GitLab 发布多项能力，编排 AI 智能体并治理影子软件工厂

GitLab, the DevSecOps platform, has announced new capabilities to orchestrate AI agents across the software development lifecycle, including managing software artefacts and enforcing security policies, as organisations scale agentic coding.

The announcements, made at the company’s Transcend event in Bengaluru, include GitLab Artifact Central, a new Dependency Firewall, goal-driven agentic workflows, expanded secrets management, and analytics for measuring the cost and impact of AI-powered software development.

The updates address a problem that GitLab says is emerging as AI coding tools become commonplace.

“While AI coding tools have made it really easy to create new code, the constraint of shipping faster and faster innovation has moved right to all the other steps in the software development lifecycle that were always built for human scale,” Manav Khurana, GitLab’s Chief Product and Marketing Officer, tells AIM.

Khurana argues that developers increasingly assemble their own software development environments around AI tools, repositories, testing systems, and deployment pipelines. He describes these setups as “shadow software factories”, which often lack the common policies and visibility enterprises need to manage software delivery at scale.

GitLab’s Four Layer Thesis

GitLab’s latest updates attempt to bring these fragmented workflows under a common system of orchestration, security controls, and measurement.

The strategy is to help enterprises build a governed software factory through a four-layer architecture—agent orchestration, context and data for agents, DevOps workflows designed for agentic development, and security and compliance controls.

Goal-driven workflows in GitLab Duo Agent Platform allow developers to specify an objective and let agents coordinate the work required across the software development lifecycle. The capabilities are available through ‘/goal’ in Duo CLI, including headless mode, Duo Agentic Chat, and the GitLab for Slack app. Custom Flows and flow triggers also let teams automate multi-step processes across their existing tools and channels.

The approach moves away from requiring developers to initiate and manage every stage of a task independently.

“Developers can define the goal of building something new and carrying it all the way through production. And agents in GitLab get orchestrated automatically to do all the steps across all the stages without any manual handoff,” Khurana says.

He explains that coding is only one part of shipping software, and enterprise code reviews can take days or weeks, depending on the change, while failed CI pipelines can force developers to seek help from senior engineers or DevOps architects.

GitLab has been extending its Duo Agent Platform to handle such work, including automatically fixing failing pipelines, conducting code reviews under repository-level policies, and triaging vulnerabilities. In addition, GitLab Artifact Central, now in beta, brings container images and software packages into a unified control plane alongside source code management and CI pipelines.

GitLab said platform teams can define organisation-wide policies, track what has been published, and reduce total cost of ownership by up to 50% compared to alternative tools. GitLab Self-Managed availability is planned for later this month. The feature targets the growing complexity of assembling software from third-party packages, open-source libraries, and container images.

When developers and AI agents pull dependencies from multiple registries, organisations can lose visibility into which components enter their builds and whether those components meet internal requirements. Artifact Central aims to centralise that control instead of leaving teams to manage separate tools and policies across repositories and registries.

Meanwhile, Orbit provides coding agents with real-time knowledge of the software lifecycle so they can operate with more context. GitLab said the tool can enable agents to complete tasks with up to 45 times fewer retries and use 4.5 times fewer tokens. It is preparing to make the feature generally available next month across all deployment options.

GitLab is also introducing GitLab Dependency Firewall, available in early access, to evaluate packages against organisational policies before they enter a build.

The firewall can warn against, block, or quarantine packages based on package age, vulnerability severity, malicious package detection, and licence compliance. Its controls span source code, build processes, and registries, allowing teams to trace exposure to affected projects.

The company is also expanding controls over credentials through GitLab Secrets Manager, with GitLab Self-Managed support planned for release 19.5. The product centralises build-time secrets, restricts access to the jobs that need them, and logs events in GitLab’s audit trail. GitLab said it can reduce costs by up to 50% as opposed to operating a separate vault.

GitLab has also introduced the GitLab Security Standard, a framework of five controls for assessing security in agentic software development. It uses the time between vulnerability detection and verified remediation as its core metric.

In addition, Anthropic’s Claude Mythos 5 and 5.1 will also be integrated into new GitLab Duo Agent Platform security workflows. The models are expected to become available next month in approved environments to help identify vulnerabilities and remediate findings before software reaches production.

GitLab is adding Duo Agent Platform Impact Analytics, now in early access, to give engineering leaders visibility into AI expenditure and outcomes by team, task, and model.

The product tracks adoption, workflow results, and credit consumption alongside work reaching production. It complements existing AI usage caps that allow administrators to set spending limits at the subscription, group, or user level.

Khurana notes the proliferation of AI-generated code has not necessarily translated into comparable improvements in business outcomes. GitLab has pitched its analytics offering to help enterprises assess whether their AI investments are producing results beyond increased coding activity.

“The amount of code being written has become abundant. But the value that the company and customers get out of that hasn’t seen much improvement,” he says. “And now there's just even more code coming into the pipeline, and it's really hard for engineering teams to figure out how to process all the stages of the software lifecycle.”

He estimates that roughly half of CI pipelines fail on their first build attempt, often requiring developers to seek help from senior engineers or DevOps architects. “Now there are agents in GitLab that can fix failing pipelines automatically.”

The platform also uses agents to review code against company-defined repository policies, costing as little as $0.25 and saving between 20 minutes and two days, according to Khurana. Agents can also triage vulnerabilities in newly generated code, identify false positives, and fix security issues without waiting for a security team to decide which findings to address.

The next step, he says, is to move from automating individual tasks to coordinating entire workflows around a developer’s objective.

“Developers don't have to go step by step, stage by stage anymore. They can define the goal of building something new and carrying it all the way through production, and agents in GitLab get orchestrated automatically to do all the steps across all the stages without any manual handoff,” Khurana said.