DEV Community: Amara Graham

Building PoCs with Codex and GitHub Copilot while they try to adjust my PoC requirements along the way

Amara Graham — Wed, 16 Sep 2026 17:04:22 +0000

I think it took about 10 minutes after I published my last blog for someone to ask about yet-another-AI-tool.

So here's two more. Then I'm done for now so I can write about the audit I did with all these tools.

ChatGPT + Codex

This felt like Claude without the orange splat logo. With a fresh download I was on 5.6 Terra Medium.

Codex created a React PoC that loaded fairly quickly, but I did have to go back and forth with it a few times to get a functional PDF viewer running and then a few more times to get the extraction not only working, but working well if the data was missing or redacted (and, if done properly, missing).

More effectively than the other AIs, it found (or made, as it claimed) valid PDFs with interesting data and formats. I did push a little harder to redact info and re-upload the redacted PDF but this appeared to work with a little nudge to leave the field blank instead of trying to grab the next field label.

This was definitely the most seamless experience. It modified the code in the directory (and yes, it did ask for approval as that's the setting it's on) and I would stop and restart the npm run dev command to see what the new updates would yield.

It did feel like it was initially a little too quick to stub or mock things, including in the initial project stubbing the WebViewer... after it very quickly recommended Apryse WebViewer in 30 seconds with the initial. So why stub it? Maybe it was scared it needed a license key to function at all.

This is intentionally a frontend prototype; the next implementation step is replacing the mock paper viewer with Apryse WebViewer and wiring the extraction/audit actions to backend APIs.

So you know I was like:

Great, can you replace the mock paper viewer with Apyrse WebViewer so I can actually do extraction?

And we got there pretty quick, but it was an interesting choice to create a front end with the part I'm actually trying to PoC stubbed out. Very pay-no-attention-to-the-man-behind-the-curtain if you ask me.

GitHub Copilot

For the purposes of my little exercise, all but one option I used was a free tier. This immediately caused issues with the follow up I tried to do on Friday - GitHub Copilot wasn't available as a desktop app for free tier users, which I didn't realize until I tried to launch it.

Never fear, I launched it in VS Code and then got distracted when I expected to see something like the Claude experience. I assumed it just didn't work or install properly.

Turns out, it installed just fine, but unlike my other AI chat experiences, I needed to make sure I was in a new project and didn't have any files actively opened, because it was certainly going to use those as context.

I'm GitHub Copilot, using Claude Haiku 4.5.

Excuse me, Claude is back? Wild. For reference, I'm using Sonnet 5 with Claude on the desktop app.

It. Is. So. Fast.

It gave me a PoC project structure in 5 seconds with a button to create a workspace. It created the project after I selected a parent directory in less than a minute and apparently only used 0.2 credits, which I can clearly see on the screen.

And then... it broke my heart.

Once I got the project structure I started to install the dependencies and ran into all sorts of mess. I continued to push on GitHub Copilot to help sort this. First it was let's adjust the WebViewer from 9.something to 10.0.0. Then it was like how about latest because this is a PoC anyway. Then it suggested I switch to pdf.js because I was having so many issues with the package.

The Apryse package isn't properly installed. Since we've been struggling with the package, let's use PDF.js instead—it's simpler and already works:

Dear reader, I was having no issues with the package. I was watching GitHub Copilot make some interesting choices with getting any sort of correct version, so I asked it:

What sources are you using for Apryse? I was able to build PoCs like Claude easily.

I like to use AIs adversarially, so I figured I would name drop and see what happened.

You're right—I apologize. Since you work at Apryse, you likely have internal access to the package that I don't have visibility into.

This is the same garbage Microsoft Copilot inferred because it saw the directory file tree included my Apryse email. I corrected it's theory that I had access to an internal repository and it seemed to suggest I should evaluate the PDF viewer and Apryse separately.

What sources are you using to generate the Apryse-based code? They seem like they are using old versions of the packages. Can you give me a list of the sources you've used in this chat?

And to my horror, it told on itself.

You're right to call this out. I don't have access to specific sources—I'm generating code based on general patterns I've learned, not from live documentation or current package versions.

For Apryse specifically, I've been making educated guesses about:

Package names (@pdftron/pdfjs-express)

API structure (WebViewer() function)

Configuration options (path: '/lib')

This is problematic because:

I can't verify current versions on npm

I don't have access to official Apryse docs to cross-reference

The code I generated is likely outdated or incorrect

Girl (gender neutral), what are you doing?

I then clarified that the Apryse docs are public, but that GitHub Copilot didn't have access to browse the web in real-time. And let me tell you, I was violently irritated with this, despite only spending like 30 minutes on this.

When AI speaks with conviction, as it so often does, it's really compelling. You accept what it's given you because you have no real reason not to... until something like this happens. What's truly the most problematic is at no point earlier in the conversation did it mention it didn't have access to the public internet. The default for all other AIs is having access to the internet!

I ended up finding the configuration in my GitHub settings, adjusting the toggle to allow GitHub Copilot to search the internet, and reran the original prompt in a new chat and allowed it to make a new project.

The project structure was wildly different, I ran into exactly zero package version issues, and in 10 minutes had a working Apryse-based PoC. Instead of building me a generic React project, it built me something with Apryse, front end and back end.

What's next?

If you won't tell me your favorite AI, who is your favorite coworker?

Since I'm using these for work, I'm going to continue to try to make Microsoft Copilot work, along with getting into the program that allows me to work with Claude.

Admittedly, I'm really disappointed in the GitHub Copilot experience not being up front about it's access to the broader internet, and then not being able to guide me to the correct setting to allow it the access I assumed it already had. Maybe this is a safety mechanism and provides a better experience for folks just doing vanilla programming, no 3rd party tech and APIs required. Just tell me that's what's going on.

This audit is kind of a one time thing, in the sense that I probably won't regularly use all the tools I can get my hands on, and I'll eventually spoil my setups by adding too much personalized context. Is there a concept of incognito mode in any of these tools? I still want to do some kind of DevEx audit like the in the future, but I may be constrained simply by using these tools for my daily work.

