gitlab·Feb 17, 2026Original article

Claude Opus 4.6 now available in GitLab Duo Agent Platform (opens in new tab)

GitLab has integrated Anthropic’s Claude Opus 4.6 into its Duo Agent Platform, providing developers with a high-intelligence frontier model designed for complex agentic workflows. By combining a 1-million-token context window with native access to DevSecOps data, the update enables more autonomous task execution and deeper reasoning within the software development lifecycle. This integration allows teams to delegate multi-step tasks to AI agents that can now process entire codebases and project histories in a single interaction. ## Advanced Agentic Capabilities and Reasoning * Claude Opus 4.6 features enhanced "agentic" behavior, meaning it can proactively take actions and drive tasks forward with minimal human intervention. * The model supports multi-agent orchestration, allowing it to spin up subagents and coordinate parallel workstreams to solve complex, multi-step problems. * Adaptive thinking capabilities allow the model to calibrate its reasoning depth based on the query, using extended thinking for difficult tasks while maintaining speed for simpler ones. * Deep reasoning via test-time compute helps the model navigate challenging development bottlenecks and architectural decisions. ## Full-Context DevSecOps Integration * The model boasts a 1-million-token context window—a fivefold increase over Opus 4.5—enabling the processing of massive codebases and extensive documentation. * Integration with the GitLab Duo Agent Platform provides the model with direct access to repositories, merge requests, pipelines, and security findings. * Enterprise-grade security features, including human-in-the-loop controls and group-based access, ensure that agentic actions remain transparent and governed. * Native integration ensures developers can utilize these frontier capabilities without leaving their established GitLab workflows. ## Availability and Resource Consumption * Opus 4.6 is currently available for GitLab.com users via the Duo Agent Platform and Agentic Chat, though it is not supported for GitLab Duo Classic features. * Support for the model within various Integrated Development Environments (IDEs) is expected to be released in the near future. * Usage is managed via GitLab credits, with multipliers determined by the size of the prompt. * Prompts containing 200k tokens or fewer are charged at 1.2 requests per credit, while larger prompts exceeding 200k tokens are charged at 0.7 requests per credit. Organizations aiming to automate complex development workstreams should migrate their specialized agents to Claude Opus 4.6 to take advantage of its superior orchestration and context handling. By leveraging the model's ability to coordinate parallel subagents, teams can significantly reduce the manual effort required for codebase-wide refactors and security remediation.

Database DesignMachine LearningGitlabDevSecOps+3

gitlab·Feb 10, 2026Original article

DevSecOps-as-a-Service on Oracle Cloud Infrastructure by Data Intensity (opens in new tab)

Data Intensity’s DevSecOps-as-a-Service provides a solution for organizations that require the granular control of GitLab Self-Managed but wish to eliminate the operational burden of infrastructure maintenance. By hosting dedicated GitLab instances on Oracle Cloud Infrastructure (OCI), the service combines the security and customization of a self-managed environment with the convenience of a fully managed platform. This partnership enables teams to focus on software delivery while leveraging expert management for high availability and disaster recovery. ### The Benefits of GitLab Self-Managed * Offers complete ownership of data residency and instance configuration to meet strict regulatory and compliance requirements. * Enables deep customization and integration possibilities that are often restricted in standard SaaS environments. * Addresses the challenges of manual server management, upgrades, and high-availability scaling by offloading these tasks to a managed provider. ### Managed Service Features and Support * Provides 24/7 monitoring, alarming, and expert technical support for standalone GitLab instances. * Includes scheduled quarterly patching performed during customer-specified maintenance windows to minimize disruption. * Ensures business continuity through automated backups and professional disaster recovery protection. * Utilizes tiered architectures designed to scale based on specific user capacities and recovery time objectives. ### Infrastructure Optimization via OCI * Delivers significant cost efficiency, with organizations typically realizing 40-50% reductions in infrastructure spending compared to other hyperscalers. * Supports diverse deployment models, including Public Cloud, Government Cloud, EU Sovereign Clouds, and dedicated infrastructure behind a corporate firewall. * Maintains consistent pricing and operational tooling across hybrid, global, and regulated environments. ### Implementation and Migration * Data Intensity offers optional migration services to transition existing code repositories and configurations to the OCI environment seamlessly. * The service is specifically designed for organizations with predictable cost requirements and those lacking in-house infrastructure expertise. * Deployment planning involves tailored consultations to match specific compliance and data residency needs with OCI’s global region availability. This managed service is a recommended path for enterprise teams that need to prioritize data sovereignty and flexibility without sacrificing the speed of a turnkey solution. Organizations currently using or planning to adopt OCI can leverage this service to standardize their DevSecOps workflows while achieving significant infrastructure savings.

