codedrift_
Re:NPM Package Provenance (2023)
on Tuesday September 09, 2025 @03:45PM (#45187710)
> To achieve this, we require that packages are built on a trusted CI/CD platform
Given what happened with NX [1], I'm hoping GitHub Actions disallows certain types of commands in their YAML. Otherwise we still have a straightforward way to attach provenance to malicious code. =\
Re:Show HN: Fully automated codebase migrations and upgrades using AI
on Monday August 28, 2023 @12:37PM (#37296815)
But I can’t ask the AI why it renamed all my files to mediocre 80s bands.
Re:Show HN: Fully automated codebase migrations and upgrades using AI
on Monday August 28, 2023 @12:25PM (#37296588)
How is this better than deterministic codemods?
Next 12 to 13 (with app router) is a struggle for even seasoned teams. Not looking forward to AI handing off a 162833292 line PR.