Surely at that point they could write the code themselves faster than they can review 5 PRs.

Producing more slop for someone else to work through is not the solution you think it is.

Give your juniors reasons to stay at your company? It's not hard if the company cares at all.

>It's not hard if the company cares at all.

It's pretty hard for a non-big tech company to pay big tech level salaries.

And most of my friends and colleagues would take a full remote role that pays half what big tech, 5 days in office pays. Add in an extra week of PTO and you have a great pitch to devs.

I'll believe it when I see it reflected in applicant resumes. (east coast tech firm)

What do you mean? You’re not getting applicant resumes to your smaller org?

I personally turned down an Apple offer because they required 3 days in office and went this a much smaller fully remote team.

You can incentivize people to stay with things other than salary. Salary plays a part of course, but there is a lot of other aspects that make staying at a job worthwhile.

Yes, as much hate as it tends to get on here it's really fine. This vulnerability is unfortunate but every library/framework will have security issues over its lifespan.

The trivial nature of the initial exploit does not instil confidence, nor does it that no one noticed it during the refactor that lead to the second variation of the exploit.

> In a sense (American) politics is experiencing a vanishing middle of epic proportions

Is that true? Democrats are pretty centrist by non-American standards.

Isn't that what all of software development is? It's tools all the way down

You can start with HTML by using Notepad and a browser.

Aren't notepad and the browser tools? And of course you can start with those, but as projects grow more complex so too will the tools.

You don’t use Notepad and a browser to generate boilerplate for you.

> in many major cities, you can make it off of $65K

This is certainly not true in any of the cities near me.

I bet wherever you live, people making $65K a year aren’t homeless

In my opinion there is a large gap between "not homeless" and "making it"

And the original person I replied to was in the top percentile of income according to him and considered “survival” not being able to live his current lifestyle.

What do you consider “making it” for a single person?

> The problem is that this step will only run when I change something in the web-app1 folder. So if my pull request only made changes in api1 I will never be able to merge my pull request!

This just seems like a bad implementation to me?

There are definitely ways to set up your actions so that they run all of the unit tests without changes if you'd like, or so that api1's unit tests are not required for a web-app1 related PR to be merged.

Absolutely correct. When creating a new workflow, I always disable push/pull_request triggered builds and instead use the manually triggered `workflow_dispatch` method. This makes testing a new workflow much easier.

Additionally, you can use conditionals based on inputs in the `workflow_dispatch` meaning that you could easily setup a "skip api tests" or "include web tests" option.

It sounds like they have the logic to skip certain things if nothing has changed. The problem is around pull request gates and the lack of dynamic "these tests must be passing before merging is allowed". There are setting on a repository in the ruleset / status checks area that are configured outside of the dynamic yaml of the GHA workflow

Adding validation/access control to server actions is pretty much the same as for API endpoints though?

I'm not sure next.js is the right fit for a blog/personal site either, but that's an odd point imo.

Your site looks very nice though!