GitlabDevSecOpsCloud InfrastructureDisaster Recovery+4

gitlab·Feb 2, 2026Original article

What’s new in Git 2.53.0? (opens in new tab)

Git 2.53.0 introduces significant performance and maintenance improvements, specifically targeting large repositories and complex history rewriting workflows. Key updates include compatibility between geometric repacking and partial clones, as well as more granular control over commit signatures during imports. These enhancements collectively move Git toward more efficient repository management and better data integrity for modern development environments. ## Geometric Repacking Support with Promisor Remotes * Git utilizes repacking to consolidate loose objects into packfiles, with the "geometric" strategy maintaining a size-based progression to minimize the computational overhead found in "all-into-one" repacks. * Previously, geometric repacking was incompatible with partial clones because it could not correctly identify or manage "promisor" packfiles, which contain the metadata for objects expected to be backfilled from a remote. * The 2.53.0 release enables geometric repacking to process promisor packfiles separately, preserving the promisor marker and preventing the tool from crashing when used within a partial clone repository. * This fix removes a major blocker for making the geometric strategy the default repacking method for all Git repositories. ## Preserving Valid Signatures in git-fast-import(1) * The `git-fast-import` tool, a backend for high-volume data ingestion and history rewriting, previously lacked the nuance to handle commit signatures during partial repository edits. * A new `strip-if-invalid` mode has been added to the `--signed-commits` option to solve the "all-or-nothing" problem where users had to choose between keeping broken signatures or stripping valid ones. * This feature allows Git to automatically detect which signatures remain valid after a rewrite and only strip those that no longer match their modified commits. * This provides a foundation for tools like `git-filter-repo` to preserve the chain of trust for unchanged commits during migration or cleaning operations. ## Expanded Data in git-repo-structure * The `structure` subcommand of `git-repo`, intended as a native alternative to the `git-sizer` utility, now provides deeper insights into repository scaling. * The command now reports the total inflated size and actual disk size of all reachable objects, categorized by type: commits, trees, blobs, and tags. * These metrics are essential for administrators managing massive repositories, as they help identify which object types are driving disk consumption and impacting performance. These updates reflect Git’s continued focus on scalability and developer experience, particularly for organizations managing massive codebases. Users of partial clones and repository migration tools should consider upgrading to 2.53.0 to leverage the improved repacking logic and more sophisticated signature handling.

Database DesignOpen SourceGitGit Fast Import+3

gitlab·Jan 27, 2026Original article

How to set up GitLab SAML SSO with Google Workspace (opens in new tab)

Organizations using GitLab.com SaaS can streamline access control by integrating SAML-based Single Sign-On (SSO) with Google Workspace. This setup enables automated user provisioning and dynamic permission management by mapping Google Workspace groups directly to GitLab roles. The result is a centralized security model that reduces manual administrative tasks while ensuring users have immediate, secure access to the platform. ### Prerequisites and Architectural Benefits * The integration requires a GitLab Premium or Ultimate subscription and Super Admin access to Google Workspace. * Once configured, the authentication flow redirects users to Google for credentials, after which Google sends a SAML assertion to GitLab containing user details and group memberships. * The system supports "Just-in-Time" provisioning, meaning GitLab accounts are created automatically upon a user's first successful login. * Permissions are dynamic; GitLab updates group memberships and roles every time a user signs in to reflect their current status in Google Workspace. ### Gathering GitLab Configuration Details * Configuration must be performed at the GitLab top-level group rather than within individual subgroups. * Administrators need to retrieve the Assertion Consumer Service (ACS) URL, which typically follows the format `https://gitlab.com/groups/[your-group]/-/saml/callback`. * The Identifier (Entity ID) must be copied to uniquely identify the GitLab group within the Google identity provider settings. * The GitLab SSO URL is the specific entry point users will utilize to initiate the authentication process. ### Configuring the Google Workspace SAML Application * Within the Google Admin Console, administrators must create a "Custom SAML app" to house the integration settings. * The setup process provides a Google SSO URL and a certificate file (typically a `.pem` format) that must be saved for the GitLab-side configuration. * The previously gathered GitLab ACS URL and Entity ID are entered into the Service Provider details section of the Google app configuration. ### Mapping User Attributes and Synchronizing Groups * Specific attribute mapping is required to ensure user data flows correctly: Google’s "Primary Email" should map to the "NameID," "First Name" to "firstName," and "Last Name" to "lastName." * For group synchronization to function, administrators must map selected Google Groups to an app attribute named exactly `groups` (lowercase). * Google allows for the synchronization of up to 75 groups, which GitLab uses to determine and update user permissions upon login. * The application must be explicitly turned "ON" for specific organizational units or the entire domain within the Google Admin Console to allow user access. ### Finalizing the Identity Provider Connection * GitLab requires a SHA-1 certificate fingerprint for security verification rather than the raw certificate file provided by Google. * Administrators must convert the downloaded Google `.pem` certificate into a SHA-1 fingerprint using an online conversion tool or a command-line utility. * This fingerprint, along with the Google SSO URL, is entered into GitLab’s SAML SSO settings to establish the trusted connection between the two platforms. To ensure a smooth rollout, it is recommended to test the integration with a small group of users before enforcing SAML for the entire organization. This allows administrators to verify that group-based permissions are mapping correctly to GitLab roles without disrupting existing workflows.

