“If a bug report comes in from a customer, a triage bot looks at the issue, tries to reproduce it in its VM, creates a video of the reproduction, and tries to implement a fix. If it can, it screen-records the fix, before and after, and posts it into the merge request. Our engineers come in, see the bug report, the triage information, the merge request and the video, and can approve and merge without even checking out the code. I call this no touch.”
Software Engineering Daily · Hands-On Engineering Podcasts · November 2026
Context
GitLab's Tim Zallmann describes the company's internal fire-and-forget workflow, in which agents handle bug triage and fixes end to end before an engineer approves.
Transcript
…signals to give you durable risk scoring and threat detection in real time. Even as human and agentic activity blends together, you can identify suspicious traffic faster and build safer and more secure sites and apps. Over 6,000 companies rely on it every day. Join them now at fingerprint.com.
…I think it's even in sort of beta stage at the moment, which is Orbit. That has been preceded by Duo. And I think if we could just talk a bit about what is GitLab Duo, and I believe that is everything that, I guess, from the AI and agentic perspective, that was the first big jump in there.
Yeah, I'm always very excited to talk about DoAgent platform. That's the main topic that I'm responsible for, and my teams are building since quite some time. The vision at the end of the day is really to bring AI to the full SDLC, and that's exactly what we wanted to do. Also, in the same way as we are doing CI CD. What does this mean? So, we have started also as many others with the classic AI thing of like add something here, add something there. But very soon, we thought, okay, let's build something that is extensible and allows people to run agentic stuff at any point in the SDLC. That means, like, if someone creates a new project, start an agent to fill the project with the baseline and do the right settings. If a work item, if an issue changes its status, then kick off a certain agent that looks at all the compliance stuff, etc., etc. And allow this in a way in the same way as we have built CI CD to build also custom capabilities. So, customers are able to build so-called custom flows, which are flows are the combination between agents and deterministic steps. Because this allows you to run things with a very clear target. You can also run stuff cheaper because, at the end of the day, on one hand, deterministic steps like…
Yeah. So my understanding is it's, as you said, it's very much graph-based and that's sort of almost being positioned instead of rag, effectively. So what was the, does that sort of contribute to this you can do magic that others can't? I mean, and also just actually looking at what does it do…
Yeah. There are certain use cases that you can also do with RAG and agents. They simply need to look a lot of times and they need to look very specifically to find everything. What Orbit does at the end of the day is like it indexes the existing data that already exists today in GitLab and it…
Yeah, very interesting. And I guess from a just pure product perspective, it is actually available, I believe, over OpenMCP to Cloud Code and Codex. It's not like completely tied to Duo. What were the kind of thoughts on that one to just not keep it as a pure GitLab thing, I guess?
More from Software Engineering Daily
