farol: open-source static tool scores pull request merge risk and flags files for review

·2 views

As AI tools generate more pull requests, human approvers struggle to know which files deserve closer scrutiny, since risk is often spread evenly across large changes. The author introduces farol, an open-source tool that gives each merge a 0-100 risk grade and a verdict of fast track, quick review, or careful review. It relies purely on static analysis with no LLM, building dependency graphs and tracing changed lines back to entry points such as routes, endpoints, and CLI commands. farol combines this with CI coverage reports, lint and security findings, dependency advisories, and API contract changes to weight each file's risk. The output is an HTML artifact that can be posted as a pull request comment, listing must-check items and high-risk files, with a live demo available on a FastAPI and React pull request.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Understanding the Dependency Inversion Principle through an order checkout example

The author closes a series on SOLID principles by tackling the Dependency Inversion Principle, which says high-level business logic should not depend on low-level implementation details. Using a simple order checkout in TypeScript, they show how OrderService directly instantiates a Postgres repository and a Stripe client, leaving the core logic tied to replaceable infrastructure. This coupling makes testing hard, forces environment-specific branches for scenarios like free trials, and risks real charges during local runs. The fix is to have OrderService define its own interfaces for storage and payment, so that concrete implementations plug into it rather than the reverse. The article frames this as flipping the dependency arrows so the most important code depends on abstractions it owns.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to run scheduled cron jobs on Vercel, Cloudflare Workers and Netlify

Serverless apps lack a persistent machine with a crontab, so each major platform offers its own way to trigger functions on a schedule. Vercel calls a route you declare in vercel.json, and you should protect it with a CRON_SECRET bearer token, since cron times are in UTC and runs target only production deployments. Cloudflare Workers instead invoke a scheduled handler configured in wrangler.toml, which is not exposed over HTTP and can serve multiple schedules via controller.cron, with ctx.waitUntil() keeping async work alive. Netlify attaches a schedule directly in function config, also using UTC and running only on published deploys, with a shorter execution limit that may require handing longer work to a background function or queue. The platforms differ in configuration, security, and failure handling, and failed runs are not automatically retried on Vercel.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

PHANTOM TRACE Audits AI Agent Claims Against Their Recorded Evidence

PHANTOM TRACE is an open-source tool that checks whether an AI agent's stated claims are backed by the events recorded in its execution trace. It first runs deterministic checks for structural problems, such as missing evidence references, and can optionally use a small open-weight model to review claims. The optional model runs in the browser via Transformers.js, so trace contents are not sent to a hosted inference service, though model files are downloaded from Hugging Face on first use. The developer noted that the model load did not complete during deployment testing, so an end-to-end model response has not been verified, while the deterministic demo works. The tool separates clear structural errors from model-based assessments, which are treated as hypotheses requiring human verification against source evidence.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Boolean Logic Gates Turn Binary Decisions Into Computing

Every processor instruction ultimately reduces to binary values of 1 and 0, governed by Boolean logic gates. The concept traces back to mathematician George Boole, who in 1854 formalized algebra using True and False states. Claude Shannon linked that theory to electrical circuits in 1937, showing that switches could physically carry out Boolean operations, which became the basis of modern computing. The article explains core gates such as NOT, AND, OR, and XOR, each defined by a truth table, and notes their roles in software conditions, hardware design, and cryptography.

0 comments Read more at DEV Community