GitlabSecurityAuthenticationGoogle Workspace+3

gitlab·Jan 20, 2026Original article

GitLab Bug Bounty Program policy updates (opens in new tab)

GitLab has updated its HackerOne Bug Bounty program policies to improve transparency and streamline the reporting process for security researchers. These changes emphasize a shift toward local testing environments and provide much-needed clarity on the scope of emerging threats like AI prompt injection and denial-of-service attacks. By refining these guidelines, GitLab aims to protect its production infrastructure while ensuring researchers have clear, objective criteria for submitting high-impact vulnerabilities. ### Enhanced Testing Guidance * GitLab now strongly recommends using the GitLab Development Kit (GDK) for local testing, allowing researchers to experiment with cutting-edge features without risking production stability. * Researchers investigating potential Denial-of-Service (DoS) impacts are advised to use self-managed GitLab instances that meet or exceed standard installation requirements. * Any testing performed on GitLab.com production architecture must utilize test accounts created specifically with the `@wearehackerone.com` email alias. ### Refined Vulnerability Scope * Denial-of-Service (DoS) is generally classified as out of scope, though exceptions exist for application-layer vulnerabilities—such as ReDoS or logic bombs—that cause persistent service disruption via unauthenticated endpoints. * Standalone prompt injection is no longer eligible for bounties unless it serves as a primary vector to achieve security breaches beyond the initial AI boundary. * The policy clarifies the distinction between metadata enumeration and privacy breaches, noting that general information gathering remains out of scope while exposure of confidential data is strictly in scope. ### Transition and Grace Period * To support researchers with ongoing investigations, GitLab is honoring a seven-day grace period for DoS reports submitted before January 22, 2026 (9:00 p.m. PT). * Reports submitted during this window will be evaluated under the previous policy to ensure fairness and maintain trust within the researcher community. Security researchers should immediately update their testing workflows by downloading the GitLab Development Kit and reviewing the updated CVSS calculator on the HackerOne program page to ensure their findings align with the new severity standards.

GitlabDevSecOpsBug BountyHackerone+3

gitlab·Jan 15, 2026Original article

Introducing GitLab Credits (opens in new tab)

GitLab is transitioning from seat-based pricing to a usage-based model with the introduction of GitLab Credits, a virtual currency designed for the GitLab Duo Agent Platform. This shift addresses the limitations of traditional licensing, which often creates "AI haves and have-nots" by making access too expensive for light or occasional users. By pooling resources across an entire organization, GitLab aims to provide equitable access to agentic AI for every developer while ensuring costs align with actual consumption. ## The Shift from Seat-Based to Usage-Based AI * Traditional seat-based models are poorly suited for agentic AI, which can be triggered by background SDLC events rather than just direct user interaction. * The credit model allows every member of a Premium or Ultimate organization to use AI capabilities without requiring an individual "AI seat." * Usage-based pricing automatically offsets the costs of power users against lighter users, lowering the total cost of ownership for the organization. ## Mechanics of GitLab Credits * Credits function as a pooled resource consumed by both synchronous interactions (like Agentic Chat in the IDE) and asynchronous background tasks. * Supported capabilities include foundational agents (Security, Planner, Data Analyst) and specific workflows such as Code Review and CI/CD pipeline fixing. * The system integrates with external models like Anthropic Claude Code and OpenAI Codex, as well as custom agents published in the GitLab AI Catalog. * Each credit has an on-demand list price of $1, with volume discounts available for enterprise customers who sign up for annual commitments. ## Governance and Usage Controls * Administrators can monitor consumption through two dedicated dashboards: a financial oversight portal for billing managers and an operational monitoring view for administrators. * Granular controls allow organizations to enable or disable Duo Agent Platform access for specific teams or projects to prevent unexpected credit depletion. * Proactive email alerts are triggered when consumption reaches 50%, 80%, and 100% of committed monthly credits. * A sizing calculator is available to help organizations estimate their monthly credit requirements based on patterns observed during the platform's beta period. ## Transitioning and Promotional Access * Existing GitLab Duo Pro and Duo Enterprise customers can roll over their current seat investments into GitLab Credits with volume-based discounts. * As part of a limited-time promotion, GitLab is providing $12 in monthly credits per user for Premium subscribers and $24 per user for Ultimate subscribers. * Self-managed and GitLab Dedicated customers will gain access to these credit-based features starting with the 18.8 and 18.9 releases. For organizations looking to scale AI across the software development lifecycle, the credit-based model offers a more flexible and cost-effective path than rigid seat licenses. Current Premium and Ultimate subscribers should leverage their monthly promotional credits to baseline their usage before committing to larger annual credit bundles.

