Hosting & CloudGlossaryPart 7 of 17
CI/CD Platforms Glossary
75 terms from the Hosting & Cloud book's CI/CD Platforms part, each defined in a line and linked to the chapter that explains it.
- 24-hour lease (macOS): Apple's license term allowing Apple hardware to be leased for developer services only for at least 24 consecutive hours to one lessee, which is why hosted macOS minutes carry idle cost (Runners & Build Infrastructure).
- Actions Runner Controller (ARC): the Kubernetes way to run ephemeral GitHub Actions runners, a community project that became a GitHub project and gained a runner scale sets mode (Runners & Build Infrastructure).
- Amazon ECR: AWS's container registry, billed for storage and internet egress with same-region transfer free (Artifacts & Registries).
- Argo CD and Argo Rollouts: CNCF Kubernetes delivery tools that treat Git as desired state and run blue/green and canary rollouts with metric analysis and automatic promotion or rollback (Continuous Delivery Platforms).
- AWS CodeBuild: AWS's build service, with container-based build environments, Lambda compute and reserved capacity (including Mac), billed per minute by compute type (Runners & Build Infrastructure).
- AWS CodeDeploy: AWS's deployment service, based on Amazon's internal Apollo, doing rolling updates with health checks and automatic rollback, gated through CodePipeline stages (Continuous Delivery Platforms).
- Azure Pipelines: CI from Microsoft's Azure DevOps suite for any repository, priced by parallel jobs with unlimited minutes (From Tinderbox to Jenkins: How CI Began).
- Azure Pipelines environments: Azure DevOps environments whose approvals and checks sit on the resource being deployed to, with deployment strategies in YAML (Continuous Delivery Platforms).
- Bamboo: Atlassian's licensed CI server, whose hosted Bamboo Cloud was discontinued and whose Data Center edition has a scheduled end of life (From Tinderbox to Jenkins: How CI Began).
- Bitbucket Pipelines: Atlassian's CI built into the Bitbucket code host, billed in build minutes scaled by runner size (From Tinderbox to Jenkins: How CI Began).
- Branch rules: an environment protection that limits which branches or tags may deploy to an environment, such as protected branches only (Continuous Delivery Platforms).
- Buildkite: CI sold as the hybrid model: a SaaS control plane with customer-run agents, so source code and secrets stay in the customer's infrastructure (Runners & Build Infrastructure).
- Bypass (deployment gate): an administrator overriding an environment's approvals or checks; Azure Pipelines shows the bypass, and the playbook logs every one (Continuous Delivery Platforms).
- CircleCI: independent hosted CI that later added self-hosted runners, priced in credits per minute by resource class (From Tinderbox to Jenkins: How CI Began).
- CloudBees: the commercial Jenkins company (The CI/CD Platform Business).
- Code-host CI: CI built into where the code lives (GitHub Actions, GitLab CI, Bitbucket Pipelines, Azure Pipelines), the kind of hosted CI that mostly survived (From Tinderbox to Jenkins: How CI Began).
- Codecov Bash Uploader: the 2021 incident in which a credential exposed by a Docker image build let attackers modify a script that sent CI environment variables out, which argued for short-lived credentials and rotating everything in CI (Pipeline Supply-Chain Security).
- Cost factors: pricing (GitLab, Bitbucket) that expresses each machine type as a multiple of a base minute drawn from the plan's quota (The CI/CD Platform Business).
- Credits (CI): a single currency the customer buys in packs and spends per minute by resource class (CircleCI, Travis), which lets the vendor reprice a class without changing the pack price (The CI/CD Platform Business).
- CruiseControl: ThoughtWorks' open-source build loop that polled version control, an early CI server (From Tinderbox to Jenkins: How CI Began).
- Custom deployment protection rules: GitHub's external checks that let a third-party service approve or reject a deployment to an environment (Continuous Delivery Platforms).
- Cyber Resilience Act (CRA): the EU regulation that phases in vulnerability and incident reporting for manufacturers and an Annex I requirement to document components, including a machine-readable SBOM (Pipeline Supply-Chain Security).
- Digest: the immutable content address of an image, which deployments should reference because tags move, and which tells a retention policy what is in use (Artifacts & Registries).
- Docker Build Cloud: Docker's hosted build service, with build minutes included in Docker plans and no on-demand overage (The CI/CD Platform Business).
