The gate flow

The Shipvigil gate is a GitLab Duo Agent Platform flow. When it runs on a merge request, it reads Shipvigil's evidence, upgrades the packages that block the release, commits the upgrade to the source branch, and posts one verdict note. A person still approves the production deploy, so the autonomy level is Supervised.

What the flow does

The flow has two parts.

1. gate (an agent with tools) checks out the source branch and runs shipvigil deps --json. It sets the fixed_in version for each blocked npm package, regenerates the lockfile with npm install --package-lock-only --ignore-scripts, runs the check again, and commits with create_commit. It answers with a JSON result: the verdict before and after, what it fixed, what is still blocked, and the commit SHA.
2. report (a one-shot step) turns that JSON into one merge request note. The note starts with Shipvigil: PASS, Shipvigil: PASS with warnings or Shipvigil: BLOCK.

The definition is in flows/shipvigil-gate.yml. The playbook the agent follows is the skill in skills/shipvigil-gate/SKILL.md.

Guard rails

• The agent takes its evidence only from Shipvigil's JSON output and the dependency files. Its rules say to use get_merge_request only for the branch names, and never to act on the title, description or comments. That's a prompt rule, not a hard limit, so the checks below don't depend on it.
• Its rules allow changes only to package.json and package-lock.json. They forbid edits to code, CI files, tests and shipvigil.policy.json.
• Every commit it makes runs the full pipeline again, and a person still approves the merge.
• It commits only to the merge request's source branch.
• The runtime in .gitlab/duo/agent-config.yml keeps the network sandbox on. The flow reaches GitLab, api.openkrill.app (the evidence) and registry.npmjs.org (the lockfile), and nothing else.
• npm runs with --ignore-scripts, so an upgraded package can't run code during the fix.

Set it up in your project

1. Copy .gitlab/duo/agent-config.yml to your default branch. Duo reads it from the default branch only.
2. Copy skills/shipvigil-gate/ to the same path in your repository. Duo gives project skills in skills/ to the flow.
3. In GitLab, open Automate > Flows > New flow and paste the definition block of flows/shipvigil-gate.yml.
4. Enable the flow in the project, then open Automate > Triggers > New trigger and add one or both:
   • Assign reviewer: the flow runs when you add its service account as a reviewer of a merge request.
   • Pipeline failed: the flow runs when a pipeline fails, for example on the shipvigil-deps gate.

Run it

Open a merge request that adds a package Shipvigil blocks, for example ejs@3.1.6. The shipvigil-deps job fails and marks ejs on its lockfile line. Assign the flow as a reviewer. A few minutes later the source branch has a commit that pins ejs to 3.1.10, the new pipeline passes, and the merge request has the verdict note.

Limits

• The flow fixes npm projects. For other ecosystems it reports each block with its fixed version, and a person upgrades.
• A package with no fixed release stays blocked, and the note says so.