中文
devexamples
← Workflows

阅读中文版本

Hermetic Build CI Workflow

Pin all inputs, fetch dependencies from a controlled mirror with locked versions, disable network during the build step, and prove the build only uses declared inputs.

advanced~150 minbuildsecurityci

Objective

Make CI builds hermetic so they depend only on declared, pinned inputs and cannot be affected by the outside world.

Environment

  • A CI system with network controls
  • A dependency mirror or cache

Steps

1. Pin toolchain, base images, and dependencies

Pin toolchain, base images, and dependencies with lock files.

Expected state: All inputs are fixed.

2. Pre-fetch dependencies into a controlled mirror

Pre-fetch dependencies into a controlled mirror or cache.

Expected state: The build does not reach the public internet.

3. Run the build step with network

Run the build step with network disabled.

Expected state: Undeclared network dependencies fail loudly.

4. Record the inputs and verify

Record the inputs and verify the build only uses them.

Expected state: Hermeticity is provable.

Decision points

Disable network for all steps or just the build?

  • All build steps
  • Only compile

Disable for the whole build; install steps should fetch from the mirror, not the open internet.

Mirror everything or use the public registry with locks?

  • Mirror
  • Locks only

Mirror when supply chain integrity matters; locks alone still trust the registry at build time.

Expected outcome

CI builds that succeed with the network disabled and depend only on locked, mirrored inputs.

Verification

Confirm the build step passes with networking off and that removing a needed input from the mirror fails the build.

Cleanup

Document the mirror refresh process and the pinned input list.

Overview

Make CI builds hermetic so they depend only on declared, pinned inputs and cannot be affected by the outside world. Confirm the build step passes with networking off and that removing a needed input from the mirror fails the build.

Steps

  1. Pin toolchain, base images, and dependencies with lock files. Expected state: All inputs are fixed.
  2. Pre-fetch dependencies into a controlled mirror or cache. Expected state: The build does not reach the public internet.
  3. Run the build step with network disabled. Expected state: Undeclared network dependencies fail loudly.
  4. Record the inputs and verify the build only uses them. Expected state: Hermeticity is provable.
# CI step with network disabled
- name: build
  run: ./build.sh
  # runner configured without egress; deps already in the mirror

Verification

  • CI builds that succeed with the network disabled and depend only on locked, mirrored inputs.

Decision points

  • Disable network for all steps or just the build? Options: All build steps; Only compile. Recommended: Disable for the whole build; install steps should fetch from the mirror, not the open internet.
  • Mirror everything or use the public registry with locks? Options: Mirror; Locks only. Recommended: Mirror when supply chain integrity matters; locks alone still trust the registry at build time.