RepoPilot

nilbuild/developer-roadmap

Interactive roadmaps, guides and other educational content to help developers grow in their careers.

Mixed

Mixed signals — read the receipts

MixedDependency

no tests detected in the complete Git tree; license evidence incomplete

MixedFork & modify

no tests detected in the complete Git tree; license evidence incomplete

HealthyLearn from

Documented and popular — useful reference codebase to read through.

MixedDeploy as-is

Scorecard "Branch-Protection" is 0/10; license evidence incomplete

  • Concentrated ownership — top contributor handles 62% of recent commits
  • No tests detected in the complete Git tree
  • Scorecard: default branch unprotected (0/10)
  • Last commit 3d ago
  • 27+ active contributors
  • CI configured

Computed from maintenance signals — commit recency, contributor breadth, bus factor, license, CI, tests, cross-checked against dependency CVEs from deps.dev and OpenSSF Scorecard

Informational only. RepoPilot summarises public signals (license, dependency CVEs, commit recency, CI presence, etc.) at the time of analysis. Signals can be incomplete or stale. Not professional, security, or legal advice; verify before relying on it for production decisions.

Want this for your own repo?

Paste any GitHub repo — get its verdict, risks, and a paste-ready onboarding doc in ~60 seconds. Free, no sign-up.

Embed the "Great to learn from" badge

Paste into your README — live-updates from the latest cached analysis.

RepoPilot: Great to learn from
[![RepoPilot: Great to learn from](https://repopilot.app/api/badge/nilbuild/developer-roadmap?axis=learn)](https://repopilot.app/r/nilbuild/developer-roadmap)

Paste at the top of your README.md — renders inline like a shields.io badge.

Preview social card

This card auto-renders when someone shares https://repopilot.app/r/nilbuild/developer-roadmap on X, Slack, or LinkedIn.

Ask AI about nilbuild/developer-roadmap

Grounded in the actual source code. Pick a starter question or write your own.

Or write your own question

Onboarding doc

Onboarding: nilbuild/developer-roadmap

Generated by RepoPilot · 2026-08-03 · Source

Verdict

Mixed — Mixed signals — read the receipts

  • Last commit 3d ago
  • 27+ active contributors
  • CI configured
  • ⚠ Concentrated ownership — top contributor handles 62% of recent commits
  • ⚠ No tests detected in the complete Git tree
  • ⚠ Scorecard: default branch unprotected (0/10)

Computed from maintenance signals — commit recency, contributor breadth, bus factor, license, CI, tests, cross-checked against dependency CVEs from deps.dev and OpenSSF Scorecard

TL;DR

A content repository powering roadmap.sh, an interactive learning platform that serves developer career guides through structured roadmaps, best practices, and Q&A content. It stores 50+ markdown-based educational roadmaps (frontend, backend, DevOps, AI, etc.) in a monorepo, each with nested topic files containing learning materials, and provides TypeScript scripts to sync content between the Git repo and a backing database. Monorepo structure: root contains pnpm workspaces config (pnpm-workspace.yaml) and sync/cleanup scripts in TypeScript; content organized under roadmaps/{roadmap-name}/content/ with individual markdown files per topic, each tagged with a unique ID (e.g., 'acting--tool-invocation@sHYd4KsKlmw5Im3nQ19W8.md'). Scripts in root handle content synchronization, orphan cleanup, and repo-to-database publishing.

LLM-derived; treat as a starting point, not verified fact.

Who it's for

Developers seeking structured learning paths and career guidance across specializations (frontend, backend, DevOps, AI engineering); platform maintainers and community contributors who write and update roadmap content; the roadmap.sh application which consumes this content via database sync.

LLM-derived; treat as a starting point, not verified fact.

Maturity & risk

Actively developed and production-deployed—the repo powers the live roadmap.sh platform serving hundreds of thousands of developers. Codebase is lean (57 lines of JavaScript, 21k+ TypeScript) with focus on content and sync tooling rather than application logic. No formal test suite visible, minimal CI metadata provided, but the fact this powers a live platform indicates stability and active maintenance.

