The Video Signal

Topic

CI/CD

All digests tagged CI/CD

· 16:24

We Vetted 2000 AI Skills Before They Reached Developers — Lucas Palma, Nubank

Lucas Palma details how Nubank addressed AI skills—which function like supply chain dependencies—being a significant security risk in a regulated financial environment. To mitigate this, they built 'Skill Vector,' a comprehensive security review system that sits between the skill and the internal marketplace. This system vets every skill using a hybrid approach: deterministic checks (e.g., regex for unsafe instructions) followed by LLM analysis to assess context and behavior before granting permissions or allowing deployment.

Key takeaways

  1. Treat AI Skills as Dependencies

    AI skills must be treated like any other software dependency, requiring rigorous vetting and security gates, rather than just configuration files.

  2. Hybrid Security Scanning is Essential 12:17

    The most effective approach combines deterministic checks (for easy risks) with LLM review (for contextual behavior analysis), ensuring comprehensive coverage.

  3. Security Gates Must Be Comprehensive

    Vetting must cover the entire workflow, including local developer testing, CI/CD steps, PR feedback, and integration into a formal vulnerability management program.

Watch on YouTube Full article

· 53:34

Harness Engineering: Building an AI Software Factory

Harness engineering is a discipline focused on building automated loops of checks and maintenance agents that allow teams to delegate increasing amounts of codebase development to AI. The goal is not merely higher velocity, but achieving higher quality by shifting from manual code review (the primary bottleneck) to systematic process oversight. This involves tracking three key dimensions—autonomy, automation, and quality—and implementing layered validation systems: the Inner Loop (unit tests/linters), Outer Loop (agentic QA/UI testing), and Meta Loop (maintenance agents that analyze historical data for systemic improvements).

Key takeaways

  1. The Three Dimensions of Agent Adoption 10:39

    When adopting AI agents, track three metrics: Autonomy (how many human course corrections are needed); Automation (the level of oversight required, indicating trust); and Quality (ensuring the shipped product remains high quality). Progressing requires improving these dimensions sequentially.

  2. The Three Loops of Harness Engineering 19:04

    1. Inner Loop (Autonomy): Focuses on cheap, frequent checks like pedantic linting or unit tests to ensure agents get it right the first time. 2. Outer Loop (Automation): Involves slower, in-depth checks, such as agentic code review or running the product through a UI/CLI. 3. Meta Loop: Utilizes maintenance agents that analyze historical data (CI logs, PR comments) to propose systemic fixes and improvements to the entire process.

  3. The Primary Barrier is Organizational 28:20

    Harness engineering is fundamentally an organizational transformation, not just a technical one. Success requires changing workflows—for example, moving from monolithic PRs to smaller, low-risk chunks that can auto-merge, thereby shifting human behavior toward better practices.

Watch on YouTube Full article

· 8:53

Antigravity Arcade: From prompt to game in minutes

The video details 'Antigravity Arcade,' a system that leverages AI skills and workflows to allow users to generate functional web games from simple ideas without writing code. The solution covers both the front-end game generation process—which enforces visual consistency using specialized AI skills (e.g., ensuring retro aesthetics, handling physical input)—and a robust back-end deployment pipeline for hosting these user-generated games on physical arcade cabinets.

Key takeaways

  1. AI-Powered Game Generation 3:30

    Antigravity uses modular 'skills' to guide the AI agent, preventing context window bloat and ensuring adherence to organizational best practices (e.g., consistent retro aesthetic, specific key mappings) when generating game code.

  2. Consistent Development Workflow 4:13

    The project enforced consistency by using a starting template built with Phaser JS's game engine, which included skills for visual guidelines (black background, CRT shader) and input handling to ensure cross-platform compatibility.

  3. Secure Deployment Pipeline 6:45

    A custom deployer CLI tool handles the deployment of user code to physical arcade cabinets. This process uses a Unix setuid model API to securely read sensitive API tokens without exposing them to the end-user or agent, followed by Cloud Run validation and GCS storage.

  4. Automated Game Moderation 8:02

    Upon successful upload, an Eventarc trigger spins up a Cloud Run function that validates the game. If approved, Firestore increments a counter, issuing a sequential ID for moderation via a web app.

Watch on YouTube Full article

· 34:18

FORGET Loop Engineering. Agentic Engineering is about THIS

The video argues that 'Loop Engineering' is an insufficient and inaccurate mental model for modern software development with AI agents. The superior approach is **Agentic Engineering**, which focuses on building complex AI developer workflows (ADWs) within a 'software factory.' These ADWs orchestrate three core actors of value creation—Engineers, Agents, and Code—to automate the entire development lifecycle, from planning to deployment, thereby scaling impact and accelerating development far beyond what simple loops can achieve.

Key takeaways

  1. Shift Focus from Loops to Workflows

    Loop engineering is a poor rebrand of the Software Development Life Cycle (SDLC). The focus must be on building comprehensive AI developer workflows that combine code execution with agents, rather than focusing solely on iterative loops.

  2. The Three Actors of Value Creation 2:00

    Successful agentic engineering requires understanding and strategically placing three actors: the human engineer, specialized AI agents, and deterministic code. Code is highlighted as the most reliable actor because it costs zero tokens and runs consistently.

  3. Scaling Developer Workflows 4:00

    Advanced workflows move beyond simple loops by integrating multiple validation steps (e.g., linting, type checking, formatting) and scaling compute through specialized sandboxes for parallel execution. This process is the core of building a 'software factory.'

  4. Meta-Engineering: Building the System 8:00

    The most valuable engineering effort is not working on the application layer, but performing meta-work on the agentic layer—building the system that orchestrates and manages all other components (the 'system that builds the system').

Watch on YouTube Full article