CI/CD & Build Infrastructure Glossary

Actions Runner Controller is a Kubernetes controller that manages self-hosted GitHub Actions runners within a cluster. Runner scale sets provision execution capacity in response to demand while cluster infrastructure remains separately operated.

Agent-driven CI describes workflows in which software agents trigger, inspect, or respond to build and test runs. It is an automation pattern rather than a standard protocol, and the underlying CI permissions and checks still apply.

An AI coding agent is software that uses an AI model to plan or perform development tasks through tools such as editors, terminals, and test runners. Its generated changes still require appropriate validation and access controls.

An API key is a credential used to authenticate requests to a service API. Its effective permissions depend on the service's scopes and access model, and possession may be sufficient to exercise those permissions.

Apple Silicon is Apple's family of systems on a chip used in modern Macs and other devices. For Mac build infrastructure, the term usually refers to Arm-based processors that execute ARM64 software natively.

An application programming interface defines how software components request operations or exchange data. Web APIs commonly specify endpoints, request formats, authentication, and responses so automation can manage resources without navigating a user interface.

ARM64 is the 64-bit Arm architecture used by processors such as Apple Silicon and AWS Graviton. Native ARM64 executables require compatible operating-system interfaces as well as the correct processor instruction set.

An artifact is a file or collection of files produced by a build or workflow and retained for later use. Examples include compiled binaries, test reports, release packages, and deployment bundles.

An artifact cache stores dependencies or build outputs under input-related keys so later builds can reuse them. It accelerates work that could be recomputed and is distinct from an artifact archive retained as a deliverable.

Artifact retention is the period a platform keeps uploaded workflow outputs before deletion. Repository policies and per-upload settings determine the effective lifetime, which affects whether reports, packages, and download links remain available.

An audit log records security-relevant or administrative events, usually including an actor, action, resource, and timestamp. Retention, integrity protections, and available events depend on the system; a log is not automatically immutable.

Autoscaling adjusts the amount of computing capacity in response to demand or policy. In CI, a controller may add runners for queued jobs and remove idle capacity, balancing startup latency against infrastructure cost.

An autoscaling runner is a self-hosted GitHub Actions runner whose capacity is created in response to queued jobs and released again when demand falls, instead of staying registered around the clock.

An availability zone is a cloud-provider-defined location designed as a distinct failure domain within a region. Its relationship to subnets and individual resources varies by provider, and cross-zone traffic may incur charges.

AWS Graviton is a family of Arm-based processors designed by AWS for cloud instances. Native binaries and dependencies must be compatible with the ARM64 architecture and the operating system running on those instances.

Bare metal refers to a physical server allocated without a customer-facing virtual-machine layer. Workloads can use the host directly, although operating-system isolation, provisioning, and cleanup still require deliberate management.

A base image is the image named in a Dockerfile FROM instruction, and it supplies the filesystem and image configuration that the build starts from.

A billable minute is a unit charged under a provider's billing rules, which may include rounding, minimums, or specified lifecycle intervals. It can differ from the exact execution time shown in a job log.

A build context is the set of files available to a container-image build, supplied from a directory, repository, archive, or other supported source. Dockerfile COPY instructions can access files within the applicable context.

Build duration is the elapsed time taken by a defined build operation. A useful measurement states its boundaries, such as job start to completion, and separates execution time from queueing and unrelated workflow delays.

A build duration percentile is the duration below which a stated share of builds finish, written as p50, p95, or p99. A p95 build duration of twenty minutes means 95 percent of the runs in the window completed in twenty minutes or less and the remaining 5 percent took longer.

A build failure occurs when a required build operation does not complete successfully or fails its acceptance criteria. It can originate from source errors, dependencies, tests, configuration, or infrastructure, so the first actionable error matters.

A build matrix expands one job definition into multiple jobs, one per selected combination of variables such as operating system and language version. Each combination executes independently, with its own runner assignment and results.

A build secret is sensitive data made available temporarily to a build step through a dedicated secret mechanism. Unlike build arguments or copied files, properly used secret mounts avoid persisting the secret in image layers.

BuildKit is the Docker build engine that resolves a Dockerfile into a graph of build steps, runs independent steps concurrently, and manages the layer cache.

BYOC, or bring your own cloud, is a deployment model where a vendor's control plane operates resources that run inside the customer's own cloud account.

Cache eviction is the removal of entries from a cache store so the store stays under a size ceiling or an age limit, usually taking the least recently used entry first.

