Tommaso Bertocchi

Posted on Apr 3

10 Tools That Will Instantly Make Your Coding Projects Better

#webdev #programming #devops #productivity

Most coding projects do not fail because the idea was bad.

They fail because everything around the code is weak.

The deploy process is manual.

The API contract lives in someone's head.

Errors show up first in production.

Dependencies age quietly until they become a problem.

Uploads get trusted way too easily.

Nobody has a clean picture of how the system actually works.

That is the part a lot of teams underestimate.

Good projects are not just built with good code.

They are built with good systems around the code.

So this is not a random list of apps.

These are 10 tools that make coding projects feel more professional, more reliable, more secure, and much easier to ship.

TL;DR: Better projects usually come from stronger workflow, testing, observability, documentation, dependency hygiene, and security, not just smarter features.

The moment you realize the feature works, but the project still feels one bad deploy away from chaos. Source: South Park on Giphy

GitHub Actions
Postman
Docker
Sentry
Playwright
Swagger / OpenAPI
pompelmi
Dependabot
Excalidraw
Raycast

1) GitHub Actions — Stop shipping manually

What it is: GitHub's built-in automation layer for CI, CD, releases, scheduled jobs, and repo workflows.

Why it improves your project: It turns quality checks from a vague team habit into a repeatable system. Linting, tests, builds, previews, and deploy gates stop depending on who remembered what.

Best for: pull request checks, automated releases, scheduled maintenance jobs, deployment pipelines, repo housekeeping.

The fastest way to make a repo feel serious is to make every change prove itself before it lands. Even a small workflow that runs install, lint, test, and build on every PR removes a huge amount of avoidable drama.

Links: Official · Representative repo

actions / starter-workflows

Accelerating new GitHub Actions workflows

Starter Workflows

These are the workflow files for helping people get started with GitHub Actions. They're presented whenever you start to create a new GitHub Actions workflow.

If you want to get started with GitHub Actions, you can use these starter workflows by clicking the "Actions" tab in the repository where you want to create a workflow.

Note

Thank you for your interest in this GitHub repo, however, right now we are not taking contributions.

We continue to focus our resources on strategic areas that help our customers be successful while making developers' lives easier. While GitHub Actions remains a key part of this vision, we are allocating resources towards other areas of Actions and are not taking contributions to this repository at this time. The GitHub public roadmap is the best place to follow along for any updates on features we’re working on and what stage they’re in.

We…

View on GitHub

name: ci

on:
  pull_request:
  push:
    branches: [main]

jobs:
  verify:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - run: npm run lint
      - run: npm test
      - run: npm run build

When the team discovers that "our deploy checklist" was actually just one person's memory. Source: Family Guy on Giphy

2) Postman — Make your API usable by more than its author

What it is: An API platform for sending requests, organizing collections, sharing environments, and testing real responses.

Why it improves your project: Good APIs are not just endpoints that return JSON. They are endpoints people can inspect, replay, debug, and hand to teammates without a 20-minute Slack explanation.

Best for: backend teams, QA workflows, auth-heavy APIs, onboarding, partner integrations, manual verification.

Postman is useful because it turns one person's debugging setup into shared project knowledge. The moment auth headers, refresh flows, sample payloads, and odd edge-case requests are saved in a collection, your API stops feeling mysterious. And once those collections become something your team can rerun and share consistently, the project gets easier to trust.

Links: Official · Representative repo

postmanlabs / newman

Newman is a command-line collection runner for Postman

Manage all of your organization's APIs in Postman, with the industry's most complete API development environment.

newman _{the cli companion for postman}

Newman is a command-line collection runner for Postman. It allows you to effortlessly run and test a Postman collection directly from the command-line. It is built with extensibility in mind so that you can easily integrate it with your continuous integration servers and build systems.

Getting started

…

View on GitHub

3) Docker — Kill environment roulette

What it is: A container platform for packaging your app and its dependencies into reproducible environments.

Why it improves your project: It reduces the classic "works on my machine" tax by making local, CI, staging, and production setups much more predictable.

Best for: apps with multiple services, onboarding, backend systems, consistent local environments, reproducible deployments.