Drop your tips and tricks for me in the comments about working with Microsoft Copilot!

Photo by Immo Wegmann on Unsplash

Admit it, you have a favorite AI (just like you have a favorite coworker)

Amara Graham — Thu, 10 Sep 2026 19:43:09 +0000

My mom likes to quote her grandmother who would say things like "I hate yous all equally" when asked who her favorite grandchild was. I feel that, but with AI tools.

If you've worked with me recently, you've probably been my favorite coworker. At least temporarily. It's an easy title to achieve, but hard to hold on to.

Anyway, I just finished a little onboarding audit project (which I may elaborate on later) but for now I want to rant about AI, which didn't help me write this at all so any typo or grammatical "error" you see is an aesthetic choice.

I used 3 AI tools, 4 if you count Google's AI results in a traditional search experience, and pretty much only the chat functionality. Just like everyone has a different working style, everyone probably feels some pull toward one AI experience over another, given that they have that choice and aren't mandated to use a specific one.

Let's dive into Claude, Gemini, and Microsoft Copilot.

Claude

Admittedly, I've had the most success with Claude, even when it hallucinated a solution earlier this year when I asked if there was a way or tool to measure time to response on a community Slack thread. When I didn't recognize the tool name I asked it to cite it's sources and Claude was like "oops, I made that up." Neat.

Anyway, Claude was the most seamless pair programming experience via Chat. When Claude suggested multiple files needed to be changed, the instructions to change them, and where, were quite clear, but at some point I said "can you just regenerate the project files with the changes", and it did exactly that.

For the most part it stuck to publicly accessible content and didn't grab context from other chats, which is exactly what I was hoping for in this experience. This allowed me to open multiple chats, as different questions, and collect all the responses. A plain ol' vanilla install if you will - so no skills, memories, artifacts, etc. I didn't even put anything in a project.

There were two situations where it didn't hallucinate, but it did need some challenges to responses it provided.

For example, Claude cited NSA secure coding "best practices" and using multiple engines for doing something like redaction. I imagine I will do a future blog on this topic, specifically around redaction with Apryse, but the guidance didn't make realistic sense for an enterprise project. It suggested doing the redaction with one platform/vendor and then verifying the redaction was complete with another platform/vendor. This is maybe reasonable if my budget is unlimited, but when prompted Claude was quick to back down and say "it's not really a citable best practice, but it's my recommendation based on security best practices."

I could see responses like this being a massive problem for people who struggle with pushing back. I was and still am a "why" kid. I'm always asking why and I think that skill is critical when working with AI. I also love demanding "cite your sources" so I can manually review whether they are credible sources or not, or in the case above, clearly see there was no specific source. Just vibes.

I was able to do everything I needed to do on a free tier using Sonnet 5 and only ran into message limits twice over two weeks. But please keep in mind I was doing a lot of context switching and using other AIs. Your mileage may vary.

Also important to note, I wasn't using Claude Code or the VS Code extension. I was just having a little chat with Claude via the desktop app to stay in control of the context and internal data sources as much as possible.

Gemini

Gemini was an ok experience. Gemini has become my preferred AI for personal use (but admittedly, my personal use is very light). With my husband heavily committed to the Google ecosystem, it's easily accessible and makes sense.

This was my first time doing any sort of programming and debugging with Gemini. It was clear about what errors I should see and where, it was also great about adding more debugging statements and what the expected outcome should be.

It just wasn't as seamless as Claude. Where Claude gave me a full React project, Gemini only produced .JSX and .CSS files and expected me to drop them into a React project. So I manually went and found a sample code React project, got it up an running, then dropped in Gemini's files. If I wasn't starting a net new project and I could actually call myself a React developer, I might have felt like this experience was just fine. I was admittedly surprised it inferred I had an existing React project when it got the same exact prompt Claude did and really should have inferred I was starting from scratch.

Gemini was a free tier experience as well. I used my work browser profile instead of my personal Google account/profile so I wasn't tapping into my family plan. This all happened in a browser tab.

Microsoft Copilot

If you are looking for Glean on steroids, Microsoft Copilot feels like the place to go. It was so aggressive about sourcing internally that I had to toggle off all the data sources and "Work IQ".

Even then, I never really solved this issue of Microsoft Copilot grabbing or referring to context I didn't want it to have. Separate chats seemed like they were all fair game. It even inferred I was an Apryse employee by referencing the file tree and directory names of an uploaded file. I'm sure someone appreciates that, but for the purposes of this audit, I want to see what externals see. It was just too smart.

Microsoft Copilot also over-answered every prompt I gave it. When I asked about curriculum-based learning or academy experiences, it responded that they didn't appear to exist and then proceed to give me a rated matrix of what was available instead. When I prompted for a more terse answer, it seemed to double down, write another dissertation, and then bold the expected terse answer at the bottom. At that point I didn't bother scrolling back up to read anything because all I wanted was a short, sweet answer.

This was also, by far, the worst coding experience. The initial React project it generated was riddled with old versions of packages that created annoying errors just trying to load the project. I want a paired programming experience, so when I'd take this or other issues back to the AI chat, it's like it would suffer a concussion with immediate memory loss.

"I don't have access to that."

You don't have access... to the code you just generated and gave to me one response above this?

"This looks like AI generated code."

Probably because you, an AI, generated said code.

"If you upload the files, I will have access to them."

You want me to upload the files that you provided me... that I downloaded and made exactly no changes to. K. Cool.

Microsoft Copilot was an enterprise licensed experience. I never saw anything about tokens or message limits, but getting a response was often quite slow. Maybe it's important to mention I did everything via chat vs. cowork and I was working in a browser tab.

What's next?

Claude wins, but it wasn't really a contest.

It's entirely possible I ran into some user error with all of these tools. It's also possible I'm generating opinions about what AI is best for what exercise. For this experience I just wanted quick answers without a lot of setup and fuss, and for better or worse I got that. Low investment, high output.