AI AgentsMachine LearningGitlab DuoGitlab Credits+4

gitlab·Jan 15, 2026Original article

Announcing general availability for GitLab Duo Agent Platform (opens in new tab)

The GitLab Duo Agent Platform has reached general availability, marking a shift from basic AI code assistance to comprehensive agentic automation across the entire software development lifecycle. By orchestrating intelligent agents to handle complex tasks like security analysis and planning, the platform aims to resolve the "AI paradox" where faster code generation often creates downstream bottlenecks in review and deployment. ### Usage-Based Economy via GitLab Credits * GitLab is introducing "GitLab Credits," a virtual currency used to power the platform’s usage-based AI features. * Premium and Ultimate subscribers receive monthly credits ($12 and $24 respectively) at no additional cost to facilitate immediate adoption. * Organizations can manage a shared pool of credits or opt for on-demand monthly billing, with existing Duo Enterprise contracts eligible for conversion into credits. ### Agentic Chat and Contextual Orchestration * The Duo Agentic Chat provides a unified experience across the GitLab Web UI and various IDEs, including VS Code, JetBrains, Cursor, and Windsurf. * The chat utilizes multi-step reasoning to perform actions autonomously, drawing from the context of issues, merge requests, pipelines, and security findings. * Capabilities extend beyond code generation to include infrastructure-as-code (IaC) creation, pipeline troubleshooting, and explaining vulnerability reachability. ### Specialized Foundational and Custom Agents * **Foundational Agents:** Pre-built specialists designed for specific roles, such as the Planner Agent for breaking down work and the Security Analyst Agent for triaging vulnerabilities. * **Custom Agents:** Developed through a central AI Catalog, these allow teams to build and share agents that adhere to organization-specific engineering standards and guardrails. * **External Agents:** Native integration of third-party AI tools, such as Anthropic’s Claude Code and OpenAI’s Codex CLI, provides access to external LLM capabilities within the governed GitLab environment. ### Automated End-to-End Flows * The platform introduces "Flows," which are multi-step agentic sequences designed to automate repeatable transitions in the development cycle. * The "Issue to Merge Request" flow builds structured code changes directly from defined requirements to jumpstart development. * Specialized CI/CD flows help teams modernize pipeline configurations and automatically analyze and suggest fixes for failed pipeline runs. * The Code Review flow streamlines the feedback loop by providing AI-native analysis of merge request comments and code changes. To maximize the impact of agentic AI, organizations should move beyond basic chat interactions and begin integrating these specialized agents into their broader orchestration workflows to eliminate manual handoffs between planning, coding, and security.

Database DesignAI AgentsCI/CDGitlab+4

gitlab·Jan 14, 2026Original article

Understanding agents: Foundational, custom, and external (opens in new tab)

The GitLab Duo Agent Platform provides a tiered framework for integrating AI into the software development lifecycle through foundational, custom, and external agents. By combining built-in expertise with the ability to define bespoke behaviors or connect to specialized external models, the platform enables teams to automate complex tasks ranging from product planning to runtime debugging. This structured approach ensures that AI assistance is deeply integrated into GitLab’s ecosystem while remaining flexible enough to meet specific organizational standards. ## Foundational Agents These are pre-configured, GitLab-maintained agents available immediately in the IDE or Web UI for general and specialized SDLC tasks. * **GitLab Duo:** The primary general-purpose partner for code modification, merge request management, and issue triaging within the full platform context. * **Planner Agent:** Specifically designed to assist with product management by breaking down epics into structured issues and generating acceptance criteria. * **Security Analyst Agent:** Focuses on triaging vulnerabilities, identifying false positives from scans, and prioritizing risks based on actual impact. * **Data Analyst Agent:** Leverages GitLab Query Language (GLQL) to visualize platform data, such as merge request trends, team workloads, and issue resolution times. ## Custom Agents Organizations can create specialized agents tailored to internal workflows by defining unique system prompts and visibility settings. * **Configuration and Control:** Custom agents are defined by a system prompt that dictates their persona and expertise—such as a DevOps agent that correlates static code data with CI/CD logs. * **Visibility Tiers:** Agents can be set to "Private" for use within a specific project or "Public" to be listed in the AI Catalog for broader organizational discovery. * **Operational Use Cases:** Common implementations include onboarding assistants for company-specific practices, compliance monitors for regulatory requirements, and localized support agents for non-English languages. * **Deployment Best Practices:** It is recommended to start with read-only permissions and highly specific constraints before granting agents write access to the repository or platform. ## External Agents External agents operate asynchronously and are triggered by mentions or assignments within issues and merge requests, rather than through interactive chat. * **Asynchronous Automation:** These agents, such as Anthropic Claude or OpenAI Codex, execute tasks in the background when triggered by commands like `@ai-codex`. * **Managed Credentials:** GitLab handles API key management and rotation for these integrations, simplifying the security overhead for teams using third-party models. * **Specialized Performance:** External agents allow teams to leverage provider-specific strengths, such as Claude’s code analysis or Codex’s task delegation, while maintaining compliance with specific data residency requirements. * **Integrated Review:** A typical workflow involves assigning an external agent as a reviewer on a merge request, where it automatically analyzes code quality and posts improvement suggestions directly as comments. To maximize the value of the platform, teams should begin by leveraging foundational agents for immediate productivity gains before developing custom agents that encode specific organizational knowledge. External agents should be reserved for specialized automation tasks or when specific third-party large language models (LLMs) are required for compliance or advanced code generation.