Docker will not magically fix bad architecture, but it will stop the weekly ritual where one machine has the right runtime, another machine has the wrong system packages, and production is somehow "close enough." That alone makes a project calmer to ship.

Links: Official · Representative repo

docker / compose

Define and run multi-container applications with Docker

Docker Compose

Docker Compose is a tool for running multi-container applications on Docker defined using the Compose file format A Compose file is used to define how one or more containers that make up your application are configured. Once you have a Compose file, you can create and start your application with a single command: docker compose up.

Note: About Docker Swarm Docker Swarm used to rely on the legacy compose file format but did not adopt the compose specification so is missing some of the recent enhancements in the compose syntax. After acquisition by Mirantis swarm isn't maintained by Docker Inc, and as such some Docker Compose features aren't accessible to swarm users.

Where to get Docker Compose

Windows and macOS

Docker Compose is included in Docker Desktop…

View on GitHub

services:
  app:
    build: .
    ports:
      - "3000:3000"
    environment:
      NODE_ENV: production
    depends_on:
      - postgres

  postgres:
    image: postgres:16
    environment:
      POSTGRES_PASSWORD: postgres

Trying to explain why local, staging, and production are "basically the same" when they absolutely are not. Source: The Simpsons on Giphy

4) Sentry — Catch the breakage before users do

What it is: Error tracking and performance monitoring for apps, APIs, and background jobs.

Why it improves your project: It gives failures context instead of vibes. You get stack traces, release correlation, breadcrumbs, request metadata, and performance signals that help you fix the right thing faster.

Best for: production apps, APIs, workers, frontend error tracking, release monitoring, performance debugging.

Projects get better the minute production stops feeling like a blindfold. Sentry shortens the distance between "something is broken" and "here is the exact release, route, and error path that caused it."

Links: Official · GitHub

getsentry / sentry

Developer-first error tracking and performance monitoring

Users and logs provide clues. Sentry provides answers.

What's Sentry?

Sentry is the debugging platform that helps every developer detect, trace, and fix issues. Code breaks, fix it faster.

Official Sentry SDKs

Resources

Documentation
Discussions (Bugs, feature requests, general questions)
Discord
Contributing
Bug Tracker
Code
Transifex (Translate Sentry!)

View on GitHub

import * as Sentry from '@sentry/node';

Sentry.init({
  dsn: process.env.SENTRY_DSN,
  environment: process.env.NODE_ENV,
  tracesSampleRate: 0.2,
});

5) Playwright — Test the flows that actually make or break products

What it is: A browser automation and end-to-end testing framework for real user journeys.

Why it improves your project: Unit tests are great for logic. Playwright is how you protect the stuff people actually click, type, submit, and depend on.

Best for: login flows, checkout paths, onboarding, regression prevention, cross-browser testing, critical UI journeys.

A lot of products feel stable right up until somebody runs the real flow. One solid Playwright test for auth, payments, or signup often prevents the kind of regression that makes a team lose confidence in every release.

Links: Official · GitHub

microsoft / playwright

Playwright is a framework for Web Testing and Automation. It allows testing Chromium, Firefox and WebKit with a single API.

🎭 Playwright

Documentation | API reference

Playwright is a framework for web automation and testing. It drives Chromium, Firefox, and WebKit with a single API — in your tests, in your scripts, and as a tool for AI agents.

Get Started

Choose the path that fits your workflow:

Best for	Install
Playwright Test	End-to-end testing	`npm init playwright@latest`
Playwright CLI	Coding agents (Claude Code, Copilot)	`npm i -g @playwright/cli@latest`
Playwright MCP	AI agents and LLM-driven automation	`npx @playwright/mcp@latest`
Playwright Library	Browser automation scripts	`npm i playwright`
VS Code Extension	Test authoring and debugging in VS Code	Install from Marketplace

Playwright Test

Playwright Test is a full-featured test runner built for end-to-end testing. It runs tests across Chromium, Firefox, and WebKit with full browser isolation, auto-waiting, and web-first assertions.