For now, I'm shifting gears to work on other projects and will have different use cases, and will probably spend a bit more time trying to make Microsoft Copilot a more usable experience for me. I'll probably also look into Claude, Claude Code, and specifically the VS Code extension, so long as that's been blessed by my employer as an option. Otherwise, I'll be reaching out to the engineers about what they are using.

Do you have a favorite AI? Or a favorite coworker? I'm here for all the hot gossip. Drop a comment and let me know.

Cover photo by Steve A Johnson on Unsplash

It's just me, slamming my hands on a keyboard, asking the AI to fix the code it generated within the same discussion it claims it has no access or context.

Amara Graham — Fri, 04 Sep 2026 14:41:50 +0000

Sibling Rivalry? How to Make Kestra Tasks Talk to Each Other

Amara Graham — Wed, 22 Apr 2026 16:45:45 +0000

I'm putting together a video on sibling tasks in Kestra and thought I would build this idea out loud with you in a blog first.

Let's jump in!

What are sibling tasks?

Sibling tasks are tasks that have the same parent task. For the rest of this blog, we'll refer to sibling tasks within the context of a dynamic or looping construct.

So in this case, we can be more specific and say sibling tasks are the tasks defined within the tasks list of a loop. If we use ForEach as an example, we could have something that looks like this:

- id: my_loop
  type: io.kestra.plugin.core.flow.ForEach
  values: ["alpha", "beta"]
  tasks:
    - id: first_sibling
      type: io.kestra.plugin.core.debug.Return
      format: "Data for {{ taskrun.value }}"

    - id: second_sibling
      type: io.kestra.plugin.core.log.Log
      # Accessing the sibling's output for the current iteration
      message: "The first sibling said: {{ outputs.first_sibling[taskrun.value].value }}"

The ForEach, or my_loop, is the parent, with the siblings being first_sibling and second_sibling.

In this example you can see our log message contains info passed from first_sibling with the expression syntax. You will see this in the docs as "sibling task lookup". Pay attention to the differences between sequential and dynamic tasks, like looping.

Execution & `TaskRun` context

You may be familiar with the concept of context or scope and I think this is where things can start to get confusing.

A task run is a single execution of an individual task within a larger workflow execution. When you are within a ForEach's task list, you'll want to use taskrun.value to get the value associated with that run or iteration.

This might be a bit different to how you've done looping with programming languages where you are scoped within the brackets of the loop. You don't need to think about iterations, just the work happening within the loop.

Think of it like a "You Are Here" marker on a map. If you were hiking on a trail and came across a trail map with no marker to tell you where you are, it's not very helpful. You know you are on a trail and you could probably make a guess of where you are based on landmarks or time spent on the trail, but you could also be really wrong. And then get really lost.

Bringing it back to programming and workflows, using a key to indicate what run or iteration becomes hugely important when you are running tasks concurrently. This means the context needs a hint at what iteration you are interested in. I know I'm looking for data in the loop, but which run?

Outputs

Outputs are how you pass data between tasks or flows. Standard tasks usually reference outputs via {{ outputs.task_id.value }}. This gives you the value of a specific task's output.

In this case, we want to pass data between sibling tasks, which may look something like this {{ outputs.first_sibling[taskrun.value].value }}. This gives you the values of a specific run or iteration from the first_sibling task's output. This is very specific and helps prevent any conflict with concurrency or tasks firing in parallel.

We can't assume ForEach child tasks will run in parallel unless we set loop concurrency or use a parallel task.

I highly recommend reading our best practices page on this topic.

Outputs vs. execution & TaskRun context

But let's say we want to access data outside of the loop. We can do that too, modifying our example from above:

- id: my_loop
  type: io.kestra.plugin.core.flow.ForEach
  values: ["alpha", "beta"]
  tasks:
    - id: first_sibling
      type: io.kestra.plugin.core.debug.Return
      format: "Data for {{ taskrun.value }}"

    - id: second_sibling
      type: io.kestra.plugin.core.log.Log
      # Accessing the sibling's output for the current iteration
      message: "The first sibling said: {{ outputs.first_sibling[taskrun.value].value }}"

- id: outside
  type: io.kestra.plugin.core.log.Log
  # Accessing the data for the `alpha` run specifically
  message: "{{ outputs.first_sibling['alpha'].value }}"

This would give us the "alpha" iteration's output from the first_sibling task as a value.

Where it gets confusing

This tends to get confusing when you start using a mix of outputs and taskRun. When your output exists outside of the loop, you use the standard syntax. Inside the loop? You need to give Kestra the key (or value) associated with the particular iteration.

Additionally, your error messages can seem non-intuitive. You can will typically get an error where the value isn't found when you forget to use a key.

So let's look again at this example:

- id: outside
  type: io.kestra.plugin.core.log.Log
  message: "{{ outputs.first_sibling['alpha'].value }}" # correct

But if we ran this with the key, the value of the iteration we want to capture, we'll get an error.

- id: outside
  type: io.kestra.plugin.core.log.Log
  message: "{{ outputs.first_sibling.value }}" # will error

Unable to find `value` used in the expression `{{ outputs.first_sibling.value }}` at line 1

When to use double quotes

Double quotes around your expressions give a clear indicator that this value is a string. Without them, you may get that unintuitive error that the value in the expression cannot be found.

When I'm debugging my workflows, I usually try to make sure I have a key for my iteration and I've wrapped my expression in double quotes before I do any more extensive investigation. That usually solves it for me.

This should show up as a linting warning with a nice yellow squiggle, but it depends on the task properties and types you are working with.

When to use `ForEach` and `ForEachItem`

A bigger topic is the differences between ForEach and ForEachItem, which we have a great best practices page on.

The TL;DR is use ForEachItem when you want subflows and you are doing a lot of work on a lot of things.

Let me know if in the comments if you want a blog or video (or both!) on this topic.

Wrapping up

So that covers sibling tasks and outputs and expressions, oh my! Hopefully this adds a little more supplemental details to our docs on this topic.

