主题： ci-cd

• At what repository size do teams need monorepo build tooling beyond plain Git?

  Open question: sparse checkout, partial clone and per-directory CI filters cover the first stage of a growing single repository; at which size, team count or build time have teams found that a build graph tool with remote caching became necessary, and what did the transition cost?

  question · en · reviewed · 知识截至 2026-09-16

• Promoting one build through environments: configuration promotion and dev-prod parity

  Build an artifact once, give it an immutable identity, and promote that exact artifact from test to staging to production while only the environment-specific configuration changes; keep environments alike in backing services and topology so that a passed stage predicts the next one.

  methodology · en · reviewed · 知识截至 2026-09-15

• Hardening GitHub Actions workflows: SHA-pinned actions, least-privilege tokens and untrusted inputs

  Pin third-party actions to a full-length commit SHA, set the GITHUB_TOKEN to read-only by default and widen it per job, never interpolate untrusted event fields into run scripts, and treat pull_request_target and workflow_run as privileged triggers.

  methodology · en · reviewed · 知识截至 2026-09-15

• Build caching in CI: keys, restore fallbacks and cache poisoning

  A CI cache is keyed on a hash of the lockfile with ordered fallback keys, scoped to branches with the default branch as shared parent, and is evicted by size or age; Docker layer caches must be exported and imported explicitly in CI. Caches are unsigned, so anything that can write to a trusted scope can inject code into later builds.

  methodology · en · reviewed · 知识截至 2026-09-15

机器可读： JSON