Install

npm init playwright@latest

Or add manually:

npm i -D @playwright/test
npx playwright install

Write a test

import { test, expect

…

View on GitHub

import { test, expect } from '@playwright/test';

test('checkout completes successfully', async ({ page }) => {
  await page.goto('/checkout');
  await page.getByLabel('Email').fill('dev@example.com');
  await page.getByRole('button', { name: 'Pay now' }).click();
  await expect(page.getByText('Payment confirmed')).toBeVisible();
});

The exact moment your one "probably fine" user flow turns out to be the one thing that definitely needed an end-to-end test. Source: South Park on Giphy

6) Swagger / OpenAPI — Turn your API into a real contract

What it is: A specification-driven way to describe routes, payloads, auth requirements, and responses.

Why it improves your project: It makes your API explicit. That means better docs, fewer frontend/backend misunderstandings, easier integrations, and less behavior hidden in memory or tribal knowledge.

Best for: internal APIs, public APIs, SDK generation, backend teams, frontend handoff, partner integrations.

When the contract is written down, fewer things depend on guessing. That helps new teammates onboard faster, frontend work unblock earlier, and backend changes stop surprising everybody else.

Links: Official spec · Swagger UI · Representative repo

swagger-api / swagger-ui

Swagger UI is a collection of HTML, JavaScript, and CSS assets that dynamically generate beautiful documentation from a Swagger-compliant API.

Introduction

Swagger UI allows anyone — be it your development team or your end consumers — to visualize and interact with the API’s resources without having any of the implementation logic in place. It’s automatically generated from your OpenAPI (formerly known as Swagger) Specification, with the visual documentation making it easy for back end implementation and client side consumption.

General

👉🏼 Want to score an easy open-source contribution? Check out our Good first issue label.

🕰️ Looking for the older version of Swagger UI? Refer to the 2.x branch.

This repository publishes three different NPM modules:

swagger-ui is a traditional npm module intended for use in single-page applications that are capable of resolving dependencies (via Webpack, Browserify, etc.).
swagger-ui-dist is a dependency-free module that includes everything you need to serve Swagger UI in a server-side project, or a single-page application that can't resolve npm module dependencies.
swagger-ui-react is Swagger…

View on GitHub

openapi: 3.1.0
info:
  title: "Example API"
  version: 1.0.0
paths:
  /users/{id}:
    get:
      summary: Fetch a user
      parameters:
        - in: path
          name: id
          required: true
          schema:
            type: string
      responses:
        "200":
          description: "User returned successfully"

Frontend, backend, and QA when the API shape is finally written down in one place instead of floating around in chat history. Source: The Simpsons on Giphy

7) pompelmi — Secure the upload edge before it bites you

What it is: A Node.js file upload security tool that scans uploads in-process before you accept them.

Why it improves your project: Upload handling is one of the most underestimated attack surfaces in web apps. Extensions lie, MIME types can be spoofed, archives can be risky, and "we'll validate later" is how tiny assumptions become expensive incidents.

Best for: Express, Fastify, Koa, NestJS, Next.js, privacy-sensitive products, public upload flows, moderation-heavy apps.

Most teams spend more time styling the upload button than defending the upload pipeline. That is backwards. A tool like pompelmi helps you make verdict-based decisions before a file becomes your problem, which is exactly the kind of boring guardrail mature projects quietly rely on.

Repo: GitHub

Site: Project site

Demo: Live demo

import { scanBytes, STRICT_PUBLIC_UPLOAD } from 'pompelmi';

const report = await scanBytes(file.buffer, {
  filename: file.originalname,
  mimeType: file.mimetype,
  policy: STRICT_PUBLIC_UPLOAD,
  failClosed: true,
});

if (report.verdict !== 'clean') {
  return res.status(422).json({
    error: 'Upload blocked',
    verdict: report.verdict,
    reasons: report.reasons,
  });
}

If you handle user uploads in Node.js, this is the kind of layer that makes your project feel much more intentional. It is not just about malware. It is about treating MIME spoofing, risky archives, and uncertain files as security decisions instead of wishful thinking.

Repository preview

pompelmi / pompelmi

Open-source file upload security for Node.js. Scan files before storage to detect malware, MIME spoofing, and risky archives.

Pompelmi

In-process file upload security for Node.js. Inspect untrusted files before storage so your application can reject, quarantine, or accept with context.