As always, let me know if there is something you want me to explain in a little more detail! I'll get a video related to this topic out next week too.

What brings you by a conference booth?

Amara Graham — Thu, 16 Apr 2026 14:39:18 +0000

I'm thinking about in-person events more and more these days, so I'm curious - what brings you by a conference booth?

What's a good experience or design you've seen? Or when do you avoid a booth (or booths!) entirely?

LMK 😊

CVEs are vulnerabilities(!!!) and part 2 of my Notion automation

Amara Graham — Tue, 14 Apr 2026 20:41:27 +0000

Read part 1 first over here.

Last week I learned that there are people in tech who don't know what a CVE is. This shocked me to my core! I'm not talking about people not knowing the acronym, because there are too many of those, I'm talking about not realizing CVEs are vulnerabilities.

Starting my career in a large Enterprise IT organization, I lived through two significant pushes - code scanning and accessibility.

Code scanning was a response to "upskilling" the organization in security-minded coding practices and with it came awareness of vulnerabilities.

And shortly after that came anxiety.

Anxiety that you left your source code vulnerable or that you chose a library that was vulnerable.

Maybe that's why I'm not an enterprise developer anymore...

Anyway, I finished my CVE tracker. My vulnerability tracker, if you will. I even made you a video! Just like I promised!

I was able to use both the Notion page and database plugins, including passing the right data type to use a checkbox. Huge shoutout to the plugin team, they rock!

I want to call out a few places you need to pay attention to with the Notion plugins.

Use plugin defaults

If you plan to do multiple tasks with the Notion plugins, particularly multiple tasks with the Notion database plugin, for example, you'll need to reuse some information, like the databaseId.

I like to think I future-proofed this a bit because I only did 3 tasks across the two plugins. Still looks cleaner when you read the entire workflow.


pluginDefaults:
  - type: io.kestra.plugin.notion
    values:
      apiToken: "{{ secret('NOTION_SECRET') }}"
      databaseId: "{{ secret('NOTION_CVE_DB') }}"

Passing content back to Notion is a little unintuitive

I ended up having the Notion API docs open because some of the database types took me by surprise.

For example, a database can have a rich text field. In reality, I really just wanted this to be a string. Sometimes it's super simple like the CVE ID string, other times it's the action plan. So figuring out what I need to pass back to the API via the plugin was a bit awkward at first, because who would guess the rich text field would want an array of objects...? Not me.

Other types are much more straightforward like the select (priority) and the checkbox (mitigate now).

#sorry for the weird indents...
- id: send_to_notion
            type: io.kestra.plugin.notion.database.CreateItem
            title: "{{ json(parent.taskrun.value).vulnerabilityName }}"
            properties:
              ID:
                rich_text: [
                  {
                    text: 
                      {
                        content: "{{ json(parent.taskrun.value).cveID }}"
                      }
                  }
                ]
              Priority:
                select: 
                  name: "{{ outputs.ask_ai[parent.taskrun.value].predictions | first | jq('.priority') | first }}"
              "Mitigate now?":
               checkbox: "{{ outputs.ask_ai[parent.taskrun.value].predictions | first | jq('.mitigate_now') | first }}"
              "Action plan":
                rich_text: [
                  {
                    text: 
                      {
                        content: "{{ outputs.ask_ai[parent.taskrun.value].predictions | first | jq('.action_plan') | first }}"
                      }
                  }
                ]

Added an SLA

In kind of the perfect storm of situations, I did a webinar last week where we talked about "hidden" features, one of them being the workflow SLA. I ended up adding one:

sla:
  - id: maxDuration
    type: MAX_DURATION
    duration: PT1H
    behavior: CANCEL #CANCEL, FAIL, NONE
    labels:
      sla: miss
      reason: durationExceeded

This particular SLA will cancel the execution when it runs for over an hour. I actually exceeded this before my webinar without trying, which was cool because I had a nice example to share.

Notice I left a comment in the behavior property - you can set the behavior to cancel, fail, or do nothing (none).

Wrapping up

So that completes this little demo. I mention this in the video, but internally at Kestra we use Notion for our knowledge base, so the idea of having a CVE Tracker table within Notion makes a lot of sense for us. We can track the associated work, assign a reviewer, and have people view the page if they are interested in the progress.

I'm curious if anyone else out there is using Notion. How are you using it? How would you automate or orchestrate something around your Notion use?

And before I truly sign off, on my last run we hit 1568 CVEs. So I could definitely look at improving the performance here with a little refactor to only look at the newest ones every pull.

Building a Self-Triaging CVE Checker with Gemini, Kestra, and Notion

Amara Graham — Fri, 03 Apr 2026 18:46:20 +0000

I built a CVE checker for a nice enterprise-y use case, and of course, it's getting bigger and bigger as I go "ooooh, what if I add this?!" So this is me taking a break and telling you what I've done so far because this was the original stopping point.

The idea

I needed some kind of data to populate a Notion database (basically a table) so I could do something interesting with our Notion + Kestra plugins. Bonus points if I could sprinkle in some AI augmentation. Extra bonus points if I could make it a realistic enterprise example. Something that really resonates with the enterprise crowd.

And immediately I was like - CVEs!

The distraction

Side note, I spent far too long last week discovering that things may look like and act like Notion Pages, but a Notion Database is not a Notion Page. So if you give the API a Database id when it wants a Page id, it tells you it doesn't exist. Because a database is not a page. Hence, we have a Kestra plugin for Pages and a separate one for Databases now!

The Notion API makes you use UUIDs, but the value you need is presented in the URL if you are looking at Notion in a browser... but you need to turn that into a UUID. So my search history looks like this:

I also use Google Search to do calculations because I could not be bothered to open the calculator app when I'm already in a browser. Follow me for more tips on what Google Search can do. 😂

What I built

I needed a list of CVEs, so I went out to CISA and found their Known Exploited Vulnerabilities Catalog. They make this available in a few formats, so I found it in JSON.

