{ "video": { "id": "-AKPRSYccJc", "title": "How to Build Quality Gates into Agentic Coding Workflows — Nnenna Ndukwe, Qodo AI", "duration": 3465, "upload_date": null, "channel": "AI Engineer", "source": "AI Engineer", "event_format": "" }, "analysis": { "video_id": "-AKPRSYccJc", "title": "How to Build Quality Gates into Agentic Coding Workflows — Nnenna Ndukwe, Qodo AI", "one_liner": "Write your code-quality standards down once, as rules and skills kept in a shared context layer, then check the same standards at every stage (planning, code generation, local gates and PR review), using deterministic linters alongside AI review.", "summary": "Nnenna Ndukwe of Qodo argues that agentic coding needs 'quality-driven systems'. A team first defines what code quality means to it, then codifies that definition as rules and skills. Those must be distributable to the CLI, the IDE and CI, so agents are checked against the same standards early and often. In a hands-on workshop on a forkable FastAPI payments repo (Qodo Quality Workshop / Signal Pay), she uses Codex to pick the relevant repo rules, write a structured plan, implement a refund workflow, run local gates and open a PR. Qodo reviews the PR and an agent skill auto-resolves the findings.", "key_points": [ "Code quality can break down at every stage of the agentic lifecycle: planning and design, development, code review, testing and deployment. Standards should therefore live somewhere every interface can reach, either in the repo or in a context management layer such as Qodo or Unblocked.", "The workshop repo contains an AGENTS.md, a hidden plan directory, rules, skills, docs, tests, Semgrep static analysis and a CI verification workflow. The task is deliberately small and risky: adding a refund or capture-retry workflow, because 'payment mutations' are where AI code can look plausibly correct but introduce issues.", "The planning templates have two levels: a high-level plan and a build-session execution plan. Sections cover summary, problem, constraints, skill routing, scope, behaviour scenarios, verification gates, failure and recovery rules, commit plan, starting state (branch, verification commands), an implementation skill handoff, a test plan and definition of done / deferrals. More detailed, structured plans help agents adhere and self-correct.", "Local verification gates are Ruff, Pyright, Bandit, pytest, Semgrep and Conventional Commits. They are 'deterministic evidence that the changes made locally preserve the local contract', combined with AI review.", "On one of her own open-source tools, she ran the full workflow on a deliberately large PR of over 1,900 lines. Qodo's automated review found only one bug, a reliability bug.", "Qodo's portal ingests rules from rules directories and suggests new rules inferred from codebase conventions, with good and bad code examples. Rules are categorised (accessibility, correctness, maintainability, architecture, security) and given severity levels. Action-required or high-severity violations can block merges. An example was an org rule requiring docstrings on all Python functions.", "In the live demo, Qodo's PR review invoked five skills and found 1 bug, 3 rule violations and 2 skill insights. The bug was refund idempotency stored in a process-local dict, which is not durable. The Qodo PR resolver skill's 'autofix all' then fixed the issues, re-ran verification, committed and posted a summary back to the PR, and all issues were resolved.", "Rule relevance at review time is chosen by an agentic RAG-like process, not deterministically. She acknowledged that regulated enterprises want deterministic rule application, and said she hopes to push for it." ], "takeaways": [ "Fork the workshop repo and ask your AI to analyse its structure for verification steps and practices to adopt in your own workflow.", "Codify team standards as rules and skills in a shared context layer (Qodo, Unblocked, or the open-source Packmind) that planning, codegen and review can all pull from. Scope them by org, language and repo.", "Use structured planning templates that include skill routing, verification gates, a commit plan and definition of done. Prompt 'do not write the code yet' or use plan mode.", "Always run a local code review and deterministic gates (linters, type checking, security scanning, tests) before a PR. After fixes, re-run verification.", "Assign severities to rules so only the important ones block merges. Use a tool like Tessl to evaluate whether skills are actually effective and safe." ], "topics": [ "agentic coding", "code quality", "code review", "quality gates", "agent skills", "planning", "static analysis", "context management" ], "tools": [ "Qodo", "Codex", "Claude Code", "FastAPI", "Semgrep", "Ruff", "Pyright", "Bandit", "pytest", "Conventional Commits", "GitHub", "GitHub CLI", "uv", "Node.js", "npm", "Pydantic", "Unblocked", "Tessl", "Packmind", "Aaron Francis audit skills" ], "quotes": [ { "text": "payment mutations are where a lot of AI generated code can look like plausibly correct but can introduce some issues", "at": "17:26", "url": "https://www.youtube.com/watch?v=-AKPRSYccJc&t=1046s" }, { "text": "I am a huge believer in combining deterministic tools with uh AI.", "at": "12:50", "url": "https://www.youtube.com/watch?v=-AKPRSYccJc&t=770s" }, { "text": "always run a local code review because there are always these small changes that you could probably make earlier before another developer has to see your code", "at": "30:56", "url": "https://www.youtube.com/watch?v=-AKPRSYccJc&t=1856s" }, { "text": "Not every uh not every rule should be treated with the same level of severity.", "at": "33:56", "url": "https://www.youtube.com/watch?v=-AKPRSYccJc&t=2036s" } ], "words": 8971 }, "summary_url": "/#-AKPRSYccJc", "transcript": { "html": "/transcripts/-AKPRSYccJc.html", "txt": "/transcripts/-AKPRSYccJc.txt", "vtt": "/transcripts/-AKPRSYccJc.vtt" } }