
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
dev-workflows
Advanced tools
Define AI coding rules once. Compile to CLAUDE.md, .cursor/rules, GEMINI.md.
AI coding tools (Claude Code, Cursor, Gemini CLI) each use different config files for project rules. dev-workflows lets you define rules once in YAML and compile them to each tool's native format. No duplication, no drift.
npx dev-workflows init
devw add typescript-strict
devw compile
Requires Node.js >= 22.
devw init # set up .dwf/ in your project
devw add typescript-strict # install a rule block
devw compile # generate CLAUDE.md, .cursor/rules, GEMINI.md
Running devw compile produces tool-specific files with your rules between markers:
<!-- BEGIN dev-workflows -->
- Never use `any`. Use `unknown` when the type is truly unknown.
- Always declare explicit return types on exported functions.
- Prefer union types over enums. Use `as const` objects when you need runtime values.
<!-- END dev-workflows -->
Content outside the markers is preserved — your manual notes stay intact.
| Block | Description |
|---|---|
typescript-strict | Strict TypeScript conventions (no any, explicit returns) |
react-conventions | Hooks rules, component patterns, naming |
nextjs-approuter | App Router patterns, RSC, server actions |
tailwind | Utility-first CSS conventions and design tokens |
testing-basics | Test naming, AAA pattern, mock boundaries |
supabase-rls | Row-Level Security enforcement and auth patterns |
| Command | Description |
|---|---|
devw init | Initialize config in current project |
devw compile | Compile rules to editor-specific formats |
devw add <block> | Install a rule block |
devw remove <block> | Remove an installed block |
devw list | List available blocks and rules |
devw doctor | Validate configuration |
See CONTRIBUTING.md for guidelines.
MIT
FAQs
CLI that compiles developer rules into editor-specific config files
The npm package dev-workflows receives a total of 24 weekly downloads. As such, dev-workflows popularity was classified as not popular.
We found that dev-workflows demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.