Pompelmi helps reduce:

MIME / extension spoofing and magic-byte mismatches
risky archive structures such as ZIP bombs, traversal, and deep nesting
risky document and binary patterns such as PDF actions, Office macro hints, PE signatures, and polyglot files
store-first upload flows that need a clean / suspicious / malicious verdict before persistence
known malicious matches when you plug in YARA or another scanner

Install: npm install pompelmi

Quick Start

import { scanBytes, STRICT_PUBLIC_UPLOAD } from 'pompelmi';
const report = await scanBytes(file.buffer, {
  filename: file.originalname,
  mimeType: file.mimetype,
  policy: STRICT_PUBLIC_UPLOAD,
  failClosed: true,
});

if (report.verdict !== 'clean') {
  return res.status(422)

…

View on GitHub

Upload security usually feels optional right until it really, really is not.

8) Dependabot — Keep dependency drift from turning into real risk

What it is: GitHub's automated dependency update system for packages, containers, and workflow versions.

Why it improves your project: It keeps security and maintenance work moving in small increments instead of one painful cleanup sprint after months of neglect.

Best for: npm repos, Docker images, GitHub Actions workflows, libraries, apps with busy dependency trees.

Most dependency risk is boring right until it is suddenly not. Dependabot makes updates reviewable, visible, and routine, which is much better than discovering six months of drift during an incident or release crunch.

Links: Docs · GitHub

dependabot / dependabot-core

🤖 Dependabot's core logic for creating update PRs.

Welcome to the public home of Dependabot .

What is Dependabot-Core?

Dependabot-Core is the library at the heart of Dependabot security / version updates.

Use it to generate automated pull requests updating dependencies for projects written in Ruby, JavaScript, Python, PHP, Dart, Elixir, Elm, Go, Rust, Java, Julia, and .NET. It can also update git submodules, Docker files, Opentofu, Terraform files and Pre-Commit hooks. Features include:

Check for the latest version of a dependency that's resolvable given a project's other dependencies
Generate updated manifest and lockfiles for a new dependency version
Generate PR descriptions that include the updated dependency's changelogs, release notes, and commits

How to

…

View on GitHub

version: 2
updates:
  - package-ecosystem: npm
    directory: /
    schedule:
      interval: weekly
    open-pull-requests-limit: 5
  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: weekly

The face you make when a stale dependency turns into tonight's emergency patch window. Source: Family Guy on Giphy

9) Excalidraw — Think clearly before you build expensively

What it is: A fast, low-friction whiteboard for architecture sketches, flows, states, and system diagrams.

Why it improves your project: It helps teams see the system before they commit to the system. That reduces misalignment, hand-wavy assumptions, and long explanations nobody remembers later.

Best for: architecture reviews, sequence diagrams, onboarding docs, RFCs, async collaboration, state-flow discussions.

A five-minute sketch can save hours of wrong implementation. Excalidraw is especially good when a project keeps getting explained verbally but never gets turned into something the whole team can point at and improve together.

Links: Official · GitHub

excalidraw / excalidraw

Virtual whiteboard for sketching hand-drawn like diagrams

Excalidraw Editor | Blog | Documentation | Excalidraw+

An open source virtual hand-drawn style whiteboard.
Collaborative and end-to-end encrypted.

Create beautiful hand-drawn like diagrams, wireframes, or whatever you like.

Features

The Excalidraw editor (npm package) supports:

💯 Free & open-source.
🎨 Infinite, canvas-based whiteboard.
✍️ Hand-drawn like style.
🌓 Dark mode.
🏗️ Customizable.
📷 Image support.
😀 Shape libraries support.
🌐 Localization (i18n) support.
🖼️ Export to PNG, SVG & clipboard.
💾 Open format - export drawings as an .excalidraw json file.
⚒️ Wide range of tools - rectangle, circle, diamond, arrow, line, free-draw, eraser...
➡️ Arrow-binding & labeled arrows.
🔙 Undo / Redo.
🔍 Zoom and panning support.

Excalidraw.com

The app hosted at excalidraw.com is a minimal showcase of what you can build with Excalidraw. Its source code is part of this repository as well, and the app features:

📡 PWA support (works offline).
🤼 Real-time collaboration.
🔒 End-to-end…

View on GitHub

10) Raycast — Remove friction from the machine itself

What it is: A keyboard-first launcher and automation layer for local developer workflows.