The objects are pretty clean and tidy and look something like this:

{
    "cveID": "CVE-2026-33017",
    "vendorProject": "Langflow",
    "product": "Langflow",
    "vulnerabilityName": "Langflow Code Injection Vulnerability",
    "dateAdded": "2026-03-25",
    "shortDescription": "Langflow contains a code injection vulnerability that could allow building public flows without requiring authentication.",
    "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
    "dueDate": "2026-04-08",
    "knownRansomwareCampaignUse": "Unknown",
    "notes": "https:\/\/github.com\/langflow-ai\/langflow\/security\/advisories\/GHSA-vwmf-pq79-vjvx ; https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-33017",
    "cwes": [
        "CWE-94",
        "CWE-95",
        "CWE-306"
    ]
},

CVEs are kind of notorious for being hard to understand. They can pop up randomly and the anxiety that comes with trying to decide if your codebase is impacted, plus how fast you need to mitigate them, can make things harder than necessary. So I wanted to augment this a bit and sprinkle in some AI to help. I want Gemini to help me set the priority and action plan and hopefully make it a little easier for a human to parse than the CVE itself.

I want to pass new vulnerabilities to AI because, as of writing this, the list is 1557 CVEs long and I want to be conscious of token use. I also think it's more realistic for my demo to have a smallish subset of CVEs to triage.

Once I have this, I want to send it to a Notion Database, where I can have a nice little visual table to assign a human reviewer and create a Notion Page on the specific CVE to capture any implementation details or other notes the human wants to provide for more context on how this applies (or doesn't apply) to us.

More on the design

I should start by saying, as always, I'm not looking to make highly performant, production-ready demos. There are times I want to do something less than ideal to show particular aspects or features of the product and workflow mechanics. The things I make should spark a conversation or ideation. Besides, you know your use case better than I do.

Now that I got the disclaimer out of the way, let's talk about the design of this demo.

Store individual CVE IDs in KV Store

I wanted to store the known CVE IDs in a way that was searchable within Kestra, and to do that I used the KV Store. The keys map to the CVE IDs and the values are the names. The CVE IDs will always be a specific format, but the names could be quite lengthy. However, I could see a case where I need to reference both in my demo.

This searchability within Kestra gives an admin a fast way to reference whether this is a known CVE in the system since the table in Notion will only show new known CVEs.

Iterate through the JSON

Since I have this running during off hours, I don't really care how long it takes. With 1500+ CVEs to iterate through, this takes about 20-30 minutes with the concurrency limit set to run some tasks in parallel (5). Without setting the concurrency limit and just letting this default to running everything sequentially, it takes over an hour. Again, running off hours, I could easily tolerate this.

What's next

I'm always like HOW DO I MAKE THIS EVEN BIGGER. What more can I pack into this demo?

Could I just iterate over the top of the JSON?

Rethinking how I iterate over the JSON. CVEs don't get reported every day, and sometimes multiple get reported in a single day. I could probably be smarter with the iteration and only "read" until I hit a known CVE in my system and then stop since CVEs are added to the top of the JSON response.

However, if I wanted to build a really robust example and look for any edits or updates to the CVE information (like whether there is a new known ransomware campaign) I would still need to iterate through all of them.

This assumes that the behavior I'm seeing, where the CVEs are added to the top of the JSON, is the typical practice. Since I've only been working with this list for ~4 days, this seems typical.

How would you approach this?

Pre-populate Notion pages with more CVE info

I want to pre-populate the page with more info from the CVE. When I add a new item to the database, I get the page id returned. I could then take this page id and send over some content with the rest of the info in the JSON. In the execution outputs, I actually have all that info returned in the Database CreateItem task, so this would be quite trivial. They even give me the page ID as a UUID!!!!

Oops, found a bug

I wanted to add a checkbox about whether it should be mitigated now. To me, this is different than priority, but more of an urgency indicator. There's a bug with the Notion Database plugin where I couldn't pass in a boolean, so I removed the checkbox for now.

Wrapping up

If you want to view or use this example you can find it over on GitHub. I do not recommend running it the first time with the AI and Notion tasks enabled because you'll get 1557+ CVEs run through Gemini and added to your Notion database. Comment those out for the first run.

In fact, as I was building this demo the last ~4 days, the CVEs trickled in at a near perfect rate for me to see 1-3 pop into the table, but often I would have to delete a KV item manually to ensure I could get something to populate in my table.

If you use it as inspiration, let me know what you are building, or what you want to build! Keen eyes will notice I used Kestra EE, but you could definitely build this with Kestra OSS too with a few tweaks for things like secret management.

Reflecting on "dead" communities, engagement, and AI

Amara Graham — Tue, 31 Mar 2026 18:04:46 +0000

Admittedly this is a bit ranty, and if that's not your jam, feel free to skip.

I stopped scrolling most social media feeds when the slop arrived. First it came in the form of images, big awkward hero images that were psychedelic or had too many arms and fingers. Then it shifted to listicle after listicle. Then the articles that inserted a new line after every... single... sentence.

I was over it.

The personal voice and opinions were gone. The images were uncomfortably odd for my brain to process. The attention grabbing tactics were at an all time high and it just wasn't doing it for me anymore.

So I stopped scrolling. The community that existed on those platforms were dead to me.

This means I missed things like your promotion or new job or even some significant tech news. Eventually the important things did find me, but I never found myself missing scrolling. I took that energy to engage somewhere else.

Fast forward to people saying "this community is dead" or "that community has an engagement problem". The "community" has likely been taken over by garbage that doesn't foster engagement, so the people left. Myself included. Communities are living, breathing organisms and when you fill them with trash, they simply cannot thrive.

This isn't a post to bash on the admins or the moderators, if they even exist on a particular platform, because that's a hard job, and where do you draw the line in this AI-enabled world? You need content, but you also need engaging content. You need engaged users, but you may need to re-engage users who left. Do we even have the tools and understanding to manage this? Do these platforms have community managers or teams evaluating this?

