4 ms·
To get many eyeballs on gem diffs, we need an easy tool.
by baggy_trough 3y ago
To get many eyeballs on gem diffs, we need an easy tool.
- freedomben 3y agoI think what GP is getting at, and is something I've hit as well in the past when auditing diffs, is that it's just not feasible. For a small project maybe, but for a medium to large Rails app for example you would need to dedicate potential multiple full time engineering to do nothing but review diffs. Things change fast, and a lot of the changes are not simple patchsets you can eyeball. Without some domain knowledge and even context such as "did they just refactor or is this a total rewrite" it can be very difficult to even understand what you're reading without a bunch of extra work. At a minimum you need to read the commit log in addition to the diffs. Personally, this is an area where I think AI could add a huge amount of value. An AI tool that looks at your gem versions (or node or elixir, whatever) and then reads all the commits that changed and reviews them for safety/security and maybe summarizes them, could be huge.
- kayodelycaon 3y agoI wouldn't even bother with deep analysis without access to the repo on Github or a similar site where I can see the PRs and their discussions.