Merge Requests

8 posts

gitlab4 min readCurated summary

How I built a demo generator with GitLab Duo Agent Platform

Click-through demos communicate product value more effectively than documentation, videos, or live environments, but traditionally required days of manual work. The author built a GitLab Duo Agent Platform workflow that turns screenshots and optional context into a narrated, branded HTML demo, opens a merge request, and publishes the result to GitLab Pages. The approach makes demos repeatable, reviewable, versioned, and easier to update when the product changes. ## Why Click-Through Demos Work - Users understand features faster by seeing them in action. - Click-through demos let viewers control the pace without requiring: - Access to a live product environment - Expertise navigating the product - External video-editing tools - Demos are reusable links that can be shared consistently through channels such as the GitLab Demo Hub. ## From Virtual Machines to Agents The author describes three stages in demo creation: - **Virtual machines:** Product and demo content were packaged into VMs, later hosted on centralized ESX servers. - **External SaaS tools:** Demo platforms added analytics and convenience but remained manual and dependent on vendor infrastructure. - **Agentic workflows:** Agents generate demos from prompts and deploy them within the same project, removing vendor dependency. Each stage improved accessibility, but agents make demos more sustainable by reducing repetitive work and simplifying updates. ## The Demo Creation Workflow A complete demo typically requires: - Learning the feature through documentation, issues, Slack, and discussions with product and engineering teams. - Developing a customer-focused story and scenario. - Creating a project and realistic demo data. - Capturing screenshots or video clips. - Writing step-by-step narration. - Assembling the demo in a clickable format. - Gathering stakeholder feedback and incorporating revisions. - Publishing to GitLab Docs, the Demo Hub, or other destinations. - Announcing the demo internally and externally. These activities can take days, and product changes may force the process to restart. The agent automates much of the predictable work while leaving feature selection, quality review, and final approval to humans. ## How the Click-Through Demo Generator Works - Screenshots are placed in a project folder. - An optional `context.md` file provides feature background. - An issue comment triggers the workflow. - The agent: - Renames and reorders screenshots - Writes the narration - Applies a branded HTML template - Creates a merge request - After review and merging, the demo is automatically published to GitLab Pages. - Follow-up changes can be requested from the agent. A Custom Flow invokes a custom tool that assembles the HTML, places narration panels over screenshots, and posts the merge request link back to the issue. ## Outcome-Focused Narration A project skill guides the agent’s writing so the demo explains customer value rather than merely walking through the interface. The required structure has three acts: - Open with the customer’s problem. - Show the product solving that problem step by step. - Close by explaining the value the customer gains. Localization can be added by creating a language-specific skill, allowing future demos to be translated automatically. ## Automated Publishing Publishing is also handled through an agent skill: - A demo is tagged as ready for production in the development gallery. - The agent enters the Demo Hub project. - It writes a short description, adds the current date, applies a “new” tag, and opens a merge request for the demo card. - A human still reviews and merges the request before the demo goes live. ## Demos as Code Because a click-through demo consists primarily of HTML, screenshots, and configuration, it can live in a GitLab repository rather than an isolated external tool. This enables teams to: - Review demos through merge requests. - Improve them collaboratively. - Track changes and versions over time. - Keep demos alongside the workflows that generate and publish them. The practical recommendation is to identify repetitive, well-defined work in your own organization and use GitLab Duo Agent Platform to automate its groundwork, while retaining human control over strategy, review, and release.

