SECOPS
Block GitLab merge until a security reviewer signs off
Sets the merge request to draft and posts a blocking commit status when a sensitive label is present, then clears the block only after an approved review from the security group.
How it runs
The automated pipeline, trigger to output.
- TriggerGitLab MR updated (label or approval)GitLab
- LogicBranch on label-added vs approval event
- ActionPost failing security/signoff commit statusGitLab
- LogicVerify approver is in security groupGitLab
- ActionFlip status to success to unblock mergeGitLab
- OutputNotify channel of block or unauthorized approvalSlack
What it does
Enforces a hard merge gate on security-labeled merge requests. The moment a sensitive label lands, it places a failing commit status named `security/signoff` so the MR cannot merge, and it removes that block only when an authorized security reviewer approves.
When to use it
Use it when project merge rules alone are not enough and you need an auditable, label-driven gate that fails closed. Ideal for repos handling auth, secrets, or regulated data where an accidental merge is a real incident.
How it works
- 1A GitLab webhook fires on MR updates (label changes and approvals).
- 2A branch checks whether the event is a new sensitive label or an approval event.
- 3On a new sensitive label, the flow posts a failing `security/signoff` commit status and comments who must approve.
- 4On an approval, it verifies the approver belongs to the security group via the GitLab API.
- 5If the approver is authorized, it flips the commit status to success, unblocking merge; otherwise it leaves the block in place and notes the unauthorized approval in Slack.
Set it up
What you configure once, before turning it on.
- 1Connect GitLabRepos, MRs, pipelines, registry.
- 2Connect SlackChannels, DMs, threads, mentions.
- 3Set each agent's modelWe leave models unset so you pick the tier — fast + cheap, or top-quality.
- 4Tune it to your dataEdit the prompts, filters, and field mappings so it matches how your team works.
- 5Test, then turn it onRun once against a sample, confirm the output, then enable the trigger.
More SecOps workflows
Post-Revocation Verification and Audit Logging
After a key is revoked, it confirms the old credential actually fails, verifies the replacement works.
Page on-call when a WAF rule mass-blocks legitimate traffic
On demand or every few minutes, it detects a single Cloudflare WAF rule suddenly blocking a broad spread of ASNs and paths (a likely false-positive storm).
PII Content Scan on New Dropbox External Share
When a file gets an external Dropbox link, it reads the file content, uses an AI classifier to detect PII or secrets.
Compile a weekly WAF tuning review with trends to Confluence
Every week an agent rolls up Cloudflare WAF block clusters by rule and ASN, compares them to prior weeks for trend direction.
Sensitive Dropbox Link Owner Remediation Loop
When a newly created Dropbox shared link points to a sensitive file, this workflow DMs the file owner, gives them a deadline to justify or revoke it.
GitLab Push Secret Detection to Block and History Purge
On a GitLab push that contains a detected secret, it revokes the exposed credential, opens a tracking issue with git-history purge instructions.
Run it inside a business
This workflow drops into a full company template. Import the org, and this is one of the playbooks its agents run.
Run this workflow in your colony.
14-day trial. No DevOps. No Sales call. Provisioned in under a minute.