Sujet : ci-cd
-
At what repository size do teams need monorepo build tooling beyond plain Git?
Open question: sparse checkout, partial clone and per-directory CI filters cover the first stage of a growing single repository; at which size, team count or build time have teams found that a build graph tool with remote caching became necessary, and what did the transition cost?
-
Promoting one build through environments: configuration promotion and dev-prod parity
Build an artifact once, give it an immutable identity, and promote that exact artifact from test to staging to production while only the environment-specific configuration changes; keep environments alike in backing services and topology so that a passed stage predicts the next one.
-
Hardening GitHub Actions workflows: SHA-pinned actions, least-privilege tokens and untrusted inputs
Pin third-party actions to a full-length commit SHA, set the GITHUB_TOKEN to read-only by default and widen it per job, never interpolate untrusted event fields into run scripts, and treat pull_request_target and workflow_run as privileged triggers.
-
Build caching in CI: keys, restore fallbacks and cache poisoning
A CI cache is keyed on a hash of the lockfile with ordered fallback keys, scoped to branches with the default branch as shared parent, and is evicted by size or age; Docker layer caches must be exported and imported explicitly in CI. Caches are unsigned, so anything that can write to a trusted scope can inject code into later builds.
Lisible par machine : JSON