- Docker Hub: Docker's public registry, which rate-limits pulls per account and, for anonymous traffic, per IPv4 address or IPv6 /64 (Artifacts & Registries).
- Ephemeral runner: a runner that gets a machine nobody used before and nobody uses after, the default for hosted jobs and the rule whenever the code is untrusted (Runners & Build Infrastructure).
- Executive Order 14028: the US order that tasked NIST with software supply chain guidance, with SBOMs among the workstreams (Pipeline Supply-Chain Security).
- Firecracker microVM: a lightweight VM per job that gives Docker a VM boundary, the alternative to mounting the host's Docker socket or running privileged Docker-in-Docker (Runners & Build Infrastructure).
- Flag service: releasing by feature flag rather than deploy (LaunchDarkly, OpenFeature providers), with per-user rollout and an instant kill switch; a flag flip is a release (Continuous Delivery Platforms).
- Fulcio: Sigstore's certificate authority, which issues short-lived certificates bound to an OIDC identity (Pipeline Supply-Chain Security).
- GhostAction: an incident in which workflows were pushed into repositories with stolen maintainer access to post secrets out, which argued for branch protection on workflow files and short-lived tokens (Pipeline Supply-Chain Security).
- GitHub Actions: workflows in the GitHub code host, run on hosted or self-hosted runners and priced per minute by OS and size (From Tinderbox to Jenkins: How CI Began).
- GitHub Container Registry (GHCR): GitHub's registry at
ghcr.io, private by default, with storage and bandwidth "currently free" (Artifacts & Registries). - GitHub environments: Actions' deployment targets carrying required reviewers, a wait timer, branch rules and custom protection rules, set outside the workflow file (Continuous Delivery Platforms).
- GitLab CI: CI built into the GitLab code host, run on runners (From Tinderbox to Jenkins: How CI Began).
- GitLab protected environments: GitLab environments that restrict deployment, with deployment approvals on Premium and Ultimate (Continuous Delivery Platforms).
- GitLab Runner autoscaling: GitLab's runner autoscaling through Fleeting, a plugin-based abstraction over a cloud's instance groups, driven by the Docker Autoscaler and Instance executors (Runners & Build Infrastructure).
- Google Artifact Registry: Google's registry, the successor to Container Registry, whose shutdown forced a registry migration on customers (Artifacts & Registries).
- Google Cloud Build: Google's per-minute cloud build service (The CI/CD Platform Business).
- Hudson, then Jenkins: the open-source CI server with plugins, renamed Jenkins after a trademark dispute; Jenkins sits under the Continuous Delivery Foundation and Hudson went to Eclipse (From Tinderbox to Jenkins: How CI Began).
- Hybrid model: self-hosted runners on a SaaS control plane: the customer owns hardware, network and cost while the vendor runs orchestration, and platform fees can appear (The CI/CD Platform Business).
- Independent hosted CI: hosted CI sold by a vendor that isn't the code host (CircleCI, Travis CI, Buildkite), selling speed and features and working with several code hosts (From Tinderbox to Jenkins: How CI Began).
- JFrog Artifactory: JFrog's universal repository for many package formats, self-hosted or cloud (Artifacts & Registries).
- Keyless signing: signing with short-lived certificates bound to an OIDC identity and recorded in a public log (Sigstore), so there are no signing keys to steal (Pipeline Supply-Chain Security).
- Kubernetes reconciler: continuous delivery with Git as desired state and controllers for rollout strategies (Argo CD and Rollouts), with no CD server and built-in drift correction (Continuous Delivery Platforms).
- Licensed server: a commercially licensed CI server with build agents (TeamCity, Bamboo Data Center), with vendor support and vendor end-of-life risk (From Tinderbox to Jenkins: How CI Began).
- OIDC federation: a CI job exchanging a signed platform token describing itself for short-lived cloud credentials under a trust policy, so no long-lived cloud keys sit in the CI secret store (Pipeline Supply-Chain Security).
- Parallel jobs: pricing (Azure Pipelines) that sells concurrency, unlimited minutes per job slot, so the bill is fixed and slow builds cost waiting instead (The CI/CD Platform Business).
- Per-minute SKUs: pricing (GitHub, CodeBuild, Cloud Build) that prices each machine type separately and rounds each job up to a whole minute, a rounding that is part of the margin (The CI/CD Platform Business).
