Operations | Monitoring | ITSM | DevOps | Cloud

"We'll spend weeks shaving 10 minutes off CI, then let code sit waiting 18 hours for review." Luca and Rob discuss why AI isn't just changing how we write code, it’s forcing teams to rethink the entire software delivery process.

The secure path and the easy path should be the same path. Ralph McTeggart (Principal Engineer), Alex Franzmann (Customer Onboarding Team Lead), and Claire McDyre (Product Manager) at Cloudsmith lay out how platform teams can deliver supply chain security as a capability rather than a checklist. The argument runs from first principles: make a private registry the default, automate policy enforcement at the global level, and extend that same logic to compliance – so SBOM generation happens in the pipeline, not as a developer's manual task.

Stop context-switching between your IDE and CI dashboard. This video shows you how to connect Cursor to CircleCI using the CircleCI MCP server so your AI agent can read pipeline failures, validate configs, and trigger builds without leaving your editor. In this demo, we introduce a bug, let CI catch it, and watch the agent diagnose and fix it autonomously through a full green pipeline. No manual log hunting required.

The first two to three hours after a supply chain compromise aren't about remediation – they're about figuring out whether you're affected at all. That requires two things: a feed of compromised packages you can cross-reference against what you're using, and an audit trail showing which developers pulled which packages and when. Teams that can answer "are we affected?" in 30 minutes have that data pre-built into their platform. Teams that don't are still piecing it together at hour three. Protect your supply chain with Cloudsmith.

For a 50-developer team operating at agentic pace, validation-related delivery costs can approach $900K a year.

Code review has always been a time sink. AI just makes the dysfunction undeniable. Luca Rossi, founder of Refactoring.fm and builder of the open source tool Tolaria, has been running one of engineering's most-read newsletters for five years, with over 170,000 subscribers. He's also been doing what a lot of engineering leaders talk about but rarely do: building a real product with AI agents to pressure-test what's actually possible today.

Asking developers to take extra steps to pull securely is a policy that won't hold. The only approach that scales is making the private registry the default – a buffer between the developer and public registries that applies policy automatically at the global level. No extra steps, no security theater, no cognitive overhead at the point of pull. Automation and global policy configuration are what turn good intentions into a default secure posture.

For years, buying software meant trusting the vendor. The Cyber Resilience Act changes that relationship by codifying what vendors must do – auditing dependencies, confirming exploitable vulnerabilities, and enforcing security best practices – as legal obligations, not internal choices. For customers, that means software safety is no longer a matter of brand reputation. For vendors, it means governance gaps that were once internal concerns are now deal blockers.

Vulnerability scanners tell you what's wrong with what you already pulled. They don't stop a malicious package from entering your environment in the first place. A private registry with minimum release age policies adds that missing layer – packages newer than two or three days don't reach developers until the industry has had time to identify and remove malicious ones from public registries. Active campaigns like TeamPCP are targeting npm, PyPI, and Maven Central right now. The gate has to come before the scan. Cloudsmith provides that gate.

AI makes it easy to write more code. The question is whether that's actually a good thing.

Without constraints, feedback, and clear standards, AI can create complexity faster than teams can manage it.

The question isn't whether your proposal is good, it's whether it's more important than everything else competing for the same time, people, and budget. That's why the strongest proposals explain the impact, not just the work.

Give Codex access to CI feedback and it can diagnose failures, make a fix, and keep iterating until the pipeline is green. Here's the CircleCI plugin in action.

A fresh Chunk Sidecar took 45.6 seconds to start. With a snapshot, it only took 12.

Pre-install scripts mean a malicious package can compromise a developer's laptop the moment it's pulled – no build, no deploy, no install required. That breaks the old model where scanning catches a bad package after the fact, when it's already too late. The fix is active policy enforcement at the point of pull, using signals like package age, signed provenance, and maintainer trust to filter out malicious packages before they ever land.

AI wrote the code, but when something breaks, that's still on you. Code ownership matters more than ever.

Learn how to connect OpenAI Codex to CircleCI so your coding agent can check pipelines, diagnose failed builds, fix bugs, and iterate until your CI pipeline is green. In this step-by-step demo, we walk through how to install and authenticate the CircleCI CLI, install the CircleCI plugin for Codex, validate your CircleCI configuration, and give Codex direct access to CI feedback. You’ll see how Codex can.

Compliance work that lives outside the build pipeline becomes developer friction – and friction kills adoption. The simpler fix is to make SBOM generation a standard pipeline step via a reusable template, with output routed automatically to central storage and surfaced to the teams who need it. When developers can see their own license issues and vulnerability exposure without filing a ticket, compliance stops being a tax and starts being a byproduct of shipping.

Waiting minutes for CI feedback while you're building with AI agents kills your momentum. Chunk sidecars snapshots let you freeze your environment after setup, so every boot skips the install and starts from a cached state instead of scratch. In this tutorial, we demo how to set up Chunk sidecars, snapshot it, and boot from that snapshot. We also benchmark the difference: a cold sidecar start took 45 seconds. Booting from the snapshot took 12 seconds. That's 30+ seconds saved on every run, multiplied across every developer, branch, agent, and session.

Claude Code + CircleCI MCP = no more hunting through build logs.

When AI writes the code and something breaks, nobody knows what it was supposed to do.

A vulnerability scanner tells you what's wrong with dependencies you've already pulled. A dependency firewall decides what enters your environment in the first place. Instead of pulling blindly from public registries, every request is proxied through the firewall – where policy controls what's permitted, threat intelligence flags malicious packages that scanners never see, and enforcement happens at the earliest possible point. Scanning what's already inside is too late.

AI agents write code fast, but without a validation layer, fast just means faster bugs. In this video, we connect Claude Code to the CircleCI MCP server so Claude can trigger pipelines, pull build failures into context, and iterate until everything is green. No context switching. No copy-pasting logs.

Technical proposals can be like campfire stories. You start at the beginning, walk through every discovery & technical detail, and eventually arrive at the point. The problem? By then, you've lost the audience.

A golden path for dependency management isn't a policy document – it's a preconfigured private registry with upstream proxies covering every ecosystem your teams use, set as the default. Developers don't opt into security; they get it automatically by using the standard toolchain. The alternative is teams configuring their own controls, producing inconsistent postures and compounding risk across the org. If the secure path requires extra steps, developers will route around it. Make it the easiest option and the policy enforces itself.

Same repo. Same tasks. Same validation gates. The only difference? Where validation happened. Here's how Chunk sidecars returned feedback in 22 seconds versus about 69 seconds through a traditional CI pipeline, giving the agent enough time to catch the failure, fix it, and revalidate before pushing.

When a malicious package is first published, threat intelligence sources haven't flagged it yet – and every team pulling from a public registry is exposed during that entire window. The fix isn't faster scanning; it's a policy that holds new packages for a defined cooldown period before they're eligible to pull. By the time the window closes, the threat intelligence has caught up. Teams pulling direct from npm or PyPI have no equivalent enforcement layer – which is exactly how attacks like Shai-Hulud got in.