Database DesignMachine LearningCI/CDGitlab Duo+4

gitlab·Jan 14, 2026Original article

Introduction to GitLab Duo Agent Platform (opens in new tab)

GitLab Duo Agent Platform introduces an AI orchestration layer designed to move beyond simple code generation into full software development lifecycle (SDLC) automation. By utilizing specialized agents and asynchronous flows, the platform enables teams to delegate complex tasks like code reviews and pipeline fixes to AI "team members" who possess full context of the project. This transition from linear workflows to multi-agent collaboration allows developers to maintain oversight through detailed session logs while focusing on high-level innovation. ### Core Functionality and SDLC Context * The platform acts as an orchestration layer that enables asynchronous collaboration between human developers and specialized AI agents. * It utilizes deep SDLC context, pulling data from issues, epics, merge requests, CI/CD logs, wikis, and security scans to inform AI actions. * Automation is designed to understand and adhere to specific organizational standards, practices, and compliance requirements. ### Agent Interaction and Interface Methods * **GitLab Duo Agentic Chat:** Provides a real-time, synchronous interface via a persistent panel in both the GitLab Web UI and supported IDEs. * **Triggered Foundational Flows:** Users can invoke pre-built GitLab workflows, such as "Fix CI/CD Pipeline" or "Convert Jenkins to GitLab CI/CD," directly within the platform. * **Custom and External Flows:** Automated workflows can be triggered asynchronously by @mentioning agents or assigning reviewers in issue and merge request comments. * **External Agent Support:** The platform supports third-party models like Claude Code and OpenAI Codex, executing them on GitLab platform compute via runner execution. ### Distinguishing Agents from Flows * **Agents:** These are specialized assistants defined by unique system prompts and toolsets; they are best suited for interactive tasks and instant feedback within the chat interface. * **Flows:** These are autonomous, multi-step workflows designed for complex background tasks, such as multi-file refactoring or event-driven automation. * **Execution Environment:** While agents are interactive, flows run asynchronously on platform compute, triggered by specific GitLab events or user assignments. ### Platform Management and Transparency * **AI Catalog:** A centralized library for discovering, creating, and sharing custom agents and flows across an entire organization. * **Automate Hub:** A management center used to configure triggers, monitor active flows, and manage agent permissions. * *Sessions:** Every interaction creates a session log that provides a transparent "decision trail," including agent reasoning, tool calls, and pipeline execution status. * **Model Selection:** Starting with GitLab 18.4, users can select specific foundational models for their conversations within the Web UI to better suit the task at hand. Teams looking to implement the GitLab Duo Agent Platform should begin by utilizing foundational flows for common tasks like pipeline debugging before moving toward custom agent creation. Reviewing the transparency logs in the "Sessions" view is highly recommended to refine agent prompts and ensure that automated actions align with internal development standards.

Gitlab Duo Agent PlatformDeveloper ToolsEvent Driven AutomationGitlab Ci Cd+4

gitlab·Jan 14, 2026Original article

Getting started with GitLab Duo Agentic Chat (opens in new tab)

