Check ReARM we're building for durable tracking of releases, software updates and fulfilling 10+ years obligations - https://rearmhq.com

Small and cheap cloud VM, preferably on a separate account used for this purpose specifically.

If you're planning to put it into production anything you do outside of bringing somebody qualified at this point is likely a waste of time. Highly recommend this recent talk by Kelsey Hightower on the subject - https://www.youtube.com/watch?v=A7WFt2JQ5sg

Thanks for the link! You could very well be right that there is not much more that could be done before the review. My reading of what Kelsey said is that agents can produce useful outcomes, it is just that humans need to validate and own them. In other words, I couldn't conclude that this somehow disproves that at least some of the functionalities that were generated in my project, couldn't be (close to) production-grade.

This is more about understanding the big picture and architecture of what's going on (the part about the diagrams / blueprints). One practical thing actually that may be useful to you - try thinking and testing in terms of "what can go wrong" rather than "is this prod-ready".

Full CRA requirements kick in in December 2027. Reporting obligations kick in in September 2026. Would probably make sense to update the website timer to reflect December 2027 deadline which is more relevant here.

Did you try working with CycloneDX AI/ML BOM group? This would be good place to contribute.

We support this with ReARM - https://rearmhq.com/

It's an open-core product (there is an option to self-host FOSS ReARM CE yourself) that gives you per-release vulnerability posture. It consumes various artifacts (e.g., SBOMs) generated during CI phase and does scan on them, doesn't need access to source code. Apart from SBOMs it consumes files with findings from other tools (reports in SARIF format, VDRs, VEXs).

Very cool, we're doing similar except we let agents open PRs as well + we track release metadata and agentic sessions via our ReARM system + we've recently launched an option for agents to track helm-based deployments via ReARM - https://docs.rearmhq.com/workflows/devops.html

I didn't mention this part, but while writing this I realized I could easily add a skill to hit the Forgejo PR API. There's no forgejo CLI like there is with GitHub sadly.

I just use the tea CLI. There is pretty good compatibility between tea and forgejo. The only place I’ve found it to be incomplete is forgejo’s actions api was missing some endpoints.

There is: https://forgejo.org/docs/latest/admin/command-line/

That's not an API tool. It performs direct database access for administrative functions on the Forgejo server.

But there is a different tool that is an API accessing CLI: https://codeberg.org/forgejo-contrib/forgejo-cli

There is, but it's limited. For example Forgejo does not expose CI build logs via the API so it's hard to make Claude auto-fix a build issue.

I still need to find the time to get into the Forgejo code and add that endpoint.

That seems like a problem an LLM could solve. ;) (Assuming Forgejo has a reasonable REST/whatever API.)

It's not about that we should drop LLM completely from the mix, but something like AI -> LLM control -> old-school classifier control -> script / human oversight is the way. If something has potential to cause millions in damages, it should be subjected to human oversight (likelihood / impact analysis needs to happen early in the system design).

Frankly I don't buy atrophy argument at all. I (and I believe many other people) switched multiple frameworks and languages over the years. I.e., I was an expert in Chef more than 10 years ago, and nowadays I hardly remember anything about it. Calling this a cognitive decline is a significant stretch.

If you're afraid of cognitive decline - try to get to proper orchestration using multiple agents. That's a fun exercise.