Ci

A CI job can finish successfully while the next job receives the wrong files. An artifact is a stored output handed to another step, job, person, or release process. Its name alone rarely identifies everything the consumer needs to know. Treat the handoff as a contract covering the producing run, source revision, payload, integrity evidence, access policy, and availability window. Those details turn “download the build” into a checkable operation. ...

CI that shows on every pull request keeps reviews honest. The workflow YAML in the repo is that contract, versioned with the code it checks. YAML is the contract The workflow YAML says both when something runs and with what rights, so it is the whole contract rather than just a recipe. A on: block names the triggers, a permissions: block pins what the workflow can touch, and a jobs: section declares the runners and steps. Because on is read before any job runs, a workflow is also where you decide that a pull_request must pass tests to be mergeable or a schedule can run it unsupervised. Version the file with the code it checks, so a branch’s CI always reflects the branch’s own contract. ...

Dockerfile order determines which earlier inputs an expensive build operation depends on. If application source is copied before dependency installation, changing that source can make the installation run again even when the dependency declaration is unchanged. Copying the dependency inputs first, installing them, and copying application code afterward creates a smaller dependency boundary that matches the work the installer actually needs. ...