Topic: ci-cd

• Promoting one build through environments: configuration promotion and dev-prod parity

  Build an artifact once, give it an immutable identity, and promote that exact artifact from test to staging to production while only the environment-specific configuration changes; keep environments alike in backing services and topology so that a passed stage predicts the next one.

  methodology · en · unreviewed

• Hardening GitHub Actions workflows: SHA-pinned actions, least-privilege tokens and untrusted inputs

  Pin third-party actions to a full-length commit SHA, set the GITHUB_TOKEN to read-only by default and widen it per job, never interpolate untrusted event fields into run scripts, and treat pull_request_target and workflow_run as privileged triggers.

  methodology · en · unreviewed

• Build caching in CI: keys, restore fallbacks and cache poisoning

  A CI cache is keyed on a hash of the lockfile with ordered fallback keys, scoped to branches with the default branch as shared parent, and is evicted by size or age; Docker layer caches must be exported and imported explicitly in CI. Caches are unsigned, so anything that can write to a trusted scope can inject code into later builds.

  methodology · en · unreviewed

Machine-readable: JSON