Read original(opens in new tab)
gitlab3 min readCurated summary

When a version bump breaks your build, GitLab fixes it

GitLab’s Dependency Scanning Auto-Remediation aims to reduce security backlogs by automatically upgrading vulnerable dependencies and repairing code when those upgrades break builds. Its AI agent analyzes pipeline errors, changelogs, and code usage, then commits fixes within the same merge request. All changes remain subject to existing reviews, approval gates, and audit controls. ## Why Dependency Backlogs Grow - Transitive dependencies account for a large share of vulnerabilities; one 2025 Maven study found vulnerabilities in about 63% of latest releases through transitive dependencies, compared with 31% through direct dependencies. - Dependency remediation competes with feature work, causing high-severity issues to remain unresolved beyond PCI-DSS and FedRAMP’s 30-day expectations. - Approximately one in eight dependency updates introduces a breaking change, and even “backward-compatible” updates can break builds. - AI-assisted exploit development is also speeding up vulnerability disclosure and weaponization. ## Automated Dependency Upgrades - When SBOM-based dependency scanning identifies a vulnerable package with an available fix, GitLab automatically opens a merge request. - The upgrade targets the nearest fixed version. - If no eligible fix exists, the vulnerability remains in the report until a safe upgrade becomes available. - Each merge request is attributed to a dedicated service account for traceability. - Developers can also start remediation manually for individual findings. ## AI-Powered Breaking-Change Resolution - If the dependency upgrade causes a pipeline failure, GitLab Duo Agent Platform investigates the failure. - It considers: - Pipeline error messages - The dependency’s changelog - How the project uses the dependency - The agent commits necessary application-code changes to the same merge request. - If it cannot restore a passing pipeline, it stops and documents its findings for developers. - Supported ecosystems include Bundler, Maven, Gradle, and major Python and JavaScript/TypeScript package managers; Rust and Go support is planned. ## Safeguards and Governance - Auto-remediation never merges changes automatically. - Merge requests explain the vulnerability, target version, and AI-generated code changes. - Cooldown periods prevent repeated remediation activity from overwhelming projects. - Closed merge requests are not recreated unless a newer fix is available. - Teams can select vulnerability severities and limit upgrades to patch, minor, or major versions. - Remediation runs through the organization’s existing pipelines, access controls, approval gates, and audit trails. - Configuration can be managed at the project or group level through API-based profiles during the beta. ## Availability and Pricing - Dependency Scanning Auto-Remediation is in public beta on GitLab.com, with rollout planned for Self-Managed and Dedicated installations. - Automated version bumping is included with GitLab Ultimate. - Agentic breaking-change resolution is available through a GitLab Duo Agent Platform trial or included GitLab Credits for eligible Ultimate subscribers. GitLab recommends using the feature to turn vulnerable dependencies into reviewable, pipeline-validated merge requests, reducing manual remediation effort without sacrificing developer approval or compliance oversight.

Read original(opens in new tab)
gitlab2 min readCurated summary

Turn multi-step software delivery into agentic flows you can trust

GitLab Duo Agent Platform’s Custom Flows are now generally available, enabling teams to automate multi-step software delivery rather than relying on chat responses, scripts, or manual runbooks. Flows can start from GitLab events or Agentic Chat, execute tasks across projects, and include human approval checkpoints. The goal is dependable, repeatable automation for work such as implementing issues, repairing pipelines, and reviewing merge requests. ## Why Software Delivery Remains Manual - Real development tasks involve multiple steps: gathering context, changing code, opening a merge request, waiting for CI, and responding to reviews. - Without workflows, people must manually coordinate each handoff and remember undocumented team practices. - Teams previously hesitated to formalize these processes because Custom Flows lacked production readiness and sufficient event coverage. ## What Agentic Flows Provide - Automate trusted sequences triggered by events such as: - Mentions and assignments - Pipeline activity - Merge request lifecycle changes - Work item updates - Run under a composite identity, keeping permissions bounded and actions attributable. - Launch specialist workflows from Agentic Chat, including: - Developer Flow for implementing changes - Code Review Flow for reviewing merge requests - Fix CI/CD Pipeline Flow for diagnosing and repairing failures - Require user approval before handing work from chat to a flow, while displaying progress inline. - Use review exclusions to avoid automatically reviewing bot-authored or branch-pattern merge requests. - Apply custom review instructions so automated reviews match team standards. ## Custom Flow Configuration - Create flows from a project or the AI Catalog. - Set visibility, enable flows for selected projects, and attach GitLab event triggers. - Add human-in-the-loop checkpoints for sensitive operations. - GitLab 19.2 adds: - A “work item status changed” trigger - Bulk enablement of public flows across up to 100 projects - A future Flow Creation Agent is planned to generate runnable flow definitions from plain-language descriptions. ## Costs and Adoption - Event-driven flows consume GitLab credits according to the work they perform. - GitLab recommends testing flows in a small number of projects before broad deployment. - Access is available through a GitLab Duo Agent Platform trial or through included credits for Premium and Ultimate subscribers. Teams should begin by encoding a few well-understood delivery processes as Custom Flows, adding approval gates where necessary, and expanding gradually while monitoring credit usage and automation quality.

