Hacker News Reader

What about security? Constantly pulling unreviewed code just because it passes unit or e2e tests does not sound like the ideal choice to me.

Presumably this was only in their testing environment, not production.

Code that gets merged into Rails master is reviewed by the Rails core team.

And indeed how much of that code gets significantly _more_ review after it's merged and before release? Some of it.

But yeah, I don't think they were releasing based on unreleased Rails master. Just running CI, and keeping it passing.