GitLab Duo Agentic Chat marks a shift from traditional Q&A chatbots to autonomous AI collaboration partners integrated directly into the software development lifecycle. By leveraging specialized agents and context-aware large language models, the platform enables developers to automate complex tasks like code refactoring, security remediation, and issue triaging. This system serves as a centralized interface across both the GitLab Web UI and IDEs to streamline workflows from initial planning to production deployment. ## Capabilities of Agentic AI * **Autonomous Actions:** The system can move beyond simple chat by creating files, modifying existing code, and opening merge requests on behalf of the user. * **Deep Context Integration:** Agents have access to the full GitLab ecosystem, including issues, epics, Git commits, CI/CD pipelines, and security scans. * **Extensibility:** Through the Model Context Protocol (MCP), the chat can integrate with external services to expand its functional scope. * **Information Retrieval:** Users can query project architecture or use GitLab Query Language (GLQL) to pull specific project analytics and insights. ## Model and Agent Customization * **Flexible Model Selection:** Users and administrators can choose from different LLMs based on task requirements, with configuration available at both the group and individual user levels. * **Specialized Agents:** The platform features dedicated agents for specific roles, such as the **Planner Agent** for product management and the **Security Analyst Agent** for vulnerability management. * **Contextual Switching:** In IDEs, users can switch between agents via a dropdown menu, while the Web UI allows for agent selection when starting new chat sessions. ## Specialized Workflow Use Cases * **Project Planning:** The Planner Agent can break down epics into smaller tasks, list high-priority bugs, and generate technical requirements for new features. * **Security Remediation:** Security-focused agents can explain vulnerabilities in simple terms, identify false positives in scans, and suggest specific code fixes for SQL injection or XSS risks. * **Troubleshooting and Debugging:** The system can analyze CI/CD pipeline logs to identify why a build failed and suggest optimizations for job performance. * **Legacy Modernization:** Specific prompts can guide the AI to refactor code to follow SOLID principles or create migration plans for modernizing legacy languages like COBOL to Java or Python. ## Access and Integration * **Interface Options:** The chat is accessible via a collapsible sidebar in the Web UI and through dedicated plugins in popular IDEs. * **Future Development:** While currently limited to UI and IDE interfaces, a GitLab Duo CLI is in development to bring agentic capabilities to the terminal. To get the most out of GitLab Duo Agentic Chat, it is recommended to transition between specialized agents as you move through different project phases. Using the Security Analyst for code reviews and the Planner for backlog grooming ensures that the underlying models are optimized for the specific metadata and constraints of those tasks.

Database DesignAI AgentsCI/CDGitlab+4

gitlab·Jan 14, 2026Original article

How to customize GitLab Duo Agent Platform (opens in new tab)

The GitLab Duo Agent Platform provides a multi-layered framework for customizing AI behavior to align with specific team workflows and coding standards. By leveraging configuration files at the user, workspace, and project levels, teams can ensure that AI-driven assistance remains context-aware and adheres to internal development policies. This extensibility allows organizations to move from generic AI interactions to highly specialized automation that respects unique architectural patterns and security requirements. ### Levels of Customization GitLab offers a hierarchical approach to tailoring agent behavior, ensuring the right balance between global consistency and project-specific flexibility: * **User-level:** Personal preferences and rules applied across all projects, typically stored in the user’s home directory (e.g., `~/.gitlab/duo/`). * **Workspace-level:** Project-specific configurations located in the repository root that override user-level settings for that specific codebase. * **Project-level:** The creation of entirely custom agents and workflows managed within a specific project to handle complex, specialized tasks. ### Custom Rule Configuration Custom rules provide a mechanism to enforce specific coding styles and instructional sets without repeating prompts in every interaction. * **File implementation:** Rules are defined in `chat-rules.md` files located either in the user's home directory for global application or within the `.gitlab/duo/` directory for project-specific application. * **Functional scope:** They are best used for granular instructions such as forcing the use of the Vue 3 Composition API, requiring JSDoc comments for public functions, or mandating single quotes for strings. * **Governance:** Teams are encouraged to use GitLab Code Owners to manage who can approve changes to these rules, ensuring that AI behavior remains aligned with official team standards. ### Architectural Control with AGENTS.md The platform supports `AGENTS.md`, an industry-standard configuration file used to define broader agent personality, tone, and deep repository context. * **Versatility:** Unlike basic rules, `AGENTS.md` is consumed by both foundational and custom flows and can be understood by external agents like Claude Code. * **Contextual Depth:** These files can be placed in subdirectories to provide specific instructions for different parts of a monorepo, helping the agent understand complex folder structures and internal dependencies. * **Key Parameters:** It typically controls high-level preferences such as security protocols (e.g., "never suggest hardcoding secrets"), documentation requirements, and preferred tool usage. ### Technical Requirements and Deployment Implementing these customizations requires specific environment versions to ensure compatibility across the GitLab ecosystem. * **GitLab Version:** Requires GitLab 18.8 or later. * **IDE Support:** For VS Code users, the GitLab Workflow extension must be version 6.60 or later. * **Update Cycle:** Changes to `AGENTS.md` or custom rules generally require starting a new chat session or triggering a new flow to take effect. To achieve the best results, teams should adopt a "standardize-then-specialize" approach: establish global security and documentation rules at the user level, while using workspace-level `AGENTS.md` files to define the unique architectural patterns and tech stacks of individual projects.