Now more than ever people are looking for community, on and offline. They crave it for a variety of reasons, but a sense of belonging, trust, and safety remains. They want to be part of something that connects them to other people in a positive way. People will cultivate community spaces when they feel empowered, dare I say emboldened, to do so. Active and engaged participation is the goal, not casual drive-by headline reading. You want people excited and enthusiastic to show up. And show up regularly.

So why mention this? Why post this?

Because I love to complain. But mostly if I'm complaining about something, it's because I'm passionate about it. I strongly believe active participants in communities encourage others to do the same - be active participants.
Because I think we are over indexing on "communities are dead" and blaming AI. Have you considered that your AI-generated content isn't engaging? Have you considered comments are more important than views, and provoking a discussion is maybe more meaningful? Have you considered you might be the problem, with or without AI?

2026 is apparently the year where I'm just going to say "we have to live in community" over and over again until I hear people say it back to me. But it's true! If you want an engaged community, you need to lead by example and cultivate the environment you are looking for.

Does that mean I'm suggesting you can't use AI in your blogs? No. But it does mean you should evaluate your blogs for engagement, AI or otherwise. Would you read it? Would you comment on it if someone else wrote it?

Are your actions or participation a value-add? Because we can't put admins, moderators, and community managers solely responsible for supporting healthy communities. There needs to be some level of personal accountability.

And maybe it's more obvious in offline spaces. You won't attend another meetup or event where you felt unsafe or uncomfortable. So if a weird AI hero image made you uncomfortable, why would you read the content underneath? Are you seeing the connection here?

So I'm really interested in challenging this idea that a particular community is dead. Is it dead? Did you or do you positively or negatively contribute to it? And what does it mean to you if it's gone forever?

How important is a community to you? And how actively will you participate going forward?

Photo by mauro mora on Unsplash

Are you paying attention to your token use?

Amara Graham — Mon, 23 Mar 2026 13:45:08 +0000

Can I get some folks in the comments talking about how closely they monitor their token usage?

Or if you don't, do you work at a company that provides you unlimited tokens? To specific tools?

I'm curious to see where people fall on this spectrum.

Photo by Dan Dennis on Unsplash

What's in a flow?

Amara Graham — Tue, 17 Mar 2026 16:15:27 +0000

You can orchestrate anything! And therein lies the problem, can you even imagine what your flow could look like? Where do you start? And what components do you include?

We have a lot of amazing video content on Kestra where you've probably heard us mention how flows look and what they contain.

When you are just getting started, it might be hard to really see what we mean when we say something like "everything has an id and a type", particularly when you are looking at the following Hello World boilerplate:

id: buffalo_875352
namespace: company.team

tasks:
  - id: hello
    type: io.kestra.plugin.core.log.Log
    message: Hello World! 🚀

Like sure, the one runnable task you can see does, indeed, have an id and a type. But is this really important to cover? And why? It's just not really convincing. At least not yet!

So let's talk through some increasingly complex flows, what components they contain, and get you more familiar with what your next workflow with Kestra could look like.

Expression syntax `{{ }}`

Let's increase the complexity from boiler plate and check out my log_off_flow and talk about expressions.

Expression syntax is critical to passing around information, making flows more dynamic with inputs, and even referencing a particular iteration during something like a ForEach.

KV Store values are pretty straight forward - {{ kv('issues_today') }}. This simply references the value with the key issues_today. It's similar for secrets.

Outputs might be a little more complicated, depending on the type of output - {{ outputs.get_issues.body }}. This would get the output of the get_issues task, and specifically the response body of the API request.

You can also get into some complex filtering and formatting with your expressions - {{ now() | dateAdd(-5, 'DAYS') | date(\"yyyy-MM-dd'T'07:00:00-06:00\") }}. This is how you would get todays date, but actually 5 days ago and format it in a certain way.

Everything really does have an `id` and a `type`

Once you hit a certain level of complexity in your workflows, you start nesting tasks. This could be due to flowable tasks where you want to do some sort of branching like parallelism in this snippet from the airbyte-sync-parallel-with-dbt blueprint:

tasks:
  - id: data_ingestion
    type: io.kestra.plugin.core.flow.Parallel
    tasks:
      - id: salesforce
        type: io.kestra.plugin.airbyte.connections.Sync
        connectionId: e3b1ce92-547c-436f-b1e8-23b6936c12ab

      - id: google_analytics
        type: io.kestra.plugin.airbyte.connections.Sync
        connectionId: e3b1ce92-547c-436f-b1e8-23b6936c12cd

      - id: facebook_ads
        type: io.kestra.plugin.airbyte.connections.Sync
        connectionId: e3b1ce92-547c-436f-b1e8-23b6936c12ef

Whether it's a flowable or runnable task, it's got (say it with me now): an id and a type.

Plugin Defaults really do clean up your flow readability

Let's look at that same snippet from the airbyte-sync-parallel-with-dbt blueprint:

tasks:
  - id: data_ingestion
    type: io.kestra.plugin.core.flow.Parallel
    tasks:
      - id: salesforce
        type: io.kestra.plugin.airbyte.connections.Sync
        connectionId: e3b1ce92-547c-436f-b1e8-23b6936c12ab

      - id: google_analytics
        type: io.kestra.plugin.airbyte.connections.Sync
        connectionId: e3b1ce92-547c-436f-b1e8-23b6936c12cd

      - id: facebook_ads
        type: io.kestra.plugin.airbyte.connections.Sync
        connectionId: e3b1ce92-547c-436f-b1e8-23b6936c12ef

You may not realize it, but this set of 3 tasks is using Plugin Defaults to cover some additional properties, which you can find further down the flow:

pluginDefaults:
  - type: io.kestra.plugin.airbyte.connections.Sync
    values:
      url: http://host.docker.internal:8000/
      username: "{{ secret('AIRBYTE_USERNAME') }}"
      password: "{{ secret('AIRBYTE_PASSWORD') }}"