Why it improves your project: Not every project improvement lives in the repo. Faster local execution means less context-switching, fewer tiny interruptions, and more energy left for the work that actually matters.

Best for: macOS-based developers, snippets, quick scripts, search, clipboard workflows, window control, micro-automation.

Raycast is one of those tools that quietly improves everything around your coding day. Opening the right folders, jumping to tickets, searching docs, running snippets, and triggering scripts faster sounds small until you notice how much time you stop wasting.

Links: Official · GitHub

raycast / extensions

Everything you need to extend Raycast.

Raycast Extensions

Raycast lets you control your tools with a few keystrokes. This repository contains all extensions that are available in the Raycast Store. It also includes documentation and examples of how to extend Raycast using React.

Getting Started

Visit https://developers.raycast.com to get started with our API. If you want to discover and install extensions, check out our Store.

Be sure to read and follow our Community and Extension guidelines and Acceptable Use Policy when submitting your extension and interacting with other folks in this repository.

Feedback

Raycast wouldn't be where it is without the feedback from our community, so we would be happy to hear what you think of the API / DevX and how we can improve. Please use GitHub issues for everything API related (bugs, improvements suggestions, developer experience, docs, etc). We have a few templates that should help you get started.

Community

Join our…

View on GitHub

What your laptop sees after you finally replace ten tiny daily interruptions with one keyboard-first workflow. Source: South Park on Giphy

Final thoughts

The projects people trust are rarely the ones with the flashiest feature list.

They are the ones where:

deploys are repeatable
APIs are easy to test
user flows are protected
production failures are visible
docs are explicit
uploads are treated like a real security boundary
dependencies do not rot quietly
ideas are clarified before code gets expensive

That is why good tooling matters so much.

It does not just make developers faster.
It makes projects better.

If you could add only one of these to your stack this week, which one would make the biggest difference?

Table of Contents

1) GitHub Actions — Stop shipping manually

actions / starter-workflows

Accelerating new GitHub Actions workflows

Starter Workflows

Note

2) Postman — Make your API usable by more than its author

postmanlabs / newman

Newman is a command-line collection runner for Postman

newman the cli companion for postman

Table of contents

Getting started

3) Docker — Kill environment roulette

docker / compose

Define and run multi-container applications with Docker

Table of Contents

Docker Compose

Where to get Docker Compose

Windows and macOS

4) Sentry — Catch the breakage before users do

getsentry / sentry

Developer-first error tracking and performance monitoring

What's Sentry?

Official Sentry SDKs

Resources

5) Playwright — Test the flows that actually make or break products

microsoft / playwright

Playwright is a framework for Web Testing and Automation. It allows testing Chromium, Firefox and WebKit with a single API.

🎭 Playwright

Documentation | API reference

Get Started

Playwright Test

Install

Write a test

6) Swagger / OpenAPI — Turn your API into a real contract

swagger-api / swagger-ui

Swagger UI is a collection of HTML, JavaScript, and CSS assets that dynamically generate beautiful documentation from a Swagger-compliant API.

Introduction

General

7) pompelmi — Secure the upload edge before it bites you

Repository preview

pompelmi / pompelmi

Open-source file upload security for Node.js. Scan files before storage to detect malware, MIME spoofing, and risky archives.

Pompelmi

Quick Start

8) Dependabot — Keep dependency drift from turning into real risk

dependabot / dependabot-core

🤖 Dependabot's core logic for creating update PRs.

Table of Contents

What is Dependabot-Core?

How to

9) Excalidraw — Think clearly before you build expensively

excalidraw / excalidraw

Virtual whiteboard for sketching hand-drawn like diagrams

Excalidraw Editor | Blog | Documentation | Excalidraw+

An open source virtual hand-drawn style whiteboard. Collaborative and end-to-end encrypted.

Features

Excalidraw.com

10) Raycast — Remove friction from the machine itself

raycast / extensions

Everything you need to extend Raycast.

Raycast Extensions

Getting Started

Feedback

Community

Final thoughts

newman _{the cli companion for postman}

An open source virtual hand-drawn style whiteboard.
Collaborative and end-to-end encrypted.