You can sometimes get by for a while not doing them both but it’s hard to survive doing neither.

NPM’s unwillingness to do so reflects GitHub’s: both show excessive caution that harm both security and usability.

Weird watching in hindsight when I was very much pre-AI.

If anything, AI only makes the guardrails more important and valuable.

Career security is what matters.

You build it by learning, changing, taking risks, being reliable and stepping outside your lane.

Your employer won’t prioritise your long-term career.

You should.

With async PR review, I prefer the “✅ with comments” review. Unblock the person from merging with trust they will read and resolve your comments first.

For coworkers only, sometimes fine explaining your testing and why reviewed isn’t necessary e.g. a one-time script.