Without them, that snippet would look more like this:

tasks:
  - id: data_ingestion
    type: io.kestra.plugin.core.flow.Parallel
    tasks:
      - id: salesforce
        type: io.kestra.plugin.airbyte.connections.Sync
        connectionId: e3b1ce92-547c-436f-b1e8-23b6936c12ab
        url: http://host.docker.internal:8000/
        username: "{{ secret('AIRBYTE_USERNAME') }}"
        password: "{{ secret('AIRBYTE_PASSWORD') }}"

      - id: google_analytics
        type: io.kestra.plugin.airbyte.connections.Sync
        connectionId: e3b1ce92-547c-436f-b1e8-23b6936c12cd
        url: http://host.docker.internal:8000/
        username: "{{ secret('AIRBYTE_USERNAME') }}"
        password: "{{ secret('AIRBYTE_PASSWORD') }}"

      - id: facebook_ads
        type: io.kestra.plugin.airbyte.connections.Sync
        connectionId: e3b1ce92-547c-436f-b1e8-23b6936c12ef
        url: http://host.docker.internal:8000/
        username: "{{ secret('AIRBYTE_USERNAME') }}"
        password: "{{ secret('AIRBYTE_PASSWORD') }}"

It's the exact same info x3. It's harder to read and if we needed to make an update to say, the URL, we'd be stuck doing it x3. Not great for maintainability, particularly those of us who typo from time-to-time.

And nothing is stopping you from using Plugin Defaults when you only use the plugin once. Maybe just pulling those values away from the rest of the plugin properties makes it easier to read and modify. Consider adding comments and group those properties to indicate those could be modified in the future, but don't touch the rest.

Order doesn't matter, mostly

I like my triggers at the top of my flow code, by default you may see them toward the bottom. Your topology will show them either at the top or on the left side, depending on how you chose to orient your diagram. Placing them at the top of your flow code makes it easier to read and quickly grasp how this flow could start, but if you have the topology panel open, you could quickly reference that just as easily.

However, your task order can matter, particularly if you want to pass outputs from one task to the next.

You may also want to group tasks in such a way that you contain them to a working directory. This is particularly important for tasks that clone repos and/or you want to share those files across scripts.

You can decide what order makes sense to you.

Meaningful, short `id`s make your topology a better reference

Again, when you are looking at a minimal flow, meaningful ids don't really click.

It's clear, you don't have to zoom in or move around, and you can see the log icon super clearly.

But then you do something more interesting and it looks more like:

And that's an eye chart. Let me zoom in a little and be less dramatic.

The longer the ids, the harder they are to really grasp what's happening in the topology. If you prefer to grasp your flow in the flow code directly, this may be less of a problem for you. But keep this in mind if you have project stakeholders who do rely on the topology and try to give them the best experience you can.

Errors

Errors can be handled at the flow-level or task-level with the errors property (which we sometimes refer to as the errors block). Things happen and we want them to fail gracefully or notify the right people or systems to ensure it's handled as gracefully as possible.

That would look something like this for a flow-level error:

errors:
  - id: rollout_failure_diagnostics
    type: io.kestra.plugin.core.log.Log
    message: |
      Rollout failed for tenant={{ inputs.tenant_id }}.
      execution={{ execution.id }}.
      last_error={{ errorLogs()[0]['message'] }}.
      Review the latest [PRE]/[PROBE]/[POST] logs for the failing application.

You'll probably want to reference what input, {{ inputs.x }}, may have contributed to the failure along with the execution id, {{ execution.id }}.

And if you didn't spot it, the errors property does, in fact, have an id and a type!

Flows as Blueprints

All the flows covered in this blog are available as blueprints, with the exception of the boilerplate that's included every time you create a new flow from scratch. You can find the blueprints below:

log_off_flow (available in two options: Notion or Confluence)
- With Notion
- With Confluence
airbyte-sync-parallel-with-dbt
argocd-single-tenant-wave-rollout

You can also find them in the Blueprints menu directly in the Kestra UI, where you can copy or click the "Use" button and use it yourself.

I hope you enjoyed this walkthrough of different flow components and flows with increasing complexity. I added tons of links so you can go a little deeper on certain topics as you see fit.

Let me know what you want to see next with Kestra in the comments or come join our community!

Workshopping my "Anatomy of a Kestra Flow" video idea

Amara Graham — Tue, 10 Mar 2026 18:21:34 +0000

I pulled together a quick video where I step through 4 different workflows and kind of talk through some ideas I had for more of a polished video. Let me know what you'd like me to focus on or where I should go into more details!

What should I do and learn in 2026?

Amara Graham — Mon, 02 Mar 2026 19:31:11 +0000

I blinked and it's March. That's not entirely true, January was 100 years long, then February showed up, and at least here in Central Texas, that meant it was harshly cold for like 48 hours and now it's summer. "That's false Spring!" No... we don't have Spring here.

Anyway, it's March and you might be asking yourself what you should actually be doing this year now that the year is rolling onward. You may have yearly or quarterly goals or metrics, but what are your personal development goals? And do you already feel behind?

You may be asking yourself what you want to actually do this year. What do you want to learn? What skills do you want to level up? Never fear, let me provide you with my opinionated list of some of the tactics I recommend for navigating this.

Use AI and have opinions about popular AI tools

I want to be very clear that I don't think AI is appropriate everywhere, but I do think if you are in tech you need to have some kind of personal narrative around AI, particularly related to your role. Where you use it, why, and how.

Someone recently asked if I would let AI write blogs for me, and the answer is no, I barely let any tools spell and grammar check my blogs. I'm sure you can tell. Voice and style aside, which I'm aware an AI can "learn", I find writing very cathartic and if someone else reads and enjoys it, that's a bonus. I have no reason to give that up, but also, where am I going to put this chaotic, GIF-filled corporate rage?

I digress.

Claude for summarizing, brainstorming, and ideation

I use Claude for summarizing written content for things like video scripts. My prompts are dead simple:

Turn this blog into a 2-3 minute video script.

Claude and I also like to collaborate on talk ideas, titles, and descriptions. This gives me a great base to either edit on my own, entirely rework, or read exactly once and close Claude's window.

