githubAug 11, 2026

From coder to orchestrator: How agents shift the role of a developer (opens in new tab)

AI agents can generate impressive one-prompt demos, but reliable software delivery requires more than isolated outputs. Developers increasingly need to design workflows that define how code is proposed, tested, reviewed, and shipped. The article argues that this shifts developers from primarily writing code to orchestrating agents within controlled, repeatable systems. ## From One-Off Prompts to Reliable Workflows - A single prompt can quickly produce a demo, such as a simple game. - Production development requires repeatable delivery with: - Appropriate context - Validation and testing - Security controls - Review processes - Clear permissions and handoffs - GitHub Copilot is presented as a control plane for connecting these parts. ## An Agentic Development Flow - Familiar repository events can trigger agent work, including: - Adding a label to an issue - Running a scheduled workflow - Starting a GitHub Actions process - The agent’s changes are captured in a pull request. - Deterministic checks then validate the work through: - Linting - Tests - Security scans - Build verification - CODEOWNERS, required reviews, and branch protection rules control what can be merged. - Agents handle ambiguous, context-heavy tasks, while predictable automation provides the safety boundary. - Developers decide: - What agents can access - How tasks are scoped - Where workflows hand off - When human judgment is required ## GitHub’s Implementation Options - Copilot cloud agent workflows support event-driven automations. - Copilot CLI can run AI-powered steps inside GitHub Actions. - Model Context Protocol (MCP) can extend agents with additional tools and external context. - These options represent different stages of building an agent-enabled development workflow. ## Starting Small - Teams should begin with one bounded, low-risk workflow. - Suitable examples include: - Issue triage - Synchronizing documentation and tests - Routine maintenance updates - The recommended approach is to integrate Copilot into existing development infrastructure rather than redesigning everything at once. Developers should treat AI agents as components within an engineered delivery system, not as replacements for that system. Start with a limited workflow, surround agent output with automated checks and review controls, and gradually expand as the process proves reliable.

security-scanningai-agentmodel-context-protocolgithub-copilot+4

gitlabJun 18, 2026

One vulnerability view: From scanner coverage to AI governance (opens in new tab)

GitLab 19.1 presents a unified approach to application security and AI governance. It lets organizations enforce third-party SARIF-compatible scanners across every project, centralize findings, and automate remediation. At the same time, new AI governance features record agent activity and require approval for sensitive actions, enabling faster development without sacrificing accountability. ## Enforcing Complete Scanner Coverage - Security scanners are often configured separately for each project, creating coverage gaps and policy drift. - GitLab 19.1 allows administrators to enforce third-party scanners across all projects. - SARIF-compatible scanner results flow into GitLab’s unified vulnerability view. - Findings use the same governance and remediation workflows as GitLab-native results. - GitLab Duo Agent Platform can: - Triage findings with SAST False Positive Detection. - Generate merge requests through Agentic SAST Vulnerability Resolution. - Automatically remediate third-party scanner findings before production. ## Improving Secret Detection - Secret detection now scans every commit on a newly created branch, rather than only the latest commit. - This helps identify credentials introduced in earlier commits. - Secret False Positive Detection, now generally available, provides: - A confidence score for each finding. - An explanation displayed in the vulnerability report. - Developers can focus on genuine exposures instead of test credentials, placeholders, and example tokens. ## Governing AI Agent Actions - AI coding agents can create merge requests, invoke tools, commit code, and modify projects. - GitLab’s AI audit event streaming beta records every agent action and sends it to existing audit log destinations. - Agent tool approval guardrails let administrators configure each tool to: - Run automatically. - Require human approval. - Remain blocked. - Sensitive operations, such as writing files or deleting resources, can therefore require explicit review. - Approval decisions are also recorded, creating an auditable history for incident response and compliance. ## Governed Autonomy GitLab’s overall goal is to combine autonomous development with enforceable controls. Organizations can prove scanner coverage, automate vulnerability remediation, restrict risky agent behavior, and review a complete audit trail of what agents did. The practical recommendation is to centralize scanner governance and configure approval requirements for high-impact AI actions, allowing agents to work quickly while keeping security and accountability under human control.

security-scanninggitlabdevsecopsvulnerability-management+4

githubJun 9, 2026

From one-off prompts to workflows: How to use custom agents in GitHub Copilot CLI (opens in new tab)