Low technical risk: dependencies are minimal and stable (markdown-it, turndown, node-html-parser for content processing). Main risks are content-centric: orphaned or outdated learning materials, sync failures between repo and database (see cleanup and sync scripts), and single-maintainer bottleneck for approving roadmap contributions. No breaking API changes expected since this is content distribution, not a library.

LLM-derived; treat as a starting point, not verified fact.

Active areas of work

Active expansion of the AI/ML roadmap track (ai-agents directory contains 50+ content files covering LLM agents, frameworks like LangChain/LlamaIndex/CrewAI, evaluation tools, memory strategies, and tool use patterns). Recent infrastructure work visible in sync scripts (sync-content-to-repo.ts, sync-repo-to-database.ts, cleanup-orphaned-content.ts) for maintaining consistency between Git and the backing database.

LLM-derived; treat as a starting point, not verified fact.

Get running

Clone the repo: git clone https://github.com/nilbuild/developer-roadmap.git && cd developer-roadmap. Install dependencies: pnpm install (pnpm is the monorepo manager; see pnpm-lock.yaml and pnpm-workspace.yaml). Format code: pnpm format. Sync scripts are run via pnpm sync:content-to-repo, pnpm sync:repo-to-database, and pnpm cleanup:orphaned-content as needed.

Daily commands: This is a content repository, not a runnable application. Dev workflow: pnpm format to lint content, pnpm sync:content-to-repo to pull content into the repo from the database, pnpm sync:repo-to-database to publish repo content to the live database, pnpm cleanup:orphaned-content to remove unused topic files. The scripts are meant for maintainers managing the content pipeline.

Map of the codebase

  • package.json — Defines the project as a monorepo with critical sync scripts between content repository and database.
  • pnpm-workspace.yaml — Configures the pnpm monorepo structure that manages multiple roadmap modules.
  • readme.md — Explains that roadmaps are interactive and community-driven, fundamental to understanding the project's purpose.
  • roadmaps/ai-agents/content/index.md — Entry point for AI agents roadmap content structure and navigation.
  • scripts/sync-content-to-repo.ts — Critical sync script that pushes content from repository into the codebase.
  • scripts/sync-repo-to-database.ts — Critical sync script that synchronizes repository content to the backend database.
  • scripts/cleanup-orphaned-content.ts — Maintenance script that removes content no longer referenced in roadmap structures.

Components & responsibilities

  • Content Repository (Git) (Git, Markdown) — Single source of truth for all markdown roadmap content with version history and community contribution support.
    • Failure mode: Loss of historical changes; blocking pull requests prevent content updates.
  • sync-content-to-repo Script (TypeScript, Node.js) — Pulls content from database and materializes it as markdown files in Git repository.
    • Failure mode: Failed sync leaves repository stale; overwrites local edits if database is source of truth.
  • sync-repo-to-database Script (TypeScript, markdown-it, Node.js) — Parses markdown files from repository and pushes parsed content to backend database.
    • Failure mode: Unpublished changes stuck in Git; parse errors prevent sync completion.
  • Markdown Parser (markdown-it, node-html-parser) — Converts markdown to structured format (AST) for validation and database ingestion.
    • Failure mode: Malformed markdown blocks parsing; broken links not detected before publication.
  • cleanup-orphaned-content Script (TypeScript, Node.js, File I/O) — Identifies and removes markdown files that are no longer referenced in any roadmap structure.
    • Failure mode: Incorrectly deletes referenced content; misses stale files leading to bloat.
  • Frontend (roadmap.sh) (React, HTML/CSS, JavaScript) — Consumes published content from database and renders interactive, clickable roadmap visualizations.
    • Failure mode: Database outage prevents content loading; rendering errors break user experience.