A cache hit occurs when a lookup finds stored data that satisfies the requested key and compatibility rules. Exact and partial matches may have different meanings, so a restored archive does not always indicate an exact hit.

Cache hit rate is the share of cache lookups that find a usable entry, counted over a window of runs and reported as a percentage.

Cache invalidation prevents stale cached data from being reused after relevant inputs change. Build systems can invalidate entries through content hashes, versioned keys, explicit deletion, or rules describing dependencies between inputs and outputs.

A cache key is the string that identifies one entry in a build cache, so a later job can ask for that exact entry by name.

A cache miss occurs when no usable entry is found for a lookup. Causes include changed inputs, scope restrictions, eviction, or a new cache store; a correct build should be able to recompute missing outputs.

Cache scope defines which workflows or identities may discover and restore a cache entry. GitHub Actions applies restrictions involving branches and cache versions, so matching a key alone does not guarantee access to the entry.

Cloud credentials are authentication material used to establish an identity with a cloud provider. They can include temporary tokens, access keys, or federated assertions; authorization policies separately determine what that identity can do.

A cloud region is a geographic area in which a provider offers infrastructure services. Region selection affects service availability, latency, data location, and pricing; individual regions usually contain multiple availability zones.

Code signing attaches a cryptographic signature to a binary so an operating system can check its origin and its integrity before it agrees to run it.

A cold start is the initialization required before a newly provisioned execution environment can perform useful work. For CI runners it can include allocation, image preparation, boot, and registration; queue wait should be measured separately.

A command-line interface lets users or scripts invoke software through textual commands and arguments. In CI, predictable exit codes, noninteractive authentication, and machine-readable output make a CLI suitable for repeatable automation.

A compiler cache is a store of compiler output from earlier builds, keyed by a hash of the compilation inputs, so a translation unit whose inputs have not changed is served from the store instead of being compiled again.

Compliance is adherence to applicable requirements, such as contracts, organizational policies, or regulatory obligations. Infrastructure features and audit reports can support compliance, but the customer's own configuration and operating processes remain part of the assessment.

A composite action is a reusable GitHub Actions action whose body is a list of workflow steps written directly in a single action.yml file, rather than JavaScript source or a container image.

A compute minute is a unit of elapsed resource usage measured over sixty seconds. The resource size and provider's metering rules determine its price; one minute on different runner types need not have the same cost.

Concurrency is the number of tasks that can be in progress during the same period. In CI it commonly means simultaneous jobs, while available processors and scheduling determine how much work actually executes in parallel.

A concurrency group is a named lane in GitHub Actions that runs one workflow run or job at a time, and can cancel the run already in progress.

A concurrency limit caps the number of tasks permitted to run at the same time. In CI it may arise from account quotas, runner capacity, or workflow settings such as a matrix's max-parallel value.

A container image is a packaged filesystem and configuration used to create containers. It identifies application dependencies and startup behavior, but relies on a compatible runtime and operating-system kernel to execute the workload.

A container registry is a service that stores and serves container images and their manifests over the registry API, an HTTP interface that clients such as docker, podman, crane, and containerd all speak.

A container runtime creates and manages isolated processes using container configuration and filesystem images. Low-level runtimes implement execution, while higher-level services can also handle image retrieval, networking, and container lifecycle management.

Continuous delivery keeps software in a releasable state through automated building, testing, and packaging. A production release may still require a deliberate approval, even when the technical deployment steps are automated.

Continuous deployment automatically releases each change that passes the required pipeline checks to production. It extends continuous delivery by removing the routine manual approval between a successful pipeline and a production release.

Continuous integration is the practice of frequently merging code changes into a shared repository and checking them with automated builds and tests. It helps teams detect integration problems while changes are still small.

A control plane is the component that decides what should exist and issues the instructions that create it, while the workload runs elsewhere on the data plane.

Cost per build divides relevant infrastructure and service spending by a defined number of builds. The calculation should state whether retries, failed jobs, storage, and data transfer are included to make comparisons meaningful.

CPU utilization measures how much processing capacity is busy during an interval. Interpretation depends on whether the metric is per core, per process, or normalized across all available processors; a single percentage can hide uneven usage.

The critical path is the longest chain of dependent tasks determining the minimum completion time of a build or workflow. Accelerating work outside that chain may improve resource use without reducing the total elapsed duration.

Cross-compilation builds code on one host environment for a different target environment. The difference can be architecture, operating system, or ABI, so the compiler and target libraries must match the intended destination.