Custom agents in GitHub Copilot CLI turn repeated terminal tasks into reusable, consistent workflows. Defined as Markdown profiles in a repository, they encode team-specific expertise, tools, standards, and safety rules instead of relying on one-off prompts. This makes workflows easier to review, version, share, and reuse across the CLI, IDE, and GitHub. ## What Custom Agents Are - A custom agent is a specialized Copilot agent configured through a Markdown file. - Its profile specifies: - Role and area of expertise - Available tools - Required standards and procedures - Guardrails and expected output formats - Teams can tailor agents to requirements such as: - WCAG accessibility standards - Formatting and testing conventions - Security and privacy policies - Review and ownership requirements - Because profiles live in the repository, they can be versioned, reviewed, and shared like code. ## Creating and Using Agents in Copilot CLI - Invoke Copilot CLI from the terminal and use the `/agent` command to select an agent. - Store the profile in the repository’s `.github/agents` directory. - Agent files use YAML frontmatter and typically end in `.agent.md`, such as `accessibility.agent.md`. - The profile defines the agent’s name, description, model, tools, instructions, scope, and guardrails. - Copilot CLI is especially suitable for these agents because it can execute scripts, call APIs, inspect repositories, and work directly with command-line tooling. ## Automating Repeated Workflows Custom agents are most useful for recurring tasks that span the terminal, IDE, and pull requests. - A security audit agent can: - Run standard checks across repositories - Group findings by Critical, High, Medium, and Low severity - Produce a pull-request-ready checklist with owners and next steps - It can use tools such as `gitleaks`, `trivy`, `semgrep`, `gh`, `git`, and `jq`. - Agents should prefer existing repository configuration files, including `.semgrep.yml`, `.trivyignore`, and `.gitleaks.toml`. - Missing security tools should be reported as coverage gaps rather than replaced with invented results. - Instructions can require secrets to be redacted, inclusive terminology, and consistent date formats. - Ownership mappings can assign findings to teams based on affected paths, using `CODEOWNERS` when available or defined defaults otherwise. Custom agents provide a practical way to capture team expertise once and apply it consistently. Start by converting a repetitive, execution-heavy task into a narrowly scoped `.github/agents` profile with explicit tools, outputs, and safety rules.

security-scanningmarkdownyamlgithub-copilot-cli+4

gitlabMay 6, 2026

Claude Code and GitLab: Three workflows that ship (opens in new tab)

Claude Code accelerates coding, but writing code is only one part of shipping software. The post argues that GitLab complements Claude Code by handling CI/CD, security scanning, code review, approvals, and auditability. It presents three workflows: fixing bugs locally, enriching Claude with GitLab context through MCP, and using a Claude-powered external agent to resolve merge request feedback. ## The Gap Between Coding and Shipping - Agentic tools can quickly understand unfamiliar code, propose fixes, and scaffold features. - Faster code generation can leave teams with: - Larger bug backlogs - More pipeline failures - Accumulating security vulnerabilities - Bottlenecks in review and approval - GitLab manages the downstream software lifecycle after Claude Code produces a change. ## Prerequisites and Project Setup - Claude Code must be installed and configured. - A GitLab project containing bug reports and feature proposals is required, such as the Tanuki IoT Platform. - Optional workflows require: - The GitLab MCP Server - GitLab Duo Agent Platform with external agents - The example project uses CMake, Make, and GCC or Clang for C++ builds. - Developers clone the repository, launch `claude`, and can ask it to explain the project before making changes. ## Workflow One: Fix a C++ Bug and Ship It Through GitLab - The Arduino IoT Collector crashes when `/dev/ttyACM0` is unavailable. - The failure can be reproduced by building and running the application with CMake: - `cmake -S . -B build` - `cmake --build build` - `./build/arduino_iot_collector` - Claude Code examines `sensors/arduino-iot-collector/src/main.cpp` and identifies an uncaught `std::runtime_error`. - The recommended behavior is to log a clear configuration error and continue running instead of terminating. - After the fix, Claude Code can create a branch, commit the changes, and push them, or the developer can run the Git commands manually. - Opening a merge request triggers: - Build and test pipelines - Security scanning - GitLab Duo Code Review Flow - Checks against project style guides and custom review instructions ## Workflow Two: Add GitLab Context with MCP - Local repository files may not contain the full history behind a bug. - GitLab issues, debugging discussions, previous merge requests, and related fixes provide valuable software development lifecycle context. - The GitLab MCP Server connects Claude Code to this information. - It can be added over HTTP with a command such as: `claude mcp add --transport http GitLab https://gitlab.example.com/api/v4/mcp` - In a new Claude Code session, `/mcp` starts OAuth authentication through the browser. - Developers can verify the integration by asking Claude which GitLab MCP tools and server version are available. - MCP uses the developer’s existing GitLab identity: - It does not grant elevated permissions. - Claude can access only projects, issues, merge requests, and other data already visible to that user. ## Workflow Three: Resolve Review Feedback with an External Agent - The third workflow uses a Claude-powered external agent in GitLab Duo Agent Platform. - Rather than requiring a developer to manually interpret review comments, the agent can address code review feedback directly in the merge request. - This extends Claude Code’s implementation abilities into GitLab’s review and delivery workflow. ## Overall Recommendation Use Claude Code for investigation and implementation, then use GitLab to provide the context, automated validation, security checks, review, and approval process needed to ship those changes safely.

