Pipeline DAG, runners, caching và evidence
CI biến commit thành verified immutable artifact; green phải có nghĩa cùng checks đáng tin chạy trên source đúng.
Pipeline flow
Checkout pinned commit → restore verified cache → compile/lint/unit → integration/contract → static/dependency/secret scan → package → SBOM/provenance/sign → publish. Fail fast cheap checks, parallel independent jobs, retain reports/logs.
Triggers and trust
PR/push/tag/schedule/manual có permissions/secrets khác. Untrusted fork code không chạy với write token/secrets hoặc privileged self-hosted runner. Merge queue/batch kiểm tra candidate gần target branch, giảm “PR xanh riêng nhưng merge đỏ”.
Runners
Ephemeral isolated runners giảm persistence; self-hosted cần patch/network/credential cleanup và workload trust separation. Container runner không tự sandbox hostile code nếu host socket/privilege exposed.
Caching
Cache dependencies/build output theo lockfile/toolchain/platform và trust boundary. Cache là optimization, artifact là deliverable. Poisoned cache có thể compromise build; không restore untrusted PR cache vào privileged release.
Monorepo
Change detection + dependency graph chọn affected services nhưng shared library/config changes phải fan out đúng. Periodic full build phát hiện missed edges. Concurrency cancellation không hủy release/deploy critical job sai lúc.