E04 - Quality gates that actually run: verification and security in the agentic workflow

Описание: Quality gates that actually run: verification and security in the agentic workflow

Pre-commit hooks, CI, a mental checklist — three quality gates that never quite agree. Alex and Mia dig into part 4 of the agentic (.NET) developer workflow series: two skills, /dev-verify and /dev-security, that collapse all of that into one command each. Build + analyzers + format + tests + Aspire runtime + AI diff review before the PR even opens. And when you need it, a full OWASP Top Ten 2025 review.

Structure from the skill. Judgment from the AI. Consistent on every PR.

Read the full post: https://eriklieben.com/posts/agentic-...

More info: https://podcast.eriklieben.com/agenti...
All episodes: https://podcast.eriklieben.com

Chapters
0:00 Intro
0:18 Three gates that never agree
0:37 /dev-verify and /dev-security — two skills, one workflow
0:50 Auto-detect the stack, run both if needed
1:03 Collect all failures first — no whack-a-mole
1:28 Aspire runtime checks catch what unit tests can't
1:48 The build runs twice — fast dev + CI-strict on demand
2:14 The diff review — AI reasoning beyond linters
2:42 Angular side — AOT template errors dev mode misses
3:12 /dev-security — full OWASP Top Ten 2025
3:36 The cold-sweat critical findings
3:49 No secrets in environment.ts
4:04 XSRF — half right equals wrong
4:35 Skill is the checklist, AI is the judgment
5:03 CI alignment — the difference is the bug
5:29 What it isn't — not a replacement for a manual audit
5:46 Skills as markdown — fork them for your own stack
6:02 Structure plus judgment — the sweet spot

About this podcast
"Erik's blogs podcast" is an AI-generated conversation between two hosts, Alex and Mia, based on blog posts from eriklieben.com. Topics cover .NET, TypeScript, Azure, event sourcing, developer experience, and how AI changes the way we build software.

#AgenticDev #DotNet #Angular #DevSecOps #OWASP