Data flow

  • Community ContributorGit Repository — Developers submit pull requests adding or modifying markdown topic files in roadmaps/**/content/.
  • Git Repositorysync-repo-to-database Script — Script reads all markdown files, parses them, and detects structural changes for database ingestion.
  • Markdown ParserBackend Database — Parsed content AST is serialized and stored, indexed by topic ID for fast retrieval.
  • Backend DatabaseFrontend (roadmap.sh) — Published roadmaps are queried and served to the browser as interactive node-based visualizations.
  • cleanup-orphaned-content ScriptGit Repository — Removes markdown files that have no inbound references from roadmap index or parent structures.

How to make changes

Add a New Roadmap Topic Node

  1. Create a new markdown file in roadmaps/{roadmap-name}/content/ with a unique ID suffix (e.g., @ABC123xyz) (roadmaps/ai-agents/content/new-topic@UniqueID.md)
  2. Write markdown content following the same structure as existing topics (headings, links, descriptions) (roadmaps/ai-agents/content/new-topic@UniqueID.md)
  3. Run sync-content-to-repo script to register the new content in the system (scripts/sync-content-to-repo.ts)
  4. Run sync-repo-to-database to push the new topic to the backend database (scripts/sync-repo-to-database.ts)

Add a New Learning Roadmap

  1. Create a new directory under roadmaps/ with the roadmap name (e.g., roadmaps/new-roadmap/) (roadmaps/ai-agents/)
  2. Create roadmaps/new-roadmap/content/ subdirectory and add an index.md file (roadmaps/ai-agents/content/index.md)
  3. Add topic markdown files following the naming convention with unique IDs (roadmaps/ai-agents/content/what-are-ai-agents@aFZAm44nP5NefX_9TpT0A.md)
  4. Update pnpm-workspace.yaml to include the new roadmap directory if creating a new workspace (pnpm-workspace.yaml)
  5. Run both sync scripts to register and publish the new roadmap (scripts/sync-repo-to-database.ts)

Update Content and Sync Changes

  1. Edit the markdown file in roadmaps/{roadmap-name}/content/ with your updates (roadmaps/ai-agents/content/agent-loop@Eih4eybuYB3C2So8K0AT3.md)
  2. Run prettier format script to ensure consistent markdown styling (package.json)
  3. Execute sync-repo-to-database to push changes to the backend database (scripts/sync-repo-to-database.ts)
  4. Run cleanup-orphaned-content to remove any stale references if content was deleted (scripts/cleanup-orphaned-content.ts)

Why these technologies

  • Markdown — Human-readable format enables easy contribution and version control via Git for educational content.
  • TypeScript — Provides type safety for sync scripts that transform content between repository, database, and runtime representations.
  • pnpm workspaces — Enables monorepo management of multiple roadmaps with shared dependencies while keeping packages isolated.
  • markdown-it & turndown — Bidirectional markdown/HTML conversion allows flexible content representation for different consumption contexts.
  • node-html-parser — Enables parsing and validation of HTML-converted content to ensure structural integrity during sync operations.

Trade-offs already made

  • Content stored as markdown files in Git rather than directly in database

    • Why: Enables community contributions via pull requests and provides version history and auditability.
    • Consequence: Requires explicit sync scripts to propagate changes to database; introduces potential for stale states if syncs fail.
  • Unique ID suffixes on markdown filenames (e.g., @ABC123xyz) instead of auto-incrementing IDs

    • Why: Allows files to be moved/renamed without breaking references while maintaining human readability.
    • Consequence: More verbose filenames; requires tooling to enforce uniqueness across content tree.
  • Separate sync-content-to-repo and sync-repo-to-database scripts instead of unified pipeline

    • Why: Provides fine-grained control and allows database to be source of truth or Git to be source of truth as needed.
    • Consequence: Increases complexity; risk of bidirectional sync conflicts if both scripts run without orchestration.

