Code may not be, but opening a Merge Request undercover may be unlawful:
> Providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system
Depends if it's a closed loop agent. If the agent opens the request, writes the body and is triggered by an answer on the MR, then I'd expect the law to cover this.
> Providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system