testing showed up to 50× faster performance and up to 1,000× less network data transfer. - **GitLab Orbit:** A context graph connecting code, work items, pipelines, deployments, and production signals. With Claude Code, GitLab reports tasks running up to 11× faster, using up to 4.5× fewer tokens and producing up to 45× fewer hallucinations. - **Security and governance agents:** Designed to address security and compliance gaps as agent usage expands. - **Agentic triggers:** Automate handoffs between developers and agents without requiring manual coordination. - **GitLab Flex agreements:** Allow customers to adjust spending across GitLab products and capabilities without changing contracts. GitLab’s central recommendation is to standardize development and AI-assisted delivery on one platform, context graph, and governance boundary. The Gartner recognition supports that positioning, although Gartner notes that its Magic Quadrant reflects analyst opinions and should not be interpreted as an endorsement or a recommendation to select the highest-rated vendor.

CI/CD AI Gitlab DevSecOps+4

gitlabJun 11, 20263 min readCurated summary

GitLab Patch Release: 19.0.2, 18.11.5, 18.10.8 | GitLab Docs

GitLab released patch versions 19.0.2, 18.11.5, and 18.10.8 on June 10, 2026, addressing important security and bug fixes. Self-managed installations should upgrade immediately; GitLab.com is already patched, while GitLab Dedicated customers need no action. The fixes affect both CE and EE and cover account takeover, cross-site scripting, denial of service, authorization bypasses, and server-side request forgery. ## Release Scope and Upgrade Guidance - Affected self-managed installations should upgrade to the latest patch release for their supported GitLab version. - The releases apply to GitLab Community Edition and Enterprise Edition. - GitLab publishes: - Scheduled patch releases twice monthly, on the second and fourth Wednesdays. - Ad-hoc critical patches for high-severity vulnerabilities. - Security issues are generally made public on GitLab’s issue tracker 30 days after the release containing their fix. - GitLab.com has already deployed the patches, and GitLab Dedicated customers do not need to take action. ## High-Severity Enterprise Edition Vulnerabilities - **CVE-2026-6552 — Group SAML Identity API** - CVSS 8.7. - An authenticated group Owner could potentially take over another member’s GitLab account through improper authorization. - Affects GitLab EE versions before 18.10.8, 18.11.5, and 19.0.2. - **CVE-2026-10087 — Analytics Dashboard XSS** - CVSS 8.7. - An authenticated developer could execute arbitrary client-side code on behalf of another user due to inadequate input sanitization. - Affects EE versions before the patched releases. - **CVE-2026-8589 — HTML Injection in Group Settings** - CVSS 7.3. - Improper sanitization could allow unauthorized email addresses to be added to a targeted user’s account. - Requires significant privileges and user interaction. ## Denial-of-Service Vulnerabilities - **CVE-2026-7250 — Grape API JSON Parsing** - CVSS 7.5. - An unauthenticated attacker could cause denial of service through malformed API request input. - Affects CE and EE versions dating back to 12.10. - **CVE-2026-1500 — Group Placeholder Reassignments API** - CVSS 6.5. - An authenticated user could trigger uncontrolled resource consumption with a specially crafted file upload. - Affects CE and EE versions beginning with 17.10. - **CVE-2026-10733 — CI/CD Catalog HTML Injection** - CVSS 4.3. - Improper sanitization could allow an authenticated user to disrupt the CI/CD Catalog page. ## Authorization and Data-Access Issues - **CVE-2026-6269 — Merge Requests API** - CVSS 5.4. - Developers could modify hidden merge requests because of incorrect authorization enforcement. - **CVE-2026-6277 — Security Inventory** - CVSS 4.3. - Security Managers could modify project security configuration even when the related feature was disabled. - **CVE-2026-6976 — Merge Request Diff** - CVSS 3.7. - Developers could hide changes from merge request diffs through improperly handled file names. ## Server-Side Request Forgery - **CVE-2026-9204 — Gitaly Repository Import** - CVSS 5.3. - An authenticated user could potentially read arbitrary files from the Gitaly server or access internal network resources during repository import. - The issue resulted from insufficient validation of secondary URLs. ## Recommendation Administrators of self-managed GitLab instances should upgrade to 19.0.2, 18.11.5, or 18.10.8 as soon as possible, regardless of whether they use Omnibus, source installations, or Helm charts.

