Learn AI code review, quality gates and SBOMs

• What is AI code review?

  AI code review uses a language model to read a code change and flag bugs, risks and gaps. What it catches, what it misses, and how to make it a gate.

• What are quality gates?

  A quality gate is a pass or fail decision a change must clear before merge or deploy. What gates check, how they differ from checks, how to design them.

• How do AI agents fit into the software lifecycle?

  Where AI agents help across plan, build, review, test, release and operate, how multi-agent teams divide work, and where a human must stay in the loop.

• What is software supply chain security?

  Software supply chain security protects what goes into your software and how it is built. SBOMs, CycloneDX vs SPDX, and license policy for AI-written code.

• How do you secure AI-generated code?

  Securing AI-generated code: SAST vs SCA, secrets scanning, the threats specific to coding agents, and the controls that keep AI changes from shipping unchecked.

• How much does AI coding cost, and how do you control it?

  How AI coding is priced per token, why agent sessions cost more than chat, how to estimate spend per developer, and the caps that stop a runaway bill.

AI code review

• How to handle false positives in AI code review

  Why AI code reviewers flag problems that aren't there, how to triage false positives without hiding real bugs, and how to tune context, prompts and thresholds.

• How to review code written by an AI agent

  A practical approach to reviewing AI-generated pull requests: what to read first, the mistakes coding agents commonly make, and how to avoid rubber stamps.

• AI code review checklist: 25 checks for AI-written pull requests

  A printable checklist of 25 checks for reviewing AI-written pull requests: scope, evidence, tests, correctness, security, dependencies and approval.

Quality gates

• Fail open vs fail closed: how quality gates should handle errors

  What fail open and fail closed mean for CI and release gates, why a gate that passes on error is off when it matters, and how to fail closed without stalls.

• Test coverage gates: floors, new-code coverage and their limits

  How test coverage gates work, line vs branch coverage, gating new code instead of the whole project, and why coverage can't prove your tests check anything.

AI agents in the SDLC

• Where to put human approvals in an AI coding workflow

  Which moments in AI-assisted delivery need a person's approval, how separation of duties works when an agent writes the code, and how to avoid rubber stamps.

• Multi-agent patterns: pipelines, parallel reviews and debate

  The common ways to split software work across AI agents (pipelines, parallel reviews, debate, orchestrators, verify loops) and how each pattern fails.

Software supply chain

• What is an SBOM? Contents, types and how to use one

  A software bill of materials in depth: what goes in one, component identifiers, SBOM types from design to runtime, how to generate one, and how VEX fits.

• What is SLSA? Build provenance and levels explained

  SLSA explained: the build track levels, what a provenance attestation records, how to verify one before you deploy, and what SLSA does not protect you from.

• EU Cyber Resilience Act: timeline, SBOM rules and a checklist

  The EU Cyber Resilience Act for software teams: the key dates, who it covers, the 24-hour reporting duty, what it says about SBOMs, and a checklist to use.

Secrets and security

• Prompt injection in AI coding agents

  How prompt injection reaches coding agents through issues, code comments, docs and tool results, what an injected agent can do, and the controls that help.

• What to do when a secret is committed to Git

  A step-by-step response to a credential committed to a Git repository: revoke and rotate it first, check for misuse, clean the history, prevent a repeat.

AI coding costs

• Prompt caching explained: how it cuts the cost of AI agents

  How prompt caching works, why it suits AI coding agents that resend a growing context every turn, what breaks a cache, and how to check it is working.

• AI coding budgets: soft limits, hard caps and per-workflow caps

  How to budget for AI coding agents: choosing a period, setting soft limits and hard caps, where enforcement must happen, and per-workflow caps.