A data plane is the set of components that carry the actual workload, while the control plane beside it decides what should exist and schedules work onto them.

Data residency is the requirement that a defined set of data is stored and processed inside a named geography, such as a country, an economic area, or a single cloud region.

A dependency cache stores downloaded packages or dependency-installation outputs for reuse across builds. Its correctness depends on compatibility with the current lockfile, operating system, architecture, and package manager rather than simply finding a matching directory.

A deployment places a version of an application or its configuration into a target environment. Building a package and deploying it are separate operations, and deployment does not necessarily expose it to all users immediately.

A deployment environment is a named deployment target in GitHub Actions that a job points at with the environment key, and that carries its own secrets, its own variables, and its own protection rules such as required reviewers.

Docker Bake is the Buildx command that reads build targets from an HCL, JSON, or Compose file, so several images build from one declarative definition.

Docker Buildx is the Docker CLI plugin that drives BuildKit: it selects the builder instance a build runs on and targets several platforms in one build.

A Docker layer cache is the store of previously built image layers that a build reuses when an instruction and the inputs it reads are unchanged.

A Dockerfile is a text specification of instructions used to build a container image. It defines base images, copied files, build commands, and runtime settings; instruction ordering influences cache reuse and the resulting image contents.

The Domain Name System maps domain names to records such as IP addresses and service information. CI jobs use DNS to locate repositories, package registries, and APIs; successful resolution alone does not guarantee network reachability.

Egress is traffic leaving a defined network, resource, or administrative boundary. The boundary matters: internet, cross-region, and cross-zone transfers may be treated differently by routing rules, security controls, and provider billing.

Egress costs are charges associated with data leaving a resource, network, or geographic boundary. Cloud pricing distinguishes internet, cross-region, and cross-zone transfers, and may add separate gateway processing charges along the route.

An ephemeral runner accepts one CI job before being deregistered. Secure implementations also dispose of or sanitize the execution environment afterward; GitHub's ephemeral registration flag alone does not delete the host or its disk.

Ephemeral storage holds data with a lifetime tied to its execution environment rather than an independent durable volume. Data can disappear during lifecycle events such as termination; exact stop and restart behavior depends on the implementation.

An exit code is a numeric result returned by a process to its caller. Zero conventionally indicates success, while nonzero meanings depend on the program and shell; workflow rules determine whether the result fails a step.

Fail-fast stops remaining work after a relevant failure. In a GitHub Actions matrix, enabled fail-fast cancels queued and running matrix jobs when a job without continue-on-error fails, reducing further work at the cost of diagnostic coverage.

A flaky test produces inconsistent pass and fail results without a relevant change to the code under test. Timing, shared state, randomness, and external services are common causes that make automated results less trustworthy.

A GitHub Actions runner is an execution environment running the agent that receives and executes workflow jobs. A job selects suitable runners through runs-on, while the runner executes its steps and reports results to GitHub.

A GitHub App is an installable integration with its own identity and its own scoped permissions, which acts on a repository without using a human account.

GITHUB_TOKEN is a GitHub App installation token made available to a workflow job. Its repository-scoped permissions are controlled by policy and workflow configuration, and its lifetime is limited to the job or a documented expiry limit.

A hermetic build controls its declared inputs and tools so execution does not depend on undeclared host state or external changes. Hermeticity improves cache correctness and reproducibility, although byte-identical output may require additional controls.

A hypervisor creates and manages virtual machines by mediating access to physical compute, memory, and devices. Its isolation and scheduling determine how guest operating systems share a host and use hardware capabilities.

An IAM instance profile is a container for one IAM role that an EC2 instance assumes, so code on the machine gets rotating AWS credentials with no stored keys.

Identity and access management controls which identities can access resources and which operations they may perform. Cloud IAM combines identities, roles, policies, and trust relationships to authorize both people and automated workloads.

Idle cost is spending on provisioned resources that are not doing useful work. In CI it commonly arises from warm runner capacity, reserved machines, or storage retained between jobs, even when no build is executing.

An image digest is a content-derived identifier for a container image manifest or image index. Unlike a mutable tag, it pins particular content, enabling a workflow to fetch or deploy the same referenced image consistently.

An image layer represents a filesystem change used to construct a container image. Layers can be shared between images and cached, while image configuration records additional metadata that is not itself a filesystem layer.

An incremental build is a build that reuses the outputs of the previous build and recompiles only the units whose inputs changed. It works by keeping a record of what produced each output, then comparing that record against the current sources so every unchanged unit can be skipped.

Incremental compilation recompiles only the source units affected by changes and reuses compatible previous outputs. It depends on accurate dependency tracking and compiler state, and is a narrower concept than incrementally rebuilding an entire application.

Inline cache is Docker build cache metadata embedded in the image you push, so pulling that image also supplies the cache hints for the next build.

The instance metadata service (IMDS) is a local HTTP endpoint that a cloud virtual machine queries to read facts about itself: its instance id, its instance type, the region and availability zone it runs in, its network addresses, and the temporary credentials of any identity role attached to it.

An instance type is a provider-defined machine configuration describing compute, memory, and other capabilities. Storage and network options vary by family and platform, so the name alone does not establish workload performance.

A job is a unit of work scheduled onto a runner within a workflow. In GitHub Actions, its steps normally run sequentially on the same runner, while separate jobs can run concurrently.

A job summary is formatted information displayed on a GitHub Actions workflow run page. Steps write Markdown to GITHUB_STEP_SUMMARY so test results, artifact links, and other useful outcomes can be read without searching raw logs.

A job timeout limits how long a workflow job may execute before cancellation. GitHub Actions supports timeout-minutes at job and step levels; a step-level timeout applies to that step rather than redefining the whole job's limit.

KVM is the Linux kernel virtualization interface, exposed as the device /dev/kvm, that lets a process run a guest with hardware acceleration on the host CPU.

Least privilege grants an identity only the access required for its task and only for the necessary duration. Applying it to CI limits what compromised scripts, dependencies, or actions can do with available credentials.

The Linux kernel manages processes, memory, devices, filesystems, and networking for a Linux system. Containers typically share their host's kernel, while virtual machines run a separate guest kernel behind a virtualization boundary.

A local SSD is solid-state storage physically attached to the host serving a workload. It can provide high-throughput temporary storage, but durability and behavior during stop, migration, or termination depend on the provider.

Logs are timestamped records of events emitted by software or infrastructure. CI logs often contain commands, output, and errors, but effective diagnosis also requires enough context to associate each record with its job and step.

A macOS runner is a CI execution environment running Apple's macOS operating system. It provides access to Apple development tools such as Xcode, making it suitable for workflows that build or test Apple-platform software.

An MCP server implements the Model Context Protocol and exposes a typed set of tools and data sources that an AI assistant can call over JSON-RPC 2.0.

Metrics are numerical measurements aggregated over time or dimensions, such as CPU usage, memory consumption, or job duration. They reveal trends and anomalies but usually require logs or traces to explain individual events.

A monorepo stores multiple projects in one version-control repository. Projects can share tooling and change history while retaining distinct build targets, making dependency-aware task selection useful for avoiding unnecessary CI work.

MSBuild is Microsoft's build engine for projects described with XML properties, items, targets, and tasks. It evaluates dependencies and invokes compilers or other tools to produce application outputs, often through Visual Studio or dotnet commands.

A multi arch image is one image reference that resolves through a manifest list to a per architecture image, so a single tag serves x64 and ARM64 clients.

A multi stage Docker build is a Dockerfile with several FROM stages, where a later stage copies only the artifacts it needs out of an earlier one.

A NAT gateway translates addresses for traffic crossing network boundaries, commonly allowing private instances to initiate outbound connections. Public internet access also requires appropriate routes and gateway configuration; NAT does not replace firewall or identity controls.

Nested virtualization is running a virtual machine inside a machine that is already virtualized. It works only when the host exposes the CPU's hardware virtualization extensions to its guest, because the guest kernel needs those extensions to act as a hypervisor for a second layer of virtual machines.

The .NET SDK supplies command-line tools, compilers, and libraries for developing .NET applications. Its version influences restore, build, test, and publish behavior and is distinct from the runtime needed to execute an application.

Network address translation rewrites packet addresses as traffic crosses a network boundary. Outbound NAT lets multiple private hosts use a shared public address, while connection tracking directs response traffic back to the originating host.

Object storage keeps data as named objects in buckets or containers, accessed through service APIs. Unlike a local filesystem, it does not generally provide the same file-locking or in-place modification semantics.

OIDC token exchange is the pattern where a workload presents a short lived identity token, signed by an identity provider the other side already trusts, and receives temporary credentials scoped to what that identity is allowed to do.

OpenID Connect is an identity protocol built on OAuth 2.0 that provides signed claims about an authenticated subject. CI systems can issue identity tokens whose claims a cloud provider validates before granting temporary access.

OpenTelemetry is a collection of specifications, APIs, SDKs