● Hands-off agent · GitLab Duo Agent Platform

Open an issue. Walk away.
It ships, and tells you what it cost the planet.

Greenlight is an autonomous delivery system. Duo agents plan, write, review and ship the change. The pipeline sizes itself to the carbon intensity of the grid, never skips security, heals its own failures, deploys, and posts a Software Carbon Intensity receipt on the issue.

See live receiptsWatch the pipelines ↗ Live · serving f9fcd02 · data: live
2
changes shipped autonomously
0.85 g
avg SCI · gCO₂e per change
48%
less carbon per change
1.6 g
CO₂e avoided vs naive pipeline
15.7
CI minutes saved

How it works

From issue to production, with nobody in the middle

Creating an issue triggers the Autopilot flow. From there, agents and the pipeline hand off to each other until the change is live and measured. A human sets the intent; that is the only step.

1 · Autopilot agents

Duo flow · 4 agents
  1. TriageReads the issue and AGENTS.md, posts a plan, or escalates to a human.
  2. ImplementSmallest correct change, plus a test the carbon gate can map.
  3. Green reviewHunts security bugs and energy waste, fixes them in place.
  4. ShipBranch, merge request with Closes #N, autopilot label.

2 · Verify & secure

GitLab CI/CD
  1. Carbon gateReads the grid and the diff, generates a right-sized child pipeline.
  2. TestsOnly impacted tests on a dirty grid; the full suite waits for a green window.
  3. SAST + secret detectionEvery change, every time.
  4. Security gateBlocks High and Critical findings and any secret.

3 · Ship & measure

GitLab CI/CD + Pages
  1. Auto-mergeMerges itself the moment the pipeline is green.
  2. StagingBuilds the site once and smoke-tests that exact artifact.
  3. ProductionPublishes to Pages and waits until the new commit is really live.
  4. ReceiptSCI per change posted on the merge request and the issue.

↺ When something breaks

Duo flow · 2 agents + pipeline
  1. Summon the FixerA failed merge request pipeline mentions the Fixer flow.
  2. Diagnose & fixReads failing jobs and scan findings, pushes a minimal fix.
  3. RollbackIf production verification fails, revert on main and redeploy.
  4. IncidentA nightly probe opens an issue, and the Autopilot takes it.

The carbon gate

The pipeline decides how much work a change deserves

Agents iterate, and every push used to run everything. Greenlight reads the live grid intensity where the runners are and the files that changed, then generates only the pipeline that change needs.

docs

Docs only

No tests run. Secret detection still does.

lean

Dirty grid

Above 300 gCO₂e/kWh: only tests mapped from the changed modules. Full suite and dependency scan wait for the nightly green window.

full

Green grid, main, or urgent

Everything runs. Production never ships on a partial run, and priority::urgent bypasses deferral.

Right now: the CI grid (us-east1) is at 560 gCO₂e/kWh, so merge request pipelines run lean. Security is never traded for carbon: SAST and secret detection run on every pipeline.

Self-healing

Bad code arrives. It ships fixed.

We push a change with user input going straight into a shell. Nobody intervenes.

  1. SAST flags itSemgrep finds the command injection.
  2. The security gate blocks the mergeAuto-merge never fires.
  3. The pipeline summons the FixerA comment on the merge request mentions the Fixer flow.
  4. The Fixer patches and pushesRemoves the shell call, validates input, keeps the tests green.
  5. Re-verified, merged, deployedSame gates, same receipt, no human.
$ merge request !2 · real run, 06:37 → 06:44 UTC ✓ carbon-gate mode=lean: grid at 560 g/kWh ✓ semgrep-sast 1 finding (shell=True on caller input) ✗ security-gate High: OS Command Injection at app/diagnostics.py:7 → summon-fixer @ai-greenlight-fixer … Fixer: caller input reached a shell string ✓ fix(greenlight): avoid shell in reachable() to resolve OS command injection $ new pipeline ✓ security-gate no blocking findings ✓ autopilot-merge → pages → verify-production ✓ receipt posted on the issue

Receipts

Every change, priced in grams

Each row is a change that went to production through Greenlight, measured from real job durations in the GitLab API.

ChangeModeSCI (g)Naive (g)Saved
Add connectivity check for status page
783c859c		full0.871.66
48%
Add CI-minutes card; validate receipts and cache dev-server loads
a745d778		full0.831.62
49%

Projected yearly savings at scale

Measured average savings per change above, × 5 changes per developer per week × 48 weeks. CI minutes priced at $0.01 (GitLab hosted-runner list price).

CO₂e avoidedEnergyCI hoursCompute $
Team of 509.5 kg14 kWh1,567 h$940
Org of 1,000190.0 kg279 kWh31,333 h$18,800

Method

Measured with the Software Carbon Intensity spec

Green Software Foundation SCI (ISO/IEC 21031:2024), with Cloud Carbon Footprint coefficients. Every receipt embeds its raw numbers, so anyone can recompute it.

SCI = ((E × I) + M) per R
EEnergy of every CI job that touched the change, from real durations: 2 vCPU, 8 GB runner, PUE 1.1.
IGrid intensity where the runners are, live from Electricity Maps or the published regional average.
MEmbodied hardware emissions, amortised over 4 years and scaled by time and vCPU share.
ROne change shipped to production. Baseline: the same change through a run-everything pipeline.
Served sustainably: this page is a static GitLab Pages site, rendered once per deploy. No always-on server, zero compute per visit.