What to Build

Pick one Path. Then build a project that fits one of three levels of autonomy.

Every project must use GitLab Duo Agent Platform features, such as agents, flows, or MCP clients. 

• Path A: Start Fresh
  Build a new AI-powered project on GitLab that shows agentic automation of the post-code lifecycle. You create the app, the CI/CD pipeline, and the automation from scratch. Your project must be new work, created for this hackathon. Deployment is optional. Deploy on Google Cloud to be eligible for up to 0.2 bonus points. Existing projects are not allowedd for this track. 

• Path B: Bring Your Own
  Take an existing MIT-licensed open-source project. It can be yours or a fork. Import it to GitLab, build the AI-powered post-code automation around it, and deploy it. You must build the automation and deploy the project on or after October 5th. Deploy anywhere. Deploy on Google Cloud to be eligible for up to 0.2 bonus points. Read the Official Rules for details.

Choose your level of autonomy

• Assisted: You approve every step. Your agents and flows propose actions and wait for your go-ahead before they proceed. You stay in the loop at every stage.

  • Example: An agent reviews your MR and flags a security vulnerability. It suggests a fix and waits for you to approve before committing. Then it runs the pipeline and waits for you to approve the deployment.

• Supervised: You approve the outcome, not the individual steps. Your agents execute a multi-step workflow on their own, clearing gates and making decisions along the way. You review the end result, not every individual action.

  • Example: You push code. Agents handle code review, fix a failing pipeline, remediate a security finding, and deploy to staging. You get a summary and approve the production deployment.

• Hands-off: You set the intent and walk away. A full loop from code to production with no human in the middle. You push code or create an issue, and the next time you check in, it's live.

  • Example: You create an issue. Agents review it, create 1+ MRs, run security scans, fix what they find, merge when everything passes, deploy to staging, validate, promote to production, and post a summary on the original issue. You touched nothing.

**The examples above are here to get you thinking. We expect submissions that go well beyond them.

Prizes for every level of autonomy. 

Cover as many lifecycle stages as you can

This is the heart of the challenge. Build automation that reaches across GitLab’s DevSecOps lifecycle, not just one corner of it. There are nine stages:

plan · create · verify · package · secure · release · configure · monitor · govern

You do not have to use every feature inside a stage. Touching the stage counts.

Prizes for the Most Stages Covered 

Bonus points for deploying on Google Cloud

Deployment is only a requirement for Path B. Deploy anywhere you like. Google Cloud is not required for either Path.

If you deploy on Google Cloud, your project is eligible for up to 0.2 bonus points. We add these points once, after judges score your project. The highest possible final score is 5.2.

To be eligible, you must:

• Include your Google Cloud deployment code in your public GitLab repository.

• Provide a link to your live project on Google Cloud. It must be public and available to judges.

See Resources Tab for how to get started on Google Cloud. Read the Official Rules for details.

What to Submit

1. Your project, built with the required technologies.

2. A text description of what your project does, the problem it solves, and how you used GitLab to automate the post-code lifecycle.

3. A public GitLab Project with all source code, assets, and instructions needed to run the project. It must include an MIT License file, visible at the top of the repository page in the About section. 

1. Visible CI/CD pipeline history showing your automation running.

4. A demo video under three minutes, uploaded to YouTube and publicly visible. Show your automation running. Do not include third-party trademarks or copyrighted music.