CI/CD Gitlab Access Control Api Security+3

lineJun 10, 20264 min readCurated summary

Transitioning from a Legacy Project to an AI-Driven Project: The AX Roadmap

AI transformation (AX) is not achieved by simply adding AI tools; it requires redesigning the team’s development system around AI. The post proposes a four-stage roadmap for turning legacy projects into AI-driven projects, beginning with security and standardization and progressing toward specification-based development automation. Its central recommendation is to introduce AI gradually, with clear documentation, human approval gates, and measurable outcomes. ## What an AI-Driven Project Means - AI participates throughout the development lifecycle, including: - Specification writing - Code generation - Testing - Code review - Pull request creation and merging - Developers focus more on direction, judgment, and business decisions rather than repetitive implementation work. - The key methodology is **spec-driven development (SDD)**: - Requirements and implementation specifications are defined before code. - AI generates, tests, and reviews code against those specifications. - Structured specifications compensate for AI’s difficulty in interpreting ambiguous intent. ## Stage 1: AI-Ready — Establish Security and Compliance The first stage creates a safe foundation for using AI with project context and company data. - Remove hardcoded secrets such as API keys, database passwords, and internal IP addresses. - Use secret-management services to inject credentials dynamically at runtime. - Protect personally identifiable information by masking or tokenizing names, emails, phone numbers, and similar data before sending it to AI systems. - Separate or restrict access to critical intellectual property, including proprietary algorithms and sensitive architecture. - Define minimum compliance requirements first rather than delaying adoption until every security improvement is complete. - Use sandboxing, system prompts, filesystem restrictions, and network isolation to limit AI access. - Validate that isolation mechanisms actually prevent sensitive-data exposure. Expected benefits include safer AI usage, faster debugging and repetitive coding, and accumulated team experience that supports later adoption stages. ## Stage 2: AI-Assist — Standardize Team Usage This stage addresses teams where individuals already use AI but follow inconsistent practices. - Create project-level AI guidelines covering: - Project context - Coding conventions - Architecture principles - Domain terminology - Establish shared prompts, skills, or plugins for activities such as: - Brainstorming - Writing implementation plans - Code review - Subagent-driven development - Integrate AI into CI/CD for automated first-pass code reviews. - Let AI identify style violations, likely bugs, and security issues. - Reserve human review for complex business logic, architecture, and policy decisions. - At this stage, AI assists with human-written code rather than independently implementing features. Possible KPIs include: - A reduction in repetitive human review comments. - Increased test coverage. - Improved deployment reliability and system stability. - More consistent adherence to team conventions. ## Stage 3: AI-Development — Automate Implementation The third stage connects specifications directly to working code through an automated pipeline. - The pipeline includes three human approval gates: 1. **Specification review:** Confirm requirements, scope, edge cases, and validation criteria. 2. **Implementation and test-plan review:** Approve the AI-generated execution and testing plans. 3. **Code review:** Approve the final implementation before merging. - AI uses documented domain knowledge and architecture context to generate project-specific code. - A new file in a directory such as `/specs` can trigger CI automation. - CI can generate an implementation plan, execute coding tasks through independent subagents, run tests, and create a pull request. - Approval steps ensure that AI cannot proceed to the next stage without human authorization. To improve adoption, the post recommends expanding AI’s responsibilities gradually: - Begin with unit- and integration-test generation for existing logic. - Move progressively toward boilerplate and broader implementation work. - Avoid delegating critical business logic immediately, since poor early results can undermine team trust. ## Overall Adoption Principles - Each roadmap stage provides value independently; teams do not need to complete all four stages at once. - The appropriate target depends on team maturity, risk tolerance, domain complexity, and adoption speed. - Documentation is essential because AI needs structured project and business context. - Human oversight remains important, especially for requirements, architecture, business rules, and final code approval. - Security controls, common workflows, and measurable KPIs should develop alongside AI usage. Teams should start with the safest achievable stage, standardize practices before automating implementation, and expand AI’s role only as documentation, testing, and review processes become reliable.