Database DesignMachine LearningTypeScriptGitlab Duo+4

gitlab·Jan 14, 2026Original article

Get started with GitLab Duo Agent Platform: The complete guide (opens in new tab)

The GitLab Duo Agent Platform represents a shift in AI-assisted development by moving from individual chat-based interactions to a collaborative multi-agent orchestration layer. By integrating specialized AI agents throughout the software development lifecycle, the platform transforms linear DevSecOps workflows into parallel processes that leverage full project context for tasks like security scanning and code refactoring. This architecture allows development teams to delegate routine technical burdens to autonomous agents, focusing human efforts on high-level innovation and complex problem-solving. ### Orchestrating the DevSecOps Lifecycle The platform functions as a central intelligence layer that connects AI agents to the broader GitLab ecosystem. * Agents access comprehensive project context, including source code management, CI/CD pipelines, issue tracking, and security scan results. * Specialized agents can be assigned to specific technical domains such as research, refactoring, and automated testing. * The system enables asynchronous collaboration, allowing multiple agents to work on different stages of a project simultaneously. ### Evolution from Duo Enterprise to Agentic AI The Duo Agent Platform is a superset of previous GitLab AI offerings, moving beyond simple 1:1 user-to-AI interactions. * GitLab Duo Pro focused on individual IDE productivity through code suggestions and basic chat. * GitLab Duo Enterprise expanded AI to the wider software lifecycle but remained primarily a 1:1 Q&A experience. * The Agent Platform introduces a many-to-many collaboration model where teams and multiple specialized agents interact autonomously to handle production-ready workflows. ### Advanced Integration and Customization To support enterprise-grade automation, the platform provides a roadmap for scaling AI from basic interactions to production environments. * Integration with the Model Context Protocol (MCP) allows for expanded data access and agent capabilities. * The platform supports a progression from initial agent interactions to full workflow customization and production-ready automation. * Developers can leverage the eight-part guide series to move from foundational concepts to advanced technical implementations. To maximize the benefits of agentic AI, organizations should transition from viewing AI as a simple Q&A tool to treating it as an orchestration layer. Teams are encouraged to explore the complete introductory series to begin delegating routine maintenance and security tasks to specialized agents, thereby accelerating overall delivery speed.

Machine LearningCI/CDGitlabDevSecOps+3

gitlab·Jan 14, 2026Original article

Monitor, manage, and automate AI workflows (opens in new tab)

The GitLab Duo Agent Platform’s Automate capabilities provide a centralized framework for managing, executing, and monitoring AI-driven development workflows within the software development lifecycle. By integrating event-driven triggers and detailed session logging, the platform allows developers to transition from manual AI interactions to fully autonomous, production-ready processes. This orchestration layer ensures that AI agents are not only performant but also transparent and easy to audit across projects. ## Resource Management for Agents and Flows The Automate hub serves as the control center for organizing AI resources, distinguishing between agents (entities that perform tasks) and flows (structured sequences of actions). * Resources are categorized into "Enabled" (those available for project use) and "Managed" (those created and owned specifically by the project). * Custom agents and flows must be enabled at the top-level group before they can be activated for specific projects. * Users can expand their automation library by browsing and enabling pre-configured resources from the GitLab AI Catalog. ## Event-Driven Automation with Triggers Triggers allow AI agents to respond automatically to specific actions within the GitLab interface, eliminating the need for manual invocation. * Automation can be initiated through three primary event types: user mentions (e.g., `@agent-name`), issue/MR assignments, or reviewer assignments. * When a trigger is activated, the system identifies the associated flow, executes the agent, and posts the final results directly back to the relevant issue or merge request. * Common use cases include using the `/assign` quick action to trigger a CI/CD optimizer or a code explanation agent. ## Workflow Monitoring and Session Transparency The Sessions interface provides a detailed audit trail for every execution, offering visibility into the "black box" of AI decision-making. * The Activity tab tracks step-by-step reasoning, showing exactly which tools the agent used and the results of individual actions. * Execution statuses are monitored in real-time, with labels such as Running, Finished, Failed, or Input Required. * The Details tab provides deep technical context by linking directly to Runner job logs, including system messages and full tool invocation outputs. ## Practical Conclusion To maximize the utility of the GitLab Duo Agent Platform, teams should move beyond experimental chat prompts and begin configuring triggers for repetitive tasks like code review assignments or issue triaging. Utilizing the Sessions tool is recommended during the initial rollout phase to verify agent reasoning and ensure that custom flows are interacting correctly with project data before full-scale deployment.