Non-goals (don't propose these)

  • Real-time synchronization of content between repository and database
  • Handling of user comments, ratings, or interactive course completion tracking
  • Authentication, authorization, or multi-user editing workflows
  • Localization or translation of roadmap content
  • Video hosting or multimedia content beyond markdown links

Code metrics

  • Avg cyclomatic complexity: ~4 — Codebase is straightforward ETL (extract, transform, load) with no algorithmic complexity; main challenge is maintaining consistency between Git and database.
  • Largest file: roadmaps/ai-agents/content/ (2,500 lines)
  • Estimated quality issues: ~3 — Missing error handling in sync scripts, no validation layer before database writes, and no automated tests visible in package.json; reliance on manual cleanup suggests automation gaps.

Anti-patterns to avoid

  • Bidirectional Sync Without Conflict Resolution (High)scripts/sync-content-to-repo.ts and scripts/sync-repo-to-database.ts: Two separate sync scripts can diverge if both are treating different sources as authoritative, risking data loss or stale content.
  • Filename-Based Content Identifiers (Medium)roadmaps/ai-agents/content/*.md: Relying on @UniqueID suffixes in filenames for content identity is fragile; filename changes could break references if not validated.
  • No Orphaned Content Detection in Scripts (Medium)scripts/sync-repo-to-database.ts: Cleanup of stale content is a separate manual script rather than automatic; can lead to database bloat if not run regularly.
  • No Content Validation Before Sync (Medium)scripts/sync-repo-to-database.ts: Scripts do not validate markdown structure, broken links, or ID conflicts before pushing to database.

Performance hotspots

  • scripts/sync-repo-to-database.ts (I/O bound) — Sequential parsing of all markdown files in the content tree; scales linearly with number of topics.
  • Backend Database (implied dependency) (External dependency) — All content serving depends on database availability; no client-side fallback or static export capability visible.
  • Git Repository + pnpm-workspace (Storage) — Monorepo structure requires all roadmaps to share a single Git history; large content trees may slow clone/checkout operations.

Traps & gotchas

ID uniqueness: Each markdown file must have a unique @ID suffix (e.g., @sHYd4KsKlmw5Im3nQ19W8); collisions will cause sync failures—check existing IDs before creating new files. Sync direction matters: sync:content-to-repo pulls from database (can overwrite local changes), while sync:repo-to-database pushes to live (use with caution on production). Database credentials: sync-repo-to-database.ts likely requires environment variables for database access (API keys, connection strings) not visible in this repo—consult maintainers before running. Orphan cleanup: cleanup-orphaned-content.ts may delete files if they're not referenced in a manifest; always commit changes before running cleanup scripts.

Architecture

Concepts to learn

  • Markdown-based content versioning — This repo treats learning roadmaps as versioned Git artifacts, enabling community contributions, PR reviews, and rollback—understanding this hybrid approach (Git + database) is key to modifying content safely
  • Content ID tagging (UUID suffix pattern) — Every topic file uses a @ID suffix for database synchronization; this decouples Git filenames from database primary keys, enabling renames and refactoring without breaking references
  • Bidirectional content sync — The sync scripts manage two-way consistency between the Git repo and a backend database; understanding which direction is authoritative prevents data loss and merge conflicts in a collaborative content workflow
  • Markdown-to-HTML transpilation (turndown library) — Content may be authored or stored as HTML in the database and converted to Markdown for Git; understanding this transformation prevents formatting loss and ensures portability
  • Monorepo dependency management with pnpm workspaces — This repo uses pnpm workspaces (pnpm-workspace.yaml) to organize multiple logical content packages without npm install overhead; essential for scaling content organization and understanding the root-level structure
  • Orphaned content cleanup patterns — The cleanup script identifies unused topic files that no longer link to a parent roadmap; understanding garbage collection strategies is crucial for maintaining a coherent, non-redundant content library
  • roadmapsh/roadmap.sh — The live front-end application that consumes content from this repo; see how roadmaps are rendered and interacted with
  • kamranahmedse/developer-roadmap — Potential predecessor or related community-driven roadmap project (if active); useful for comparing content curation approaches
  • scrimba/frontend-path — Similar interactive learning platform focused on structured developer paths; good reference for content pedagogy and UX patterns
  • sveltejs/site — Example of a framework documentation repository using markdown-based content with sync tooling; shows patterns for large-scale content management

PR ideas

Click to expand

To work on one of these in Claude Code or Cursor, paste: Implement the "<title>" PR idea from CLAUDE.md, working through the checklist as the task list.

