AI & Reproducible Builds
This is a passing thought I had last week. I don’t have any answers yet, but I wanted to record the question.
For years people have talked about creating repeatable build processes. One of the primary benefits is the ability to rebuild and verify a given version of a software project from a given source control checkpoint. Before AI, having the ability to deploy an older, verified version of software was likely a useful thing. Today, with AI and its ability to find vulnerabilities in software at a rapidly increasing rate I’m not sure deploying an older version of software would be reasonable or desirable. Any piece of software that is older than a week likely has vulnerabilities in itself or its dependencies. Deploying an older version of software in this world doesn’t really make sense. Combined that with AI-based development, and I wonder if it still makes sense to store all of the changesets in source control.
I can’t imagine it would be deemed a good idea to a deploy an older version of the software with known vulnerabilities. Combine that with AI-enhanced development, and I wonder if it still make sense to keep the entire change history? The extra history consumes valuable context space the AI needs, and fixing any new issues would require pushing forward instead of rolling back.
I haven’t fully thought this through, but ultimately wonder if we need a new paradigm in source control for the AI era.
