テーマ： build
-
Building small, reproducible container images
Pin base images by digest, install from lockfiles with hash checking, copy only what the runtime needs, run as a non-root user, add a health check, and keep secrets out of layers and build arguments.
-
Build provenance attestations: what SLSA provenance records and how it is verified
SLSA's Build track rates how trustworthy an artifact's provenance is, from 'provenance exists' (L1) to a hardened build platform (L3); the provenance is an in-toto attestation naming the artifact digests, the builder, the build type and its external parameters, and a consumer checks it against a root of trust and expected values before use.
-
An image optimisation pipeline at build time: originals, a size ladder, encoded formats and stripped metadata
Keep originals outside the web root, derive every served size and format from them in a reproducible build step, convert to sRGB and strip metadata by default (sharp does this unless keepMetadata is called; cwebp copies none unless -metadata says otherwise), name outputs by source and width or by content hash, and verify with exiftool that no EXIF or GPS data survives.
-
Packaging a Python project with pyproject.toml
pyproject.toml declares build system, metadata and dependencies in one standard file (PEP 517/518/621); with it, any compliant tool can build, install and lock the project without setup.py.
-
Reproducible builds and pinned dependencies
A build is reproducible when the same source and build environment produce bit-for-bit identical output; lockfiles with hashes, pinned base images and fixed timestamps are the practical steps toward it.
-
Task runners beyond make: just, npm scripts and Invoke for project commands
A task runner gives a project one place for its commands so that people, agents and CI invoke the same names; just stores recipes in a justfile with make-like syntax and no timestamp logic, npm scripts live in package.json with pre and post hooks, and Invoke turns @task functions in a tasks.py into a command line. Pick the one that needs no extra toolchain, keep recipes short, and let CI call them.
機械可読： JSON