CI/CD RAG Testing Ai Coding Agents+3

gitlabJun 10, 20264 min readCurated summary

Introducing GitLab Orbit

GitLab Orbit is a public-beta, queryable graph that connects code with merge requests, pipelines, deployments, vulnerabilities, incidents, and ownership. GitLab argues that this unified context makes AI agents faster, more accurate, and capable of answering cross-system questions that traditional file search or RAG cannot. In testing, Orbit improved code-review accuracy while reducing agent runtime, token use, and hallucinations. ## The Problem with Code-Only Agents - Agents often struggle to understand the systems surrounding code: - Related files and dependencies - Tests and pipelines - Deployments and environments - Vulnerabilities and ownership - Work items and merge requests - In large or multi-repository codebases, agents can waste tokens exploring irrelevant paths, miss dependencies, or run out of context. - This can produce code that appears correct but is later reverted or requires substantial human correction. ## Results from Compare the Market - Compare the Market tested four context-retrieval approaches across 79 real merge requests. - An Orbit-grounded AI reviewer: - Placed accurate inline comments about 70% of the time. - Outperformed RAG, which achieved roughly 58%. - Produced slightly better summaries of key changes: 68% versus 66%. - RAG performed worse than the other tested approaches, including using no additional context. ## Faster and More Efficient Coding Agents - Claude Code and other agents can connect to Orbit through the Model Context Protocol (MCP). - Instead of crawling a repository to infer relationships, an agent can query the graph directly for: - Where code is located - What depends on it - Which tests and pipelines cover it - GitLab reports up to: - 11× faster execution - 4.5× lower token usage - 45× fewer hallucinations ## Cross-System Engineering Workflows Orbit enables agents on the GitLab Duo Agent Platform to investigate relationships beyond source code. - **Pipeline failure triage** - Agents can identify merge requests associated with a failing job. - They can find other projects and in-flight changes likely to encounter the same failure. - This can help teams resolve shared incidents centrally rather than repeating investigations. - **Vulnerability blast-radius analysis** - Queries can trace vulnerable components through services, pipelines, environments, and owning teams. - Security teams can produce assigned remediation plans shortly after a CVE is discovered. - **Engineering metrics** - Teams can query relationships between cycle time, pipeline failure rates, and deployment frequency without waiting for custom dashboards or SQL analysis. - **Migration planning** - Orbit identifies dependent services, jobs, environments, and owners. - This reduces the risk of discovering hidden dependencies late in a migration. ## Architecture and Access - Orbit ingests lifecycle data through change-data capture into ClickHouse. - It parses code in 12 languages, including Ruby, Java, Python, TypeScript, Rust, Go, C#, C++, and PHP. - GitLab reports indexing more than: - 40,000 projects - 500 million nodes - 2 billion edges - The graph can be queried through: - A Cypher-like query language - MCP - REST - The GitLab CLI - An event-driven engine keeps the graph current as changes occur. - Indexing runs separately from GitLab, so query traffic does not burden the GitLab instance. - Authorization follows existing GitLab permissions, limiting agents to data their users can access. - Queries pass through validation, planning, optimization, and security stages before reaching the database. ## Engineer-Facing Data Explorer - The Data Explorer provides direct access to the same graph without an AI agent. - Engineers can use it to: - Investigate incidents - Trace dependencies across services - Diagnose recurring CI failures - GitLab positions it as a way to answer open-ended system questions in seconds rather than reconstructing the answer manually across multiple tools. GitLab Orbit is best suited to organizations where code, CI/CD, security, and ownership data are spread across large repositories or many projects. Its main recommendation is to use one permission-aware graph as shared context for both AI agents and engineers, rather than relying on repository search or disconnected tool calls.

