End-to-end automation from service request to infrastructure removal — with AI-assisted code review and a complete audit trail.
"Give me six hours to chop down a tree and I will spend the first four sharpening the axe."— Abraham Lincoln
Retiring a single app requires careful, detail-oriented manual work from developers across 10+ systems — time that could be spent building, not maintaining.
Manual steps across multiple systems create opportunities for mistakes that can impact production reliability.
Manual steps leave no structured record. Tracking what changed, who changed it, and when requires digging through commit history and old emails.
Removes the app's infrastructure entry from the Kubernetes repo, opens a Merge Request, gets it AI-reviewed, and waits for a human to approve and merge — then marks the TDX workflow task complete.
Renames the app's GitLab repo to mark it retired, transfers it to the archive group, locks it read-only, and marks the TDX workflow task complete. No manual GitLab actions needed.
As soon as the automated job opens the Merge Request, the review team is notified in Slack's #decom-reviews channel with a direct link.
GitLab Duo's review result — passed or action required — fires a second Slack message, so the reviewer knows whether there's a problem before they even open the link.
When the Developer merges the change, Slack notifies #decom-reviews instantly. iPaaS then sends a final enriched message to #decom-ops with the TDX closure confirmation.
| Component | Responsibility | Type |
|---|---|---|
| TeamDynamix / iPaaS | Detects the trigger, reads ticket metadata, fires the GitLab pipeline, and closes the TDX task on completion | Automated |
| GitLab CI Job | Makes the actual file changes, creates the audit issue, branch, and Merge Request | Automated |
| GitLab Duo Agent Platform | Reviews every change against a specific checklist — posts a pass or action-required verdict before the human reviews | AI |
| GitLab for Slack | Sends real-time Slack notifications as events happen: MR opened, AI verdict, MR merged | Automated |
| Human Reviewer (Developer) | Makes the final approval. Reviews the diff and AI verdict, then approves and merges. The only entity that can authorize a change. | Human |
The automated job that creates a Merge Request does not have permission to approve its own work. A human Developer must approve — enforced by GitLab's branch protection rules.
Everything goes through a Merge Request. There is no mechanism for the automation to modify production configuration files without passing through a human review step.
When GitLab Duo posts a review feedback comment, the Merge Request is technically blocked — it cannot be merged until the flag is addressed or explicitly overridden by a reviewer with justification.
When GitLab notifies iPaaS that a Merge Request was merged, the message is cryptographically signed. If the payload was altered or faked, iPaaS rejects it automatically.
No passwords or access tokens appear in code, files, or change records. All secrets are stored in encrypted variable stores with access controls.
Every decommission produces a traceable record across TDX ticket, GitLab issue, Git commit history, Merge Request, and TDX closure comment — including who approved it and when.
The task: find one app's block inside a structured config file, and remove it cleanly from both environments. Same input every time, same correct answer every time — no interpretation required.
"An AI-powered DevSecOps feature that automates the initial evaluation of code changes directly within GitLab merge requests. It uses large language models to scan MR diffs, analyze repository context, and provide automated, actionable feedback on code quality, security, and performance."How GitLab describes Code Review Flow
As part of our Human-in-the-Loop (HITL) guardrails, GitLab Duo automatically checks five things on every proposed decommission:
Self-service intake, automated TDX ticket + 19 tasks, automated infra changes, HITL Slack/email gates, AI-assisted review, GitLab archival, TDX closure — all built.
Other priorities can and do become the team's primary focus — this can shift or delay the timeline, by design.
Less manual triage and fulfillment work per request; consistent, predictable steps every time.
Time back from repetitive teardown work — reinvested in building, not maintaining.
As the automation extends to more workflow tasks, the desired future state also cuts down the manual, repetitive work Enterprise Operations handles for each decommission.
A full audit trail on every decommission: TDX ticket, GitLab history, MR, reviewer, and closure — every time.
This is a sneak peek at an evolving, in-progress capability — not a rollout plan the dev teams can adopt tomorrow.
Some Laravel apps still share combined GitLab repos, which this automation doesn't yet handle — a real gap, not a footnote.
Team fit matters as much as the technology — adoption needs agreement on where and how this gets maintained long-term.
Sustainable operation means clear runbooks and an owner for the automation — that groundwork is still being laid.