security-scanninggitlabcode-reviewclaude-code+4

gitlabApr 21, 2026

GitLab + Amazon: Platform orchestration on a trusted AI foundation (opens in new tab)

GitLab Duo Agent Platform and Amazon Bedrock combine GitLab’s software-lifecycle orchestration with AWS’s governed foundation-model infrastructure. Duo coordinates agents across planning, development, security, pipelines, and remediation, while Bedrock provides secure inference within AWS boundaries. The pairing aims to reduce shadow AI, fragmented tooling, unclear data flows, and unplanned cloud spending. ## The Enterprise AI Governance Problem - Teams often adopt unapproved AI tools, creating unknown prompt and code-data paths. - AI tooling and model choices become fragmented across developers and departments. - Security teams may lack control over logs, data residency, and access policies. - Existing AWS and Amazon Bedrock investments can be underused when teams rely on external point solutions. - The proposed division of responsibility is: - GitLab Duo Agent Platform: workflow and agent orchestration. - Amazon Bedrock: approved models and inference. - The organization: IAM, VPC, regional, security, and policy controls. ## GitLab Duo Agent Platform as the Control Plane - Duo provides specialized agents and flows that operate asynchronously across the software lifecycle. - Agents use shared GitLab context, including: - Issues - Merge requests - Pipelines - Security findings - It extends beyond a single conversational assistant by coordinating multiple agents across continuous workflows. - Potential tasks include planning, code development, merge-pipeline work, security scanning, and vulnerability remediation. ## Amazon Bedrock as the AI Foundation - Bedrock is a managed, serverless foundation-model layer operating within AWS. - Customer inputs and outputs are encrypted, not shared with model providers, and not used to train base models. - It supports compliance requirements including GDPR, HIPAA, and FedRAMP High. - Organizations can use native Bedrock models or import fine-tuned models through Custom Model Import. - Bedrock Guardrails can provide content filtering, hallucination detection, and sensitive-data protection. ## Deployment Options The core Duo capabilities remain consistent, but control and infrastructure ownership vary across three patterns: - **Self-hosted models with Amazon Bedrock** - Intended for GitLab Self-Managed deployments. - Uses a self-hosted AI Gateway. - Keeps inference traffic, prompts, logs, and lifecycle data within the organization’s AWS environment. - **GitLab-operated Bedrock models with GitLab-owned keys** - Intended for GitLab Self-Managed deployments. - Uses GitLab’s hosted AI Gateway. - GitLab operates the model layer while the deployment remains self-managed. - **GitLab.com with GitLab-operated Bedrock models** - Uses GitLab’s hosted AI Gateway and GitLab-owned keys. - Suits organizations that prefer the SaaS GitLab experience while using Bedrock-backed models. ## Practical Enterprise Uses - Platform teams can standardize models for code suggestions, security analysis, and pipeline remediation. - Centralized guardrails and logging reduce independent, unmanaged AI adoption. - Security agents can propose and validate fixes directly within GitLab. - Routing AI workloads through Bedrock helps organizations align usage with existing AWS agreements and spending commitments. The recommended approach is to treat GitLab Duo Agent Platform as the orchestration layer and Amazon Bedrock as the governed inference foundation, selecting the deployment model that matches the organization’s compliance, hosting, and control requirements.