CI/CD AI Agents Model Context Protocol Graph Database+3

gitlabJun 10, 20263 min readCurated summary

GitLab: Built for the agentic engineering era

GitLab argues that AI coding only becomes truly “agentic engineering” when paired with infrastructure built for machine-scale concurrency, lifecycle context, and enterprise governance. At GitLab Transcend, it announced new source control, context, security, orchestration, and purchasing capabilities designed to let agents work faster without sacrificing control. The overall goal is to convert rapid AI-generated development into reliable business value rather than unmanaged complexity. ## The challenge: speed without control - Research across more than 1,500 developers and technology leaders found: - 91% of organizations use at least two AI coding tools. - 54% use three or more. - Some customer codebases are growing by as much as five times per year. - Fragmented development lifecycles create several problems: - Human-scale source control systems struggle with thousands of concurrent agents. - Agents lack context about dependencies, deployments, and production behavior. - Rapidly changing code is difficult to govern. - Fixed contracts make AI adoption difficult to forecast. - 73% of respondents worry about maintaining AI-generated code, while only 21% see productivity improvements across the full SDLC. ## GitLab’s agentic infrastructure model GitLab presents its platform as four coordinated systems: - **Motor system:** Source control, pipelines, and deployments that execute work. - **Nervous system:** Context that helps agents and humans make informed decisions. - **Immune system:** Security, governance, identity, policy, audit, and approvals. - **Orchestration system:** GitLab Duo Agent Platform, which coordinates work across the lifecycle. The company says these systems operate consistently whether work is performed by a developer or an agent. ## Next-generation source control for agent concurrency Git’s traditional workflow creates bottlenecks when every developer runs hundreds of agents: - Agents repeatedly clone repositories even when they need only one file. - Thousands of simultaneous sessions can overwhelm a human-oriented backend. - Shared accounts and branches make it difficult to isolate, audit, or discard agent work. GitLab’s next-generation SCM, currently in private beta, retains Git protocol compatibility while redesigning the backend and interfaces for agents. It is intended to support thousands of parallel agents working safely across repositories. Early internal tests reported: - Up to 2× fewer tokens - Up to 50× faster wall-clock execution - Up to 1,000× less network traffic ## GitLab Orbit: lifecycle context for agents Agents often understand the code they modify but not the broader software lifecycle, causing wasted iterations, hallucinations, and incorrect work across large or multiple repositories. GitLab Orbit, in public beta, provides a continuously updated context graph connecting: - Code - Work items - Pipelines - Deployments - Production signals This gives agents and engineers a shared source of truth. GitLab reports that Orbit-grounded agents achieved up to 11× faster responses, 4.5× better cost efficiency, and 45× fewer hallucinations in early testing. Compare the Market’s testing on 79 merge requests found that graph-grounded agents placed inline review comments correctly 69.6% of the time, compared with 57.7% for a conventional RAG approach. ## Governance, orchestration, and purchasing GitLab also announced: - **Agents for security and governance for agents**, covering identity, policy, auditing, and approval of agent actions, in private beta. - **GitLab Duo Agent Platform**, generally available since January, allowing agents to pick up issues, review code, and fix pipelines. - **GitLab Flex**, a purchasing model intended to accommodate the unpredictable pace of AI adoption. - A Transcend hackathon inviting developers to build agents and workflows using Orbit. GitLab’s practical recommendation is not to slow down AI-assisted development, but to pair it with dedicated infrastructure for concurrency, full-lifecycle context, and enforceable governance.

CI/CD AI Agents Gitlab Git+4