CI jobs that build artifacts must be deterministic and guarded, and CI tests must be scoped to avoid unnecessary heavy work.
Apply these rules 1) Guard CI assumptions (fail loudly): If a build-time tweak is required (e.g., removing -march=native leakage), make the script error when the expected input/state isn’t found—never allow a “no-op” edit that silently produces a different binary. 2) Keep scripts portable and version-stable: Use portable tooling options (e.g., sed -i.bak) and pin dependency/build versions so pattern matches don’t break unexpectedly. 3) Avoid rebuilding heavyweight dependencies in-line: Prefer prebuilt images/artifacts, caching, or reusing a prior build. 4) Scope expensive tests by change set: Move costly jobs (like Docker image build + integration runs) into separate workflows/jobs and run them only when relevant files change.
Example: fail loudly + portable edit (bash)
set -euo pipefail
# ... obtain/extract source at a pinned version ...
file="CMakeLists.txt"
needle='add_compile_options(-march=native)'
# Portable in-place edit with backup, and verify the line existed.
if ! grep -qF "${needle}" "${file}"; then
echo "Expected line not found: ${needle} (refusing to build native-leaking artifact)" >&2
exit 1
fi
sed -i.bak "/${needle//\//\\\/}/d" "${file}"
Example: run expensive workflow only when relevant paths change (GitHub Actions)
on:
push:
paths:
- 'ops.lua'
- 'docker-entrypoint.sh'
- 't/cli/test_standalone_docker.sh'
- 'ci/**'
This standard prevents silent build drift and keeps pipelines fast by doing the minimum necessary work per change.