- Pull accounting: a registry counting manifest requests per principal and, for anonymous traffic, per IPv4 address or IPv6 /64, in a sliding window; layer caches don't reduce the count (Artifacts & Registries).
- Pull-through cache: a local mirror of an upstream registry that avoids rate limits and egress and survives upstream outages, at the risk of a stale or poisoned cache (Artifacts & Registries).
- Rekor: Sigstore's public transparency log, which lets a consumer verify that an artifact was signed by a given workflow at a given time (Pipeline Supply-Chain Security).
- Remote execution: distributing and caching build actions across many machines over Bazel's Remote Execution API, where a cache hit skips work; it needs hermetic builds (Runners & Build Infrastructure).
- Retention policies (registry): rules that delete untagged manifests after a period and keep the newest N tags per repository, never deleting digests pinned by a running deployment (Artifacts & Registries).
- Runner labels: the scheduler's interface: jobs ask for labels such as
linux,arm64orgpu, and the control plane matches them to runners that advertise them (Runners & Build Infrastructure). - SBOM (software bill of materials): a component inventory per build that answers "are we affected" fast and supports CRA compliance (Pipeline Supply-Chain Security).
- Self-approval: a person approving a deployment they started, which GitHub environments can prevent and GitLab disallows by default (Continuous Delivery Platforms).
- Self-hosted runners: the customer's machines running the vendor's agent, which polls the control plane for jobs, giving the customer its own hardware, network and cost (Runners & Build Infrastructure).
- Self-run OCI registry: registry software (Distribution, Harbor) on the operator's own storage, with full control and no rate limits but storage, garbage collection and availability to run (Artifacts & Registries).
- Self-run open-source server: a CI server the customer runs (Jenkins), running any workflow through plugins with no per-minute cost, at the price of plugin sprawl and upgrades (From Tinderbox to Jenkins: How CI Began).
- SHA pinning: referencing actions by commit rather than tag, enforced by organization policy, so a moved tag can't reach the workflow (Pipeline Supply-Chain Security).
- Shai-Hulud: a self-replicating npm worm that stole tokens and republished victims' packages; its second wave registered infected hosts as self-hosted runners (Pipeline Supply-Chain Security).
- Signed provenance: the build platform signing a statement of what it built and how, so consumers can verify origin (Pipeline Supply-Chain Security).
- SLSA: the supply-chain framework whose Build levels run from L0 (none) through L2 (signed provenance from a hosted platform) to L3 (a hardened platform with isolated runs and an unreachable signing secret) (Pipeline Supply-Chain Security).
- SolarWinds (SUNSPOT and SUNBURST): the incident in which malware on the build server swapped one source file during the build and restored it afterward, the case for hardened, isolated builds with provenance (Pipeline Supply-Chain Security).
- Sonatype Nexus Repository: Sonatype's artifact repository, whose free Community Edition has a usage ceiling (Artifacts & Registries).
- Spinnaker: Netflix's open-source multi-cloud continuous delivery tool of pipelines of deployment stages, now under the Continuous Delivery Foundation (Continuous Delivery Platforms).
- TeamCity: JetBrains' licensed CI server with build agents (From Tinderbox to Jenkins: How CI Began).
- Third-party runner vendors: vendors (Depot, Blacksmith, Namespace, Ubicloud, WarpBuild, Actuated) selling faster or cheaper machines registered to the code host as self-hosted runners, tying their business to its terms (Runners & Build Infrastructure).
- Tinderbox: Netscape's release-engineering system of build machines reporting to a status page, the shape every CI system kept: many agents, one coordinator, a result per commit (From Tinderbox to Jenkins: How CI Began).
- tj-actions/changed-files (CVE-2025-30066): the incident in which a popular action's tags were repointed at a commit that dumped secrets into logs, the case for SHA pinning (Pipeline Supply-Chain Security).
- Travis CI: hosted CI that was free for open source on travis-ci.org until that service shut down, later priced in credits (From Tinderbox to Jenkins: How CI Began).
- Trusted publishing: a registry accepting uploads only from a named workflow, exchanging its OIDC token for a short-lived upload token so no publish token is stored (npm, PyPI) (Pipeline Supply-Chain Security).
- Universal repository: one store for every package format plus proxies of public registries (Artifactory, Nexus), bought for governance (Artifacts & Registries).
- Wait timer: a delay an environment imposes before a deployment proceeds, such as GitHub's configurable timer or Azure's business-hours check (Continuous Delivery Platforms).