You're right, I used an LLM to help write it from sketches. Gonna rewrite it properly because I think the ideas are worth exploring.
Thanks for taking the time to read and reply.
Many of the suggestions in this thread (min-release, ignore script) are defenses for the consumers.
I've been working on Proof of Resilience, a set of 4 metrics for OSS, and using that as a scoring oracle for what to fund.
Popularity metrics like downloads, stars, etc are easy to fake today with ai agents. An interesting property is that gaming these metrics produces better code, not worse.
These are the 4 metrics:
1. Build determinism - does the published artifact match a reproducible build from source?
2. Fuzzing survival - does the package survive fuzz testing?
3. Downstream stability - does it break any repos dependent on this project when pushing a release?
4. Patch velocity - how fast are fixes merged?
Here's a link to the post, still early but would appreciate any feedback.
SEEKING WORK | Sweden | Fullstack javascript developer | Remote and available to travel
Experienced developer with a wide array of experience working on projects such as realtime mobile games, e-commerce sites, an analytics dashboard for internet of things data, food-ordering apps, ticketing platform, bots and more.
Current stack of choice:
React, GraphQL, Gatsby, Serverless, styled-components