Read original(opens in new tab)
gitlab2 min readCurated summary

Transform MRs from manual tasks to an automated workflow

GitLab 19.0 expands Developer Flow from generating merge requests to managing much of their entire lifecycle. Its AI agent can respond to reviews, investigate codebases, resolve conflicts, and split oversized MRs, while automation handles rebasing and merging. The result is less manual effort between opening and merging an MR, with developers supervising rather than executing every step. ## Developer Flow Across the MR Lifecycle - Can be triggered from: - An issue via **Generate MR** - An issue or MR assigned to the **Duo Developer** service account - Any issue or MR discussion using the new **@mention** trigger - Continues working on the same MR instead of creating separate changes to reconcile. - Handles: - Multiple rounds of reviewer feedback - Merge conflicts on long-running branches - Codebase research and technical evaluations - Oversized MR splitting - New feature implementation - Uses a single agentic loop with tools such as `read`, `grep`, file editing, and command execution. - Reads `AGENTS.md` for project conventions and operational guidance. - Uses `agent-config.yml` to configure dependencies, tooling, tests, and pre-commit hooks. These capabilities are available through GitLab Duo Agent Platform on Premium and Ultimate plans. ## Autonomous Merge Conflict Resolution - The beta **Resolve with Duo** button is available on the MR conflict page and merge checks widget. - The agent: - Reviews the MR’s intent and both branches - Selects a resolution strategy - Edits conflicting files - Commits and pushes the resolution - It leaves a summary comment explaining the conflict and resolution path. - If it cannot resolve the conflict safely, it reports that rather than guessing. ## One-Click Rebase and Merge - The beta feature combines rebasing and merging into one action. - It is designed for teams using semi-linear or fast-forward merge methods. - It is available on Free, Premium, and Ultimate tiers. ## Reducing Manual MR Work GitLab distinguishes between AI-driven judgment and mechanical automation: - AI handles code changes, reviewer feedback, and conflict resolution. - Automation handles tasks such as rebasing before merge. - Together, these features reduce the time developers spend on repetitive MR maintenance while preserving human oversight for steering, reviewing, and final decisions. Developers can try Developer Flow through a GitLab Duo Agent Platform trial. Existing Premium and Ultimate users with the platform can use it on merge requests, while older GitLab versions may require manually configuring the mention trigger.

Read original(opens in new tab)
gitlab2 min readCurated summary

Teaching software development the easy way using GitLab

GitLab for Education can turn the administrative work of teaching software development into a scalable, professional workflow. University of Washington lecturer Stephen G. Dame uses GitLab groups, controlled permissions, merge requests, and inline comments to distribute materials, protect solutions, and provide contextual feedback. The approach helps students build real-world version-control and code-review habits while reducing instructor overhead. ## Building a Course Structure with Groups - Dame organizes the university in a root group such as `UWTeaching`, with one subgroup per course, such as `css430`. - Course subgroups contain: - Private lecture materials and code repositories - Student subgroups - Grader subgroups - Permissions inherit through the hierarchy, allowing instructors to control access centrally. - Students receive Reporter access with an expiration date tied to the academic quarter. - They can clone and pull assignment repositories but cannot push to instructor-controlled repositories. - Students use SSH keys across local machines, cloud shells, and virtual machines, then copy code into private repositories for their own version history. ## Automating Enrollment for Large Classes - Manually creating student accounts and permissions becomes impractical for large cohorts. - GitLab’s REST API can automate: - Creating personal subgroups for students - Looking up GitLab users - Assigning Reporter permissions - Setting membership expiration dates - GitLab also provides an open source class-management project with additional automation tools. ## Feedback Through Merge Requests - Students submit assignments by opening merge requests in their repositories. - Instructors immediately see a complete diff of the student’s work. - Comments can be attached directly to individual lines of code. - Inline feedback lets instructors explain both what is wrong and why, while directing students toward the next step. - Because feedback appears beside the relevant code, it is more actionable than comments on a separate document. ## Starting with GitLab for Education - The initial setup requires planning, but the workflow becomes largely self-sustaining once established. - GitLab for Education provides qualifying institutions with GitLab Ultimate features, including expanded storage, compute minutes, and merge-request capabilities. - Instructors are advised to begin with one course group, one assignment template, and a basic pipeline before expanding. A simple GitLab structure can make course administration more efficient while giving students practical experience with the collaborative development tools used in industry.

Read original(opens in new tab)
gitlab1 min readCurated summary

GitLab 18.11 release notes | GitLab Docs

Agentic SAST Vulnerability Resolution is now generally available in GitLab 18.11 through the GitLab Duo Agent Platform. It autonomously analyzes critical and high-severity SAST findings, proposes code fixes, and creates ready-to-review merge requests. The feature is designed to accelerate remediation while giving reviewers confidence assessments and the option to apply fixes directly from vulnerability details. ## Availability and Integration - Available with GitLab Ultimate. - Supported on GitLab.com, GitLab Self-Managed, and GitLab Dedicated. - Runs: - As part of a SAST scan - After SAST false-positive detection - Manually for individual SAST vulnerabilities ## Automated Vulnerability Analysis - Examines each finding and reasons through the surrounding code context. - Generates proposed fixes for critical and high-severity SAST vulnerabilities. - Automatically opens a merge request containing the remediation for review. ## Review and Remediation Workflow - Provides quality assessments to help reviewers evaluate the likely reliability of each proposed fix. - Lets users apply resolutions directly from vulnerability details pages. - Feedback is welcomed through GitLab issue 585626. ## Practical Recommendation Teams using GitLab Ultimate can enable the feature to streamline SAST remediation, while still reviewing agent-generated merge requests before merging changes.

