Lachlan Donald

Co-founder, CTO @buildkite, Dad, Llama Aficionado (not the model). Previously @GroqInc @PatientNotesApp @cashapp, @99designs.

[Lachlan Donald @lox]

@pepicrft @NathanFlurry Not yet, but this is a good reminder that I should

[Lachlan Donald @lox]

@Suchintan Right, that doesn’t have to be PRs

[Lachlan Donald @lox]

@thorstenball @hmemcpy He's also not not judging you though...

[Lachlan Donald @lox]

@karlclement We use PRs and feature branches, but have lots of automation to allow rapid review / approve / merge. Merge queue still painful, we're considering ditching it too. Also using Orbs a lot :D

[Lachlan Donald @lox]

This is how lots of folks run CI. Rather than using the branch merge base, they use whatever the latest main branch head (GitHub exposes this as refs/pull/*/merge).

The challenge is, as it updates you need to propagate that change to all branches and open PRs and re-run lots of tests. Similar challenge in stacked PRs.

I agree it seems optimal, having an agent handle each of those merge ref updates would be interesting.

I wonder if we could have agents mediating all rebases 🤔

[Lachlan Donald @lox]

@sama I’m dying to know what the thinking was around going back to named models after all the hardship of consolidating down to gpt-5 with levels of reasoning. Seemed like such a great decision in the time of 4o and o1 and o3.

[Lachlan Donald @lox]

Lots of Buildkite customers have been asking us for npm Trusted Publishing support.

We already have OIDC workload identity and we’re keen to do the work to become a supported provider.

@npmjs / @github, who should we work with to get @buildkite added? 👋

[Lachlan Donald @lox]

@samgoodwin89 Yeah, it's pretty frustrating. I've been trying to get in touch with them for @buildkite. The OIDC pieces are already there, this was a deliberate choice by them.

[Buildkite @buildkite]

Engineering teams running CI with @buildkite spent today building uninterrupted 👀

[Daniel Cuthbert @dcuthbert]

Oooohkay let’s talk about this @OpenAI incident

The @BlackHatEvents review board had questions. You all had questions and we put them to the OpenAI team to answer

No fluff
No marketing
Just what in gods name happened

[Lachlan Donald @lox]

@BenceRedmond Why?

[Dino A. Dai Zovi @dinodaizovi]

Oh look, more long-term authentication keys (SSH keys) just sitting as files on the filesystem when every end-user device today has hardware-backed key storage.

Generate and keep your SSH keys hardware-bound to a TPM, Secure Enclave, or Yubikey. It's 2026.

[Lachlan Donald @lox]

@diptanu Next for @buildkite !

[Florian Brand @xeophon]

👨 "okay let’s fix XY"
🤖 "done" +1,292 -50 LOC
👨 "are you sure that’s the best way?"
🤖 "you are right" +640 -53 LOC
👨 "i think we just need to touch Z?"
🤖 "oh yeah lmao" +5 -7 LOC

[Lachlan Donald @lox]

@willdepue I use https://t.co/ebcBNT94ZR via the skill in codex and @AmpCode

[Ryan Djurovich 😎 @ryan0x44]

Putting all of your technical docs in the same repo as your code is essential for coding agents. When making changes to the system, ensuring the agent updates docs as it makes changes gives you huge leverage as a reviewer: review the changes to the docs first - faster, easier.

[Jay @jayair]

https://t.co/i8kONJP3Ag