Add TypeScript validation schema for roadmap content files

The repo has 100+ markdown content files in roadmaps/ai-agents/content/ with auto-generated IDs in filenames. There's no visible schema validation or TypeScript types ensuring content structure consistency. Creating a schema validator would catch malformed content before sync operations and prevent database inconsistencies.

  • [ ] Create src/types/content.ts with TypeScript interfaces for roadmap content (frontmatter, metadata, structure)
  • [ ] Create src/validators/content-validator.ts to validate markdown files against the schema using node-html-parser and markdown-it already in dependencies
  • [ ] Add a new npm script 'validate:content' that runs the validator against all files in roadmaps/*/content/
  • [ ] Reference this validator in the existing sync scripts (sync-content-to-repo.ts, cleanup-orphaned-content.ts) to prevent invalid data propagation

Add GitHub Actions workflow for content integrity checks

With 100+ content files and sync scripts that push to both repo and database, there's no CI preventing broken content from being committed. A workflow should validate markdown structure, check for orphaned files, and ensure sync scripts complete successfully on pull requests.

  • [ ] Create .github/workflows/content-validation.yml that runs on PR for any changes to roadmaps/ directory
  • [ ] Add job to validate markdown frontmatter and structure using the content-validator from PR #1
  • [ ] Add job to run 'npm run cleanup:orphaned-content --dry-run' to detect orphaned references
  • [ ] Add job to lint all markdown files with prettier --check to maintain formatting standards
  • [ ] Document the workflow in contributing.md with specific instructions for content contributors

Create unit tests for sync and cleanup scripts

The three main scripts (sync-content-to-repo.ts, sync-repo-to-database.ts, cleanup-orphaned-content.ts) handle critical data operations but have no visible test coverage. This is especially risky since they modify both repository and database state. Tests would ensure data integrity across sync operations.

  • [ ] Create tests/ directory with test files for each script: sync-content-to-repo.test.ts, sync-repo-to-database.test.ts, cleanup-orphaned-content.test.ts
  • [ ] Add test fixtures in tests/fixtures/ with sample markdown files and mock database states
  • [ ] Write tests covering: file parsing, ID validation, orphan detection, and rollback scenarios
  • [ ] Add 'test' and 'test:watch' npm scripts using tsx and a lightweight test runner (e.g., Node's test runner or Vitest)
  • [ ] Document testing requirements in contributing.md for future script modifications

Good first issues

  • Add missing test coverage for sync scripts: Create a test directory under scripts/ and write unit tests for sync-repo-to-database.ts to validate markdown parsing and database payload generation.
  • Expand the AI roadmap with 'RAG (Retrieval-Augmented Generation)' subtopic: Create roadmaps/ai-agents/content/retrieval-augmented-generation@{NEW_ID}.md with learning content, then link it from the main ai-agents structure.
  • Audit and update the JavaScript roadmap: Review roadmaps/javascript/content/ (if it exists, not fully visible), identify outdated frameworks or missing modern patterns (e.g., async/await, ESM), and propose markdown updates via PR with clear before/after examples.

