
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
dev-workflows
Advanced tools
Define rules once. Compile them everywhere.
A local-first CLI to define AI coding rules and compile them for every editor and agent.
npx dev-workflows init
devw add react-conventions
devw compile
.dwf/rules/*.yml → devw compile → CLAUDE.md
.cursor/rules
GEMINI.md
You define rules in YAML. The compiler generates each editor's native format. Change a rule, recompile — every editor stays in sync.
| Command | Description |
|---|---|
devw init | Initialize a .dwf/ ruleset in your project |
devw add <block> | Install a prebuilt rule block |
devw remove <block> | Remove a rule block |
devw compile | Generate editor-specific rule files |
devw watch | Watch .dwf/ and recompile on changes |
devw doctor | Validate config and detect rule drift |
devw list rules | List all active rules |
devw list blocks | List installed blocks |
devw list tools | List configured editors |
Prebuilt rule blocks you can stack. Install with devw add <block>.
| Block | Purpose |
|---|---|
typescript-strict | Enforces strict TypeScript patterns |
react-conventions | Common React component and hook rules |
nextjs-approuter | Next.js App Router best practices |
tailwind | Utility-first styling conventions |
supabase-rls | Database security and RLS rules |
testing-basics | Test naming and structure rules |
Bridges generate editor-compatible rule files. One adapter per tool.
| Tool | Output |
|---|---|
| Claude Code | CLAUDE.md |
| Cursor | .cursor/rules/devworkflows.mdc |
| Gemini CLI | GEMINI.md |
| Windsurf | .windsurfrules |
| VS Code Copilot | .github/copilot-instructions.md |
Issues and PRs welcome. If you find a bug or have an idea, open an issue.
MIT
FAQs
CLI that compiles developer rules into editor-specific config files
The npm package dev-workflows receives a total of 24 weekly downloads. As such, dev-workflows popularity was classified as not popular.
We found that dev-workflows demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.