New GitHub Action flags AI token-cost regressions in pull requests before merge

·1 views

A developer tool called ci-guardrail has been released as a GitHub Action to detect token-cost regressions in AI agent codebases before changes are merged. The action compares token usage between a pull request branch and the base branch, then posts a cost-delta summary comment on the PR identifying the top cost-driving files. Teams can optionally configure a percentage threshold that will block a build if token costs grow beyond an acceptable limit. The tool uses static analysis via a companion package called tokenscope, requiring no API keys or external services beyond the standard GitHub token. It was built in response to real incidents where unreviewed prompt changes caused significant spikes in LLM API bills, sometimes going unnoticed until invoices arrived.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

TraceTree malware scanner fixes critical verdict bug with help from OpenAI Codex

TraceTree is a file security tool that uses radare2 disassembly, YARA rule matching, and a machine learning pipeline to detect malicious behavior before files are executed. Its developer participated in OpenAI Build Week to continue improving the project, which combines these scans into a visual dashboard rather than raw log output. The most significant fix this round addressed a backend bug where dangerous files were incorrectly flagged with a yellow caution warning instead of a red danger verdict. OpenAI's Codex, running on GPT-5.6, helped trace the issue across the orchestrator, server, and frontend components. The developer noted that targeted, narrow prompts to AI agents proved far more effective than broad open-ended queries during the debugging process.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Software Engineers Must Understand Technology From the Ground Up

Software engineers are encouraged to evaluate new technologies by examining why a tool is needed, what it offers, and how it works internally. A strong grasp of fundamentals helps developers diagnose problems faster and integrate systems more effectively. Understanding core concepts — such as namespaces and control groups in containerization — enables better management of modern development environments. Grounding decisions in technical knowledge also helps teams future-proof their projects against rapidly shifting industry trends. The guidance emphasizes that informed, principle-driven technology adoption leads to more efficient and innovative software development outcomes.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

SOC166 Walkthrough: XSS Attack from Malicious Chinese IP Blocked on Company Server

A cross-site scripting (XSS) attack was detected after JavaScript 'script' and 'alert' code was found embedded in a requested URL. The source IP address was traced to a Chinese internet service provider and flagged as malicious on both VirusTotal and AbuseIPDB, while the destination IP belonged to a corporate network. Log analysis revealed eight requests from the attacker to the same destination at the time of the incident, with seven returning HTTP 200 responses and the final one returning a 302 status, indicating the attack ultimately failed. No planned security tests were found in the Email Security section, ruling out an authorized simulation. As a precaution, the WebServer1002 endpoint was isolated to prevent any potential further damage.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Dev Builds Local-First Multi-Persona AI Sandbox With No Cloud or Subscription

An independent developer has created 'Bob's Bar', a locally-run AI application that allows multiple AI personas to converse with each other and the user simultaneously. The tool runs entirely on personal hardware using Ollama for LLM inference, requiring no cloud connectivity, API keys, or recurring fees. To manage chaotic AI interactions — such as personas impersonating each other or hijacking conversations — the developer built a regex-based moderation function called 'The Bouncer'. The app features two modes: a freeform 'Pub Mode' for creative, emergent conversations and a structured 'Work Mode' that turns the personas into a professional focus group. Bob's Bar is available as a one-time purchase for £29 via Lemon Squeezy and was launched on Product Hunt.

0 comments Read more at DEV Community