Machine LearningGitlabDevSecOpsEvent Driven Automation+4

gitlab·Jan 14, 2026Original article

AI Catalog: Discover, create, and share agents and flows (opens in new tab)

The GitLab AI Catalog serves as a centralized repository designed to streamline the discovery, creation, and distribution of AI agents and automated flows across an organization. By providing a structured environment for managing foundational and custom AI assets, it fosters team collaboration and ensures consistency throughout the development lifecycle. Ultimately, the catalog enables developers to scale AI-driven automation from experimental private prototypes to production-ready, instance-wide solutions. ## Discovering and Enabling AI Assets * The catalog acts as a central hub for two distinct asset types: Agents, which handle on-demand or context-specific tasks, and Flows, which are multi-step automations that orchestrate multiple agents. * Users can browse assets via the Explore menu, inspecting titles, descriptions, and visibility statuses before implementation. * To utilize an asset, it must first be added to a top-level group via the "Enable in group" button and then activated within specific projects. * The duplication feature allows teams to copy existing agents or flows to serve as templates for further customization. ## Development and Configuration * Custom agents are built by defining specialized system prompts and configuring specific tool access, such as granting read-only permissions for code and merge requests. * Custom flows utilize a YAML-based structure to define complex behaviors, incorporating components like prompts, routers, and agent hierarchies. * New assets are typically assigned a unique display name (e.g., `ci-cd-optimizer`) and initially set to private visibility to allow for safe experimentation. * Effective creation requires thorough documentation of prerequisites, dependencies, and specific use cases to ensure the asset is maintainable by other team members. ## Managing Visibility and Sharing * Private visibility restricts access to project members with at least a Developer role or top-level group Owners, making it ideal for sensitive or team-specific workflows. * Public visibility allows anyone on the GitLab instance to view and enable the asset in their own projects. * Best practices for sharing include using descriptive, purpose-driven names like `security-code-review` rather than generic identifiers. * Organizations are encouraged to validate and test assets privately before moving them to public status to ensure they solve real problems and handle edge cases. ## Versioning and Lifecycle Management * GitLab employs automated semantic versioning (e.g., 1.1.0) where any change to a prompt or configuration triggers an immutable version update. * The platform uses "version pinning" to ensure stability; when an asset is enabled, projects remain on a fixed version rather than updating automatically. * Updates are strictly opt-in, requiring users to manually review changes and click an "Update" button to adopt the latest version. * Version history and current status can be monitored through the "About" section in the Automate menu for both agents and flows. To maximize the benefits of the AI Catalog, organizations should establish a clear transition path from private experimentation to public sharing. By leveraging version pinning and granular tool access, teams can safely integrate powerful AI automations into their development workflows while maintaining full control over environment stability and security.

Database DesignGitlabAgentsFlows+4

gitlab·Jan 14, 2026Original article

Understanding flows: Multi-agent workflows (opens in new tab)

The GitLab Duo Agent Platform introduces flows as a sophisticated orchestration layer that allows multiple specialized AI agents to collaborate on complex, multi-step developer workflows. Unlike standard interactive agents, flows are designed to work autonomously and asynchronously on GitLab’s platform compute, executing tasks ranging from initial requirement analysis to final merge request creation. This architecture enables teams to offload repetitive or high-compliance tasks to a background process that integrates directly with the existing GitLab ecosystem. ## Core Mechanics of Multi-Agent Flows * Flows function as event-driven systems triggered by specific actions such as @mentions, issue assignments, or being designated as a reviewer on a merge request. * Execution occurs on GitLab's platform compute, removing the need for users to maintain separate infrastructure for their automation logic. * While standard agents are interactive and synchronous, flows are designed to be autonomous, gathering context and making decisions across various project files and APIs without constant human intervention. * The system supports background processing, allowing developers to continue working on other tasks while the flow handles complex implementations or security audits. ## Foundational and Custom Flow Categories * Foundational flows are production-ready, general-purpose workflows maintained by GitLab and accessible through standard UI controls and IDE interfaces. * Custom flows are specialized workflows defined via YAML that allow teams to tailor AI behavior to unique organizational requirements, such as specific coding standards or regulatory compliance like PCI-DSS. * Custom flows utilize a YAML schema to define specific components, including "Routers" for logic steering and "Toolsets" that grant agents access to GitLab API functions. * Real-world applications for custom flows include automated security scanning, documentation generation, and complex dependency management across a project. ## Technical Configuration and Triggers * Flows are triggered through simple Git commands and UI actions, such as `/assign @flow-name` or `/assign_reviewer @flow-name`. * The configuration for a custom flow includes an "ambient" environment setting and defines specific `AgentComponents` that map to unique prompts and toolsets. * Toolsets provide agents with capabilities such as `get_repository_file`, `create_commit`, `create_merge_request`, and `blob_search`, enabling them to interact with the codebase programmatically. * YAML definitions also manage UI log events, allowing users to track agent progress through specific hooks like `on_tool_execution_success` or `on_agent_final_answer`. To maximize the value of the GitLab Duo Agent Platform, teams should identify repetitive compliance or boilerplate implementation tasks and codify them into custom flows. By defining precise prompts and toolsets within the YAML schema, organizations can ensure that AI-driven automation adheres to internal domain expertise and coding standards while maintaining a high level of transparency through integrated UI logging.

AI AgentsGitlabReactTypeScript+4