Read original(opens in new tab)
gitlab2 min readCurated summary

GitLab 18.10 brings AI-native triage and remediation

GitLab 18.10 adds AI-powered security features designed to reduce vulnerability triage noise and speed remediation. GitLab Duo Agent Platform can assess whether SAST and secret-detection findings are likely false positives, explain its reasoning, and— for verified SAST issues—generate tested fixes in merge requests. These capabilities are available to GitLab Ultimate customers using the Duo Agent Platform, with some features still in beta. ## SAST False Positive Detection - Generally available for new critical and high-severity SAST findings. - Uses LLM-based agentic reasoning to assess whether a vulnerability is likely real or a false positive. - Adds: - A confidence score - An AI-generated explanation - A “Likely false positive” or “Likely real” badge - Findings can be filtered in the Vulnerability Report so teams can prioritize likely real vulnerabilities. - The assessment remains a recommendation that teams can review and audit. ## Agentic SAST Vulnerability Resolution - Currently in beta. - For findings judged unlikely to be false positives, the agent: - Reads the vulnerable code and its surrounding context - Generates a proposed fix - Validates the fix with automated tests - Opens a merge request for developer review - The merge request includes code changes, a confidence score, and an explanation of the remediation. - Developers should still carefully review AI-generated changes before merging. ## Secret False Positive Detection - Currently in beta. - Identifies likely test credentials, placeholder values, example tokens, and other dummy secrets. - Provides confidence scores, explanations, and visual badges in the Vulnerability Report. - Runs automatically on the default branch and can also be triggered manually with “Check for false positive.” - The goal is to help teams focus on exposed credentials that represent genuine risk. GitLab 18.10 extends AI assistance across the vulnerability lifecycle: filtering out misleading findings, explaining security assessments, and proposing validated code fixes. Teams using GitLab Ultimate and Duo Agent Platform can use these features to reduce review effort while retaining human control over security decisions and merges.

Read original(opens in new tab)
gitlab2 min readCurated summary

Agentic code reviews for $0.25 each

GitLab introduces Code Review Flow, an agentic AI review feature priced at a flat $0.25 per merge request. It automatically analyzes code, repository context, pipelines, security findings, and compliance requirements, producing structured inline feedback. The post argues that predictable pricing and parallel execution can reduce review costs and shorten merge queues. ## The Code Review Bottleneck - AI coding tools have increased development speed, but review capacity has not kept pace. - Code review times have reportedly risen 91% on teams using AI coding tools. - Engineers at large companies wait a median of 13 hours for pull requests to merge. - 44% of engineering teams identify slow reviews as their biggest delivery blocker. - Existing AI review tools often use unpredictable token-based pricing, with some costing $15–$25 per review. ## How Code Review Flow Works - It starts automatically when a merge request is opened. - The agent: - Scans the code changes. - Explores relevant repository context. - Checks pipeline status and results. - Reviews security findings and compliance requirements. - Produces structured inline comments. - Because it runs within GitLab, reviews can execute in parallel across projects and organizations rather than sequentially in individual developers’ environments. ## Flat-Rate Pricing and Savings - Each review costs 0.25 GitLab Credits, or $0.25 at list pricing. - The price is the same regardless of merge request size or complexity. - Four reviews cost one GitLab Credit, making usage easy to forecast. - Compared with an estimated $25 cost for 15 minutes of senior-engineer review time, GitLab claims a 99% reduction in per-review cost. - Parallel reviews can unblock merge requests within minutes instead of hours. ## Scaling Reviews Across Teams - The low fixed price makes it practical to run reviews on every merge request. - Teams can define project-specific review instructions and guardrails. - Different projects can use Code Review Flow, Claude Code, Codex, or custom agents. - Results remain visible in GitLab while reviews run concurrently. ## Availability - The $0.25 pricing is available on GitLab.com, Dedicated, and self-managed GitLab instances running version 18.8.4 or later. - Users can try GitLab Duo Agent Platform through a free trial or contact their GitLab account representative. The post recommends enabling automated reviews broadly rather than reserving them for high-priority changes, using AI to handle routine feedback while engineers focus on architecture, mentorship, and higher-value decisions.

Read original(opens in new tab)