Search
Results for “ai-coding”
- software-engineering
GitHub Copilot Agent Mode vs Copilot Edits in VS Code: A Task-Selection Workflow for Safer Changes
Use Copilot Edits for bounded changes you can specify and review file by file. Use agent-oriented workflows when a task requires discovery, implementation, testing, and iteration—and add explicit checkpoints before generated changes reach a branch.
- software-engineering
AI Code Validation vs Release Governance: 9 Production Pipeline Checks to Add First
AI can assess changes and recommend whether a release is safe, but it should not silently become the authority that approves production. Use this control checklist to assign decision ownership, preserve audit evidence, route security review, and handle model-policy conflicts.
- ci-cd
A Reviewer Playbook for AI-Generated GitHub Actions Workflows
AI-generated GitHub Actions YAML can be syntactically correct while creating a direct path from a forked pull request to repository credentials. Use this workflow-specific review playbook to inspect permissions, action pins, triggers, interpolation, secrets, and checkout context before merging.
- software-engineering
A 10-Point Review Rubric for AI-Generated Pull Requests That Catch Architectural Debt
AI-generated pull requests can pass every visible test while quietly creating duplicate policy, unsafe boundaries, and unsupported dependencies. Use this five-gate, 10-point rubric to decide what can merge, what needs follow-up, and what needs an architectural redesign.
- engineering
How to Monitor a Feature Rollout Before Trusting Its AI Kill Switch
A rollout gate and a runtime kill switch solve different problems. Use this checklist to set measurable exposure limits, compare candidate and control behavior, and decide exactly what an AI kill switch should change.
- productivity
Build a Faster Technical Knowledge Feed With AI Curation, Tags, and Weekly Reviews
Turn an AI-driven news feed into a practical technical reading system. This workflow shows how to filter articles, save only reusable ideas, tag them consistently, and convert a week of reading into decisions and experiments.
- developer-tools
Spring Tools 5.2 Embedded MCP Server: A Safe Workflow Guide for Claude Code and Spring Project Context
Spring Tools 5.2 introduces an experimental Claude Code plugin and embedded MCP server, but safe use depends more on workspace isolation than on prompts. This workflow shows a minimal validation change, test contract, secret-safe project preparation, and rollback procedure.
- software-engineering
Where to Put Human Approval Gates in AI-Powered Developer Workflows
Let an agent prepare release candidates, run checks, and explain its choices; pause before publishing or changing shared state. A worked GitHub Actions and npm example shows how to make the boundary reviewable and enforceable.
- software-engineering
A Pre-Launch GenAI Risk Checklist for Internal Chatbots and Developer Tools
Turn NIST’s generative AI risk guidance into a practical release gate for a coding assistant, repository chatbot, or internal support bot. Use this checklist to test data exposure, harmful outputs, human review, evaluation coverage, and incident response before enabling real users.
- Engineering
The Event Loop Explained: How JavaScript Actually Runs Your Code
The event loop is the beating heart of every Node.js server and browser tab. Understanding it is the difference between writing code that happens to work and code that works because you know why.
- software-engineering
Diagnose Node.js Event Loop Latency: Blocked Code, CPU Saturation, or Downstream I/O
Use Node.js event-loop delay and utilization metrics as an incident decision system. This guide shows what to measure first, how to distinguish synchronous blocking from CPU saturation and downstream I/O pressure, and when code changes are actually justified.
- security
Choose CI/CD Security Tools With a Risk-Based Evaluation Matrix
A buyer-oriented framework for selecting CI/CD security tools based on the risks in your actual delivery pipeline: code, dependencies, secrets, workflows, artifacts, and continuous validation.
- security
How to Choose CI/CD Security Tools With a Requirements Matrix
Stop comparing CI/CD security products as interchangeable suites. Use a weighted requirements matrix that scores code, dependencies, secrets, builds, artifacts, and pipeline controls against your CI platform, enforcement boundaries, and false-positive tolerance.
- developer-tools
Annotated Tags to Downloadable Assets: A GitHub Publishing Runbook
Use an annotated Git tag as the immutable version marker, then turn it into a GitHub release page with reviewable notes and downloadable assets. This runbook shows the exact sequence, checks, and decisions for publishing a version without losing the connection between code and artifacts.
- software-engineering
How to Investigate Node.js Latency With Event-Loop Metrics, Not CPU Alone
Learn to distinguish a blocked Node.js event loop from slow downstream I/O using event-loop delay, event-loop utilization, request timing, and CPU measurements. Includes instrumentation code, a diagnosis matrix, and concrete remediation decisions.
- security
A Practical OWASP CI/CD Security Review Worksheet for GitHub Actions Pull Requests
Turn OWASP CI/CD risks 8, 9, and 10 into a repeatable GitHub Actions pull-request review. Use a worked workflow example to find ungoverned actions, weak artifact checks, and missing deployment evidence before code reaches production.
- software-engineering
How to Choose CI/CD Security Tools With an OWASP-Based Proof-of-Value Scorecard
Compare native CI controls, specialist security tools, and unified platforms using a proof-of-value matrix tied to OWASP CI/CD risks. This worksheet tests real coverage for secrets, code, dependencies, infrastructure, artifact integrity, visibility, and developer friction.
- security
How to Audit Node.js Single Executable Applications Before Internal Distribution
Node.js Single Executable Applications simplify deployment, but they also make it easier to distribute an opaque runtime and application payload as one file. Build an audit workflow that inventories SEA artifacts, validates provenance, inspects bundled code, tests behavior, and applies endpoint allow/deny rules.
- software-engineering
How to Lock GitHub Releases Safely: Tags, Rulesets, and Immutable Releases
A moved v2.4.0 tag can make the same download URL point to different source code, while an editable release can replace the binary users already trusted. This guide separates Git tags, GitHub releases, tag rulesets, and immutable releases, then builds a practical workflow for locking versioned software.
