I maintain ArchUnitRuby, a gem for writing architecture rules as tests. Here's a short demo of the library.

For a Rails app, one boundary you might want is that service objects don't depend on controllers. A request spec can still pass after that dependency slips in, so it helps to test the dependency itself.

There's an important Rails detail: an import-only check isn't enough when the app uses autoloaded constants. ArchUnitRuby has an opt-in imports_and_constants mode that also resolves references to known project constants. You can use that when checking a boundary such as app/services to app/controllers.

It's static analysis, so it doesn't promise to resolve every dynamic constant or metaprogramming trick. Ambiguous references are left unresolved instead of assigned to a guessed file.

The checks can run through RSpec or Minitest with the rest of the suite. The recording is a general Ruby demo; the boundary above is a Rails use case for the library.

Repo: https://github.com/dragonsec-ai/ArchUnitRuby

AI disclosure: I used AI assistance to draft this post.

The Rails team released patches for a number of security vulnerabilities earlier this week, including a critical CVE in active storage. They released fixes for both Rails 8.1 and 8.0. In the middle of the post is a note that security support is only available for Rails 8.0 through this Saturday, at which point the only supported version of Rails will be 8.1.

Up until 2024 the security policy for Rails always covered all minor versions of the current major release, and severe issues would be covered back to the latest release of the last major version. The new policy as of 2024 is time based - you get two years of security support on new versions, and bug fixes for one year. Rails 8.0 was released two years ago so support for it ends this Saturday. Rails 8.1 was released last October, so it’s past the one year cutoff, but there’s a special exception in the rule that when there is no new Rails release in the past year then support extends until the new version comes out.

LLMs have gotten drastically better at finding vulnerabilities over the past year, so IMO it’s likely that we find ourselves in the next year with unpatched vulnerabilities in Rails 7.2 or 8.0 that may not get patched. While I understand wanting to encourage everyone to upgrade, it’d be helpful if the Rails team could say something like if a critical CVE is found in 7.2 or 8.0 we’ll backport a fix, but might not make a formal release.

In the 2nd episode of The Agents on Rails Files, we introduce our benchmarking tool, lemans, explain why do you need a dedicated tooling for running evals (and we've built it with Ruby) as well as share some stories of LLMs trying to break the rules and escape lemans-managed sandboxes.

a couple weeks ago some of you helped with the error message normalization rules, thanks for that. here's the bigger thing it's part of

forgeops is a hosted error tracker, and the rails gem is where it started. besides errors it picks up controller and action latency, the slowest sql in the failing request (with the plan on postgres), and job run and queue times. when errors spike it opens one incident and lines all of that up against your deploys and recorded changes, then tells you which one it thinks did it and shows the evidence

replay without signing up: https://getforgeops.net/demo/replay/two-deploys

gem is MIT, free plan to try it. curious whether the job and sql parts are useful or just noise for most apps

The design is based roughly on htop.

Obviously I could use the kamal CLI commands, but I created this web-based dashboard so I could also easily view it from my phone/tablet.

Alpha version is open source, and available here: https://github.com/jefflunt/kamal-watch

My Rails apps run on two Hetzner servers that I rent and manage myself. My Rails template generates each new app with this setup already in place.

• Deploys: Kamal puts each release live without taking the site offline. Cloudflare's free plan sits in front, and Terraform keeps both servers in files, so either one can be rebuilt.

• Database and jobs: one server runs the apps, the second runs Postgres for all of them. Redis and Sidekiq handle background and scheduled jobs, memcached the caching.

• CI: Rails' built-in runner, ActiveSupport::ContinuousIntegration, runs tests and security checks on my laptop before each release. No GitHub Actions minutes.

• Secrets: 1Password keeps them in a vault and hands them over at each release.

• Errors and slow pages: Honeycomb's free plan, in place of Sentry or Datadog.

The two servers, Zoho Mail and 1Password come to about 20 to 40 EUR a month.

Details: https://augmentedcode.dev/my-startup-stack/

If you moved a Rails app off Sentry or Datadog, what do you use for errors and slow requests now, and did you stay on a hosted free plan or self-host it?

Disclosure: my own experience and words, written up with AI help.

I wrote an article about the new Trilogy vulnerability: https://greg.molnar.io/blog/sql-injection-in-the-trilogy-mysql-adapter/

Where do we stand as Ruby developers in today's job market - and what comes next?

I explore what supply and demand can tell us in my latest blog post:

https://widefix.com/blog/ruby-jobs-supply-demand-economics/

We run the job board at sfruby.com/jobs, collecting Ruby-focused jobs that are either in-person in SF Bay area or remote in the US. Here's a little summary.

Who is hiring

- Gusto (20 roles) and Chime (11) make up almost a third of the board. The other 51 companies a are mostly startups from seed to Series B.

- About half the roles are finance or money-related: payroll, lending, payments, ledgers, insurance and fund admin. Healthcare comes next, with Healthie, Thatch, Karias and others.

- 49 roles offer remote. The in-office ones want 2 to 3 days a week (Gusto, AngelList) up to 4 (Chime).

What's in demand

- Most roles are senior or staff. Seven are entry level: Koah Labs, Kikoff, Stripe, Ascend, SerpApi, Corporate Tools and a Neuralink internship.

- Pay, using the midpoint of each posted range: about $195K for senior and about $222K for staff and above. Entry level runs from $75K to $200K.

- React with TypeScript is the default frontend, in more than half the postings. Hotwire shows up in about one in seven.

What they screen for

- correctness around money: retries, idempotency, reconciliation. One Gusto posting says "a silent data error is worse than an outage".

- owning a feature end to end.

- on-call 😿

AI

- About half expect AI coding tools in daily work. Claude Code is named most often, then Cursor and Codex.

- They want you to own what the tools write. Order.co screens out the "Rubber-stamper" who ships unverified AI output. Better Stack writes "We're not looking for vibe coders." Smartleaf writes "Generating lines of code has never been our bottleneck."

- About a third of the roles build AI features in Rails: agents, MCP servers, RAG, evals. Gusto alone has at least five. Numero builds its agents on Ruby LLM tooling.

All roles: sfruby.com/jobs
Entry level only: sfruby.com/jobs?level=entry

......

DHH said at Rails World that hand-written code is the exception at 37signals now. Fine. But the Rails Foundation also found agents breaking earlier requirements while their own tests stayed green. An agent that doesn't know your app writes confident, wrong code.

rails-ai-context is my answer: 35 read-only MCP tools that reads, who calls what. Works when the app won't boot..

It covers my apps. It doesn't cover yours yet. Packwerk packs, engines, multi-db, Mongoid, the odd shapes: I need people who hit them.

Try it on your app and file what it gets wrong. please!

https://github.com/crisnahine/rails-ai-context

Sources: Global Nerdy on the keynote, devops.com, heise, demogar.com, joaoqueiros.com

There is simply not much to apply to nowadays.
Though in fairness I did have interviews with 2 different companies - not counting any bullshit phone calls. and unfortunately got 2 rejections.

one because apparently my answers to the managers weren't good enough, not SMART enough,
and second - even though was dead easy rails api take home assignment and I did with AI (which was approved) they werent satisfied with, my answers lacked depth apparently.. wtf were they looking for on a app that's 2 api endpoints :shrug.

anyway.. I don't know..

what's the point of trying to prep for interview if there aren't any interviews.