{ "video": { "id": "7b9tov5Uc5s", "title": "Rebuilding CI for AI-Scale Commit Volume — Gautam Korlam, Sonar", "duration": 1159, "upload_date": null, "channel": "AI Engineer", "source": "AI Engineer", "event_format": "" }, "analysis": { "video_id": "7b9tov5Uc5s", "title": "Rebuilding CI for AI-Scale Commit Volume — Gautam Korlam, SonarSource", "one_liner": "Merge queues, CI and review were all built for human speed. With agents opening several PRs a day each, you need sub-minute incremental CI, AI-first review with policy-based auto-approval, and a durable audit record of every check, finding and approval, because CI logs expire.", "summary": "Gautam Korlam spent nearly a decade on Uber's build and merge infrastructure and is now at Gitar, which Sonar acquired. He argues that the merge queue, CI and review are centralized bottlenecks in the SDLC, and that agent-driven 'software factories' are pushing them over capacity. He draws on Uber's SubmitQueue and on Gitar's own data: commits up about 10x, and the PRs Gitar reviews growing about 25% month over month. His prescription has four parts: make CI fast, make review fast and AI-first, shift checks left, and enforce policies beyond CI. For regulated industries he adds one more: keep a record of who or what made, tested and approved each change, so it can be audited after CI artifacts expire.", "key_points": [ "At Uber, one monorepo took thousands of changes a day with long builds. Merging them one at a time could take up to 20 days to get to green. Letting everyone merge freely left main, and the iOS monorepo, red all the time. SubmitQueue fixed this by testing likely combinations of incoming commits in parallel, predicting breakages, sending a likely-breaking PR back to its author, and only landing changes on trunk if they passed with all the combinations. It still runs at Uber.", "The merge queue, CI and review are centralized bottlenecks built for human speed. Agents produce several PRs a day per developer, and background agents fire from workflows, so the queues pile up and everything slows to a crawl.", "Gitar's own commit rate has almost 10x'd in about 3 years with the same small team. The number of PRs Gitar reviews is growing about 25% month over month, which he says matches the PR growth GitHub has reported.", "On Gitar's platform, at least 13% of PRs had a recorded CI failure. Each one costs a repair round trip, and it also holds up review, because humans usually won't look until CI is green.", "Gitar cut CI from about 10 minutes to under a minute for incremental builds. The Rust build caches outputs aggressively, compiler churn was reduced so builds are invalidated less often, tests are sharded, and overheads were removed.", "Measuring P90 time from PR to production, both at Uber and in most teams today, the vast majority of the time is spent in review, not CI. Many reviewers now rubber-stamp PRs because they can't keep up.", "Uber lost its licence to operate in London after a feature-flag change let drivers onto the platform without proper checks. It won the licence back by tracing whether each change affected London and which controls applied.", "In one case, Gitar's reviewer caught a flaky-test risk before merge: a shared test database used with parallelized tests had no guards, so a busy CI could cross-contaminate tests. Gitar suggested the fix, committed it and added the engineer as co-author." ], "takeaways": [ "Make CI fast enough that repairs are cheap. Cache, shard, parallelize, reduce compiler churn, and move expensive checks to post-merge where you can.", "Make AI the first pass on review and send only exceptional or high-risk changes to humans. Auto-approve low-risk changes, such as docs, non-breaking dependency bumps, security patches and internal tooling, using policies written in plain English. Always require a human for sensitive areas like payments or auth.", "Shift checks left so agents catch failures locally, where they have more context. Enforce compliance policies such as HIPAA and DORA beyond 'CI is green'.", "Enforce separation of duties. An agent must not approve its own change, and the engineer who prompted it counts as an author, so they can't be the approver either.", "Record which agent made the PR, the session it came from and who triggered it. Save the actual test report against the commit, not just a status. Record how each finding was resolved, and give a named reason for every override. Keep all of this on the PR or another system of record, because CI artifacts expire." ], "topics": [ "ci-cd", "merge-queues", "code-review", "agents", "software-factories", "compliance", "monorepos", "build-performance" ], "tools": [ "Uber SubmitQueue", "Gitar", "Sonar (SonarSource)", "GitHub merge queues", "GitHub", "Rust", "cargo-nextest", "HIPAA", "DORA" ], "quotes": [ { "text": "at least 13% of PRs had a recorded CI failure", "at": "07:20", "url": "https://www.youtube.com/watch?v=7b9tov5Uc5s&t=440s" }, { "text": "just because the code compiles doesn't mean that it's following a particular specifications", "at": "10:23", "url": "https://www.youtube.com/watch?v=7b9tov5Uc5s&t=623s" }, { "text": "you don't want to have the agent who made the change approve its change because that would not be uh zero trust", "at": "14:36", "url": "https://www.youtube.com/watch?v=7b9tov5Uc5s&t=876s" }, { "text": "So the control here is making sure that the change was approved and tested by someone who did not write it.", "at": "15:57", "url": "https://www.youtube.com/watch?v=7b9tov5Uc5s&t=957s" } ], "words": 4290 }, "summary_url": "/#7b9tov5Uc5s", "transcript": { "html": "/transcripts/7b9tov5Uc5s.html", "txt": "/transcripts/7b9tov5Uc5s.txt", "vtt": "/transcripts/7b9tov5Uc5s.vtt" } }