CI

A CI job can finish successfully while the next job receives the wrong files. An artifact is a stored output handed to another step, job, person, or release process. Its name alone rarely identifies everything the consumer needs to know. Treat the handoff as a contract covering the producing run, source revision, payload, integrity evidence, access policy, and availability window. Those details turn “download the build” into a checkable operation. ...

A workflow can produce evidence for a merge decision, but YAML alone does not make that evidence mandatory. A dependable build gate connects the intended event, the exact revision being tested, meaningful test results, and a repository rule requiring the correct check. Review those connections together. A green badge on some earlier run is not proof that the proposed merge has satisfied today’s requirements. ...

Dockerfile order determines which earlier inputs an expensive build operation depends on. If application source is copied before dependency installation, changing that source can make the installation run again even when the dependency declaration is unchanged. Copying the dependency inputs first, installing them, and copying application code afterward creates a smaller dependency boundary that matches the work the installer actually needs. ...