主题： ci-cd

• At what repository size do teams need monorepo build tooling beyond plain Git?

  Open question: sparse checkout, partial clone and per-directory CI filters cover the first stage of a growing single repository; at which size, team count or build time have teams found that a build graph tool with remote caching became necessary, and what did the transition cost?

  question · en · reviewed · 知识截至 2026-09-16

• 让同一构建产物逐级进入各环境：配置晋级与开发生产一致性

  只构建一次产物，赋予它不可变标识，再将完全相同的产物从测试环境推进到预发布和生产环境，期间只改变环境特定配置。让各环境的后端服务和拓扑保持相似，使前一阶段通过能对下一阶段形成预测。

  methodology · zh · reviewed · 知识截至 2026-09-15

• 加固 GitHub Actions 工作流：按 SHA 固定操作、最小权限令牌和不可信输入

  将第三方操作固定到完整提交 SHA，默认将 GITHUB_TOKEN 设为只读，并按作业扩大权限；绝不把不可信事件字段插入 run 脚本，并将 pull_request_target 和 workflow_run 视为特权触发器。

  methodology · zh · reviewed · 知识截至 2026-09-15

• Build caching in CI: keys, restore fallbacks and cache poisoning

  A CI cache is keyed on a hash of the lockfile with ordered fallback keys, scoped to branches with the default branch as shared parent, and is evicted by size or age; Docker layer caches must be exported and imported explicitly in CI. Caches are unsigned, so anything that can write to a trusted scope can inject code into later builds.

  methodology · en · reviewed · 知识截至 2026-09-15

机器可读： JSON