CI/CD Concepts

A path filter compares the files a change touched against glob patterns and runs a job only when one matches. It sees file paths only, so it misses packages affected indirectly through dependency edges or shared root files.

A stage is a unit of ordering — a named phase that acts as a barrier before the next one starts. A job is a unit of allocation — one machine and one workspace, and the thing that runs in parallel. A step is a unit of execution — one command inside a job.

Semantic Versioning encodes compatibility: bump MAJOR for a backward-incompatible change to the public API, MINOR for backward-compatible new functionality, PATCH for a backward-compatible bug fix. The public contract decides the bump, not how much code changed.

A provider-hosted runner is a fresh machine the CI vendor creates per job, bills per minute, then destroys. A self-hosted runner is a machine you own and register yourself: usually cheaper at volume and able to reach private networks, but you inherit patching, isolation and cleanup.

A CI secret store keeps the value out of the repository and out of history, encrypts it at rest, hides it from the UI once saved, and masks it in logs. It does not limit what the credential can do, or stop a job that receives it from sending it anywhere.

A CI/CD pipeline holds the credentials that reach production and its output is deployed without anyone re-reading it, so compromising the build is equivalent to compromising every system that build can deploy to.

Take the URL out of the build so one bundle serves every environment, and supply it at deploy time — substituted into the served files at start-up, fetched from a per-environment config file, or derived from the serving origin.

Derive the key from a digest of every input that determines the cached content: the lockfile, the toolchain version, the operating system and architecture. Too-specific keys never hit and waste effort; too-loose keys hit while stale and silently corrupt builds.

Surge buys capacity with spare resources: extra instances start before old ones stop. Unavailable buys speed with reduced capacity: old instances stop first. Surge zero degrades a busy service mid-rollout; unavailable zero stalls the rollout when there is no headroom to schedule the extras.

A first-class environment is a named deployment target the delivery platform owns: it carries its own scoped credentials, protection rules that decide who and what may deploy to it, and a recorded deployment history that serves as the audit trail.

The tool builds a dependency graph of the repository's projects, maps the changed files to the projects that own them, then walks the graph backwards to include every project that transitively depends on those. Path filters see only the directly edited directories.

Runs start from a branch push, a pull/merge request, a tag, a schedule, a manual button, an upstream pipeline, or an external API call. Each differs in how often it fires, who is waiting for the result, and how much compute it burns per merge.

OIDC federation replaces a stored cloud key with a trust relationship. The CI platform mints a short-lived signed identity token describing the specific run; the cloud verifies its signature and claims against a trust policy and hands back temporary credentials.

A mutable reference resolves at build time to whatever the publisher has there now, so a third party can change what your build executes with no commit and no review in your repository. A digest names the exact bytes, making substitution impossible.

A cache is a best-effort copy of data a job could regenerate itself, kept only to make later runs faster; an artifact is a required output a later job or a release consumes. Every job must still succeed on an empty cache.

Recreate stops every old instance before starting any new one, so there is a deliberate downtime window and never two versions running at once. Choose it when mixed versions would corrupt shared state or fight over an exclusive resource.

A manual approval gate pauses a run at a boundary before a protected stage until a permitted person approves it. A platform-level gate holds the run as pending state with no agent allocated, and expires after a configured timeout.

A whole-repository coverage threshold is dominated by legacy code, so one change barely moves it and the gate rarely fires on the change that deserves it. Gate on coverage of the lines the change touched, or ratchet the number so it can never fall.

Locked (fixed) mode gives every package the same version number and republishes them together on each release. Independent mode bumps and publishes only the packages that changed, each on its own version line, at the cost of far more bookkeeping.

A barrier makes every job in a phase wait for the slowest job in the previous phase, so total time is the sum of those slowest jobs. A dependency graph lets each job start as soon as its own inputs are ready, so total time is the longest actual chain.

Conventional Commits give each commit a type — fix, feat, or a breaking marker. A release job reads every commit since the last release tag, derives the SemVer bump from the highest-ranked type it finds, generates the changelog from the same messages, then tags and publishes.

A container isolates the filesystem view, processes and network but shares the host kernel, so a kernel bug or a privileged mount escapes it. A virtual machine gives the job its own kernel and is the strongest boundary. A shared bare-metal machine contains nothing: jobs share a user, disk and credentials.

A reused runner carries state forward: leftover workspace files, globally installed tools, package-manager config and credentials in the agent user's home directory, stray processes, and cached images. The build silently depends on it. Single-use runners — one job per instance, then destroyed — remove the class.

The CI engine substitutes the title into the script text before any shell runs, so an attacker-chosen title becomes part of the program rather than data. Bind such values to environment variables and reference them quoted instead.

Retain by class, not by age alone: expire per-commit and pull-request builds quickly, exempt any artifact an environment has actually run, and keep released artifacts for at least as long as your stated rollback horizon.

Promotion changes a reference, not the artifact — the record of which build production is declared to run. For it to mean anything, production must deploy an immutable identity such as a content digest, never a tag that promotion moves.

Restoring a cache places files chosen by whoever wrote it onto disk, and a build then executes them with the trusted job's credentials. Containment is scoping: untrusted refs get their own cache namespace, read from trusted entries but never write them.

Each parallel job repays a fixed cost — queue wait, checkout, dependency restore, image pull, service startup — and that cost does not divide. Add unbalanced shards and shared bottlenecks and the speedup flattens. Choose the split where the next shard's saving stops exceeding that fixed cost.

A standby that passed smoke tests at near-zero traffic is still cold: empty caches, unestablished connection pools, uncompiled hot paths and an autoscaler sized for no load. Warming means giving it real load — shadow traffic, pre-scaling and pre-opened pools — before the switch.