security-scanninggitlabdevsecopsamazon-bedrock+4

gitlabMar 19, 2026

GitLab 18.10 brings AI-native triage and remediation (opens in new tab)

GitLab 18.10 adds AI-powered security features designed to reduce vulnerability triage noise and speed remediation. GitLab Duo Agent Platform can assess whether SAST and secret-detection findings are likely false positives, explain its reasoning, and— for verified SAST issues—generate tested fixes in merge requests. These capabilities are available to GitLab Ultimate customers using the Duo Agent Platform, with some features still in beta. ## SAST False Positive Detection - Generally available for new critical and high-severity SAST findings. - Uses LLM-based agentic reasoning to assess whether a vulnerability is likely real or a false positive. - Adds: - A confidence score - An AI-generated explanation - A “Likely false positive” or “Likely real” badge - Findings can be filtered in the Vulnerability Report so teams can prioritize likely real vulnerabilities. - The assessment remains a recommendation that teams can review and audit. ## Agentic SAST Vulnerability Resolution - Currently in beta. - For findings judged unlikely to be false positives, the agent: - Reads the vulnerable code and its surrounding context - Generates a proposed fix - Validates the fix with automated tests - Opens a merge request for developer review - The merge request includes code changes, a confidence score, and an explanation of the remediation. - Developers should still carefully review AI-generated changes before merging. ## Secret False Positive Detection - Currently in beta. - Identifies likely test credentials, placeholder values, example tokens, and other dummy secrets. - Provides confidence scores, explanations, and visual badges in the Vulnerability Report. - Runs automatically on the default branch and can also be triggered manually with “Check for false positive.” - The goal is to help teams focus on exposed credentials that represent genuine risk. GitLab 18.10 extends AI assistance across the vulnerability lifecycle: filtering out misleading findings, explaining security assessments, and proposing validated code fixes. Teams using GitLab Ultimate and Duo Agent Platform can use these features to reduce review effort while retaining human control over security decisions and merges.

security-scanninggitlabvulnerability-managementsast+4

gitlabMar 4, 2026

10 AI prompts to speed your team’s software delivery (opens in new tab)

AI-assisted coding can accelerate code production without accelerating delivery, because review, security, documentation, and planning often become the new bottlenecks. The post recommends applying AI across the full software lifecycle, using targeted prompts to reduce routine work and let teams focus on architecture, risk, and business decisions. ## Code Review as an Accelerator - AI can review merge requests (MRs) for: - Logical errors, edge cases, and potential bugs. - API changes, altered return types, schema modifications, and configuration changes that may break consumers. - Catching these issues before human review reduces repeated review cycles and helps prevent deployment-time rollbacks. ## Shifting Security Left - Security scan analysis can use AI to: - Distinguish real vulnerabilities from false positives. - Explain risks and recommend remediation. - Prioritize findings by severity and exploitability. - AI-assisted code reviews can identify injection flaws, authorization problems, data exposure, insecure dependencies, and cryptographic weaknesses before an MR is created. - This reduces security-team backlogs and limits late-stage developer/security rework. ## Keeping Documentation Current - AI can generate release notes from merged MRs, organizing changes into features, fixes, performance improvements, breaking changes, and deprecations. - It can also identify which README files, API references, architecture diagrams, and onboarding guides need updates after code changes. - Automating these checks helps prevent documentation drift without creating a separate manual task. ## Breaking Down Complex Planning - An AI planning prompt can decompose an epic into implementable issues by considering: - Technical dependencies. - Appropriate issue sizes. - Acceptance criteria. - Implementation order. - The goal is to replace lengthy planning meetings with an initial AI-generated breakdown followed by team review. The practical recommendation is to treat AI as a team workflow accelerator, not merely a code generator. Applying focused prompts to review, security, documentation, and planning can help prevent increased coding speed from creating larger downstream bottlenecks.

security-scanningdatabase-designpostgresqlcode-review+4