Top contributors

Click to expand

Recent commits

Click to expand
  • 75ca4a9 — chore: sync content to repo (#10194) (github-actions[bot])
  • c706be9 — chore: sync content to repo (#10192) (github-actions[bot])
  • 38a3ce2 — chore: sync content to repo (#10191) (github-actions[bot])
  • 187e387 — chore: sync content to repo (#10189) (github-actions[bot])
  • e0c4a4b — chore: sync content to repo (#10185) (github-actions[bot])
  • bd8e655 — chore: sync content to repo (#10186) (github-actions[bot])
  • c6020b1 — chore: sync content to repo (#10184) (github-actions[bot])
  • 9503cbf — chore: sync content to repo (#10183) (github-actions[bot])
  • 2129f3b — chore: bump ci to node 24 and pnpm 11 (#10182) (arikchakma)
  • 4d8939e — chore: adjust header logo size (nilbuild)

Security observations

Click to expand

The codebase demonstrates moderate security posture with generally well-maintained dependencies. Primary concerns involve potential XSS risks from HTML/Markdown processing without visible sanitization, and unverified input handling in synchronization scripts. The project lacks visible security scanning automation and documented security policies. No critical vulnerabilities were identified in the dependency versions themselves, but implementation patterns for the sync scripts and content processing pipelines should be reviewed. Recommend adding automated dependency scanning, explicit input validation in all scripts, and HTML sanitization for any user-controlled content.

  • Medium · Potential XSS Risk in HTML Parsing — package.json dependencies - node-html-parser, turndown. The codebase uses 'node-html-parser' (v7.0.1) and 'turndown' (v7.2.0) for HTML/Markdown processing. Without proper sanitization, user-controlled HTML content processed by these libraries could lead to XSS vulnerabilities if the output is rendered in a web context without additional escaping. Fix: Implement strict input validation and output encoding. Use a dedicated HTML sanitizer library (e.g., 'sanitize-html' or 'DOMPurify') before processing untrusted content. Verify that all HTML output is properly escaped before rendering in web contexts.
  • Medium · Missing Input Validation in Sync Scripts — scripts/ directory (sync-content-to-repo.ts, sync-repo-to-database.ts, cleanup-orphaned-content.ts). The scripts 'sync-content-to-repo.ts', 'sync-repo-to-database.ts', and 'cleanup-orphaned-content.ts' are referenced but not visible. These scripts likely perform file operations and database interactions. Without visible input validation, they could be vulnerable to path traversal or injection attacks. Fix: Implement strict validation for all file paths and database queries. Use allowlists for permitted paths, sanitize all user inputs, and use parameterized queries for database operations. Avoid string concatenation for file paths and SQL queries.
  • Low · Outdated TypeScript Version — package.json - devDependencies. TypeScript is pinned to v5.8.3. While not directly a security vulnerability, using outdated versions may miss security-related compiler improvements and type safety enhancements. Fix: Regularly update TypeScript and all dependencies to the latest stable versions. Implement automated dependency scanning with tools like Dependabot or npm audit.
  • Low · Missing Dependency Audit Configuration — Repository root - missing security configuration files. No evidence of automated security scanning (e.g., npm audit in CI/CD, security.md, or SECURITY policy) visible in the provided files. Fix: Add 'npm audit' to CI/CD pipeline. Create a SECURITY.md file with vulnerability reporting guidelines. Use tools like Snyk or npm audit to regularly scan dependencies.
  • Low · No Content Security Policy or Trust Boundaries Defined — markdown-it processing pipeline (implicit from dependencies). The codebase processes and transforms markdown/HTML content. Without clear trust boundaries or CSP documentation, it's unclear how content validation is enforced. Fix: Document content validation requirements and trust boundaries. Implement markdown parsing with restricted plugins. Ensure all user-submitted content is validated against a schema before processing.

LLM-derived; treat as a starting point, not a security audit.

The exported doc (Copy CLAUDE.md / Download / .cursor/rules) also includes an agent protocol and a verification script written for AI coding agents — omitted here to keep this view scannable.

Embed this chat in your README

Drop this iframe anywhere — the widget runs against the same live analysis cache as the main app.

<iframe
  src="https://repopilot.app/embed/nilbuild/developer-roadmap"
  width="100%" height="500"
  style="border:1px solid #d0d7de; border-radius:8px;"
  allow="microphone"
  loading="lazy"
></iframe>