Make this talk title something people would actually go to.

I also like asking for summaries on specific docs pages because I want to see a TL;DR that matches my understanding. This leads into the next use case.

Docs AI for search and knowledge checks

I use built-in docs AI for enhanced search and knowledge checks, almost like quizzes in academy courses. Those implementations will heavily depend on the model, but many are good about citing their sources if I feel like I need to fact check.

If there is both a search and a docs AI, I like to see what results come up when I search or ask a question with similar terms. This is helpful to see and work to improve the UX and "findability" within docs. If search and docs AI are generating different results, or worse, they are not finding what they should, you need to spend some time to fix it before your users get stuck.

Copilots

I'm mostly only working on small code bases and demos these days, so I can use Kestra's Copilot or Visual Studio Code's Copilot, something specific to a single file or repo, and this works really well for me. I know some people have other AI agents deep in their organization's tooling, but I don't really need that right now.

All of this comes back to my experience with AI and my opinions I've developed around it. These options may not work for you, but I would strongly encourage you to develop your own experience and opinions, particularly because it will come up in my next "skill": interviewing.

Never stop interviewing

This one hurts to type because interviewing is hard, even in the most pleasant interview cycles and job markets. It can evoke a lot of negative feelings and, depending on who you talk to about it, might make it seem like you are looking for your next opportunity. How you feel after that interview, whether you are truly job seeking or not, can be largely dependent on the interviewer.

The idea with this one is you "never stop interviewing" so you never lose the skills to interview. You are able to talk about your experience, skills, delivery, and value outside of a yearly or bi-yearly performance review to someone who knows nothing other than maybe what you put on the application and in your resume.

I heard this one very early on in my career from someone quite senior, and then I heard it reinforced by people in other areas of the org chart. They were clear that they weren't necessarily looking for another position, but they wanted to know what was out there and they wanted to keep these interview skills honed.

It's also a great reality check to see if you need to do a hard pivot of some kind. Sometimes titles change or roles evolve and you need to be flexible enough to adjust. Interviewing helps you understand what people outside of your current organization are looking for.

Keep your resume updated

I like to visit my resume at least twice a year, typically aligned either with a performance review or the end of the year. What you are trying to avoid is a situation where you need an updated resume immediately, and you can't possibly figure out how to summarize your role on the fly.

If you can get really good at having a refined, ready-to-go resume, you should be really good at communicating your role, experience, skills, delivery, value, etc. and interviewing (and performance reviews!) become easier too.

Find your community, online and offline

I started going to bookstore events last year. I had started reading romance novels for the predictability and comfort that comes with a happily ever after (HEA) or happy for now (HFN). And at some point I realized one of my favorite authors was local and I could actually go see her. And surround myself with people who also thought she and her books were pretty cool too. Not only do these events immediately feel like safe spaces, they remind me that even though I've spent an entire career working mostly with men, there are communities that are almost entirely not-men out there too.

And it's all about finding balance. Like balancing a stack of books on the way to the cash register when you just came for one. Oopsies!

More and more community spaces and groups seem to be seeing a post-pandemic-shutdown renaissance. I don't know exactly what's driving that, but I know I'm finding more energy to even get out to tech meetups again. Maybe people are craving those connections again? This makes it a great time to join and explore communities with others doing the exact same thing.

Geek out on something

I like birds.

This is not new, this is a life long... hobby...? Birds + AI are apparently a thing this year, with CES summoning AI-powered bird identifying tools. So I acquired some new tech and apps to live my best bird nerd life this year.

Birds aren't your thing? Find something to go deep into. I'm also big into nail polish and stained glass (copper foil & lead came). Those aren't even close to tech adjacent, but they give me an opportunity to "touch grass" away from a computer.

So, what's the plan?

Maybe this wasn't quite the list you were expecting, but I hope it gets you thinking. What is on your list for doing and learning this year? Have you started? There is still so much year left.

DEV Community: Amara Graham

Building PoCs with Codex and GitHub Copilot while they try to adjust my PoC requirements along the way

ChatGPT + Codex

GitHub Copilot

What's next?

Admit it, you have a favorite AI (just like you have a favorite coworker)

Claude

Gemini

Microsoft Copilot

What's next?

It's just me, slamming my hands on a keyboard, asking the AI to fix the code it generated within the same discussion it claims it has no access or context.

Sibling Rivalry? How to Make Kestra Tasks Talk to Each Other

What are sibling tasks?

Execution & TaskRun context

Outputs

Outputs vs. execution & TaskRun context

Where it gets confusing

When to use double quotes

When to use ForEach and ForEachItem

Wrapping up

What brings you by a conference booth?

CVEs are vulnerabilities(!!!) and part 2 of my Notion automation

Use plugin defaults

Passing content back to Notion is a little unintuitive

Added an SLA

Wrapping up

Building a Self-Triaging CVE Checker with Gemini, Kestra, and Notion

The idea

The distraction

What I built

More on the design

Store individual CVE IDs in KV Store

Iterate through the JSON

What's next

Could I just iterate over the top of the JSON?

Pre-populate Notion pages with more CVE info

Oops, found a bug

Wrapping up

Reflecting on "dead" communities, engagement, and AI

Are you paying attention to your token use?

What's in a flow?

Expression syntax {{ }}

Everything really does have an id and a type

Plugin Defaults really do clean up your flow readability

Order doesn't matter, mostly

Meaningful, short ids make your topology a better reference

Errors

Flows as Blueprints

Workshopping my "Anatomy of a Kestra Flow" video idea

What should I do and learn in 2026?

Use AI and have opinions about popular AI tools

Claude for summarizing, brainstorming, and ideation

Docs AI for search and knowledge checks

Copilots

Never stop interviewing

Keep your resume updated

Find your community, online and offline

Geek out on something

So, what's the plan?

Execution & `TaskRun` context

When to use `ForEach` and `ForEachItem`

Expression syntax `{{ }}`

Everything really does have an `id` and a `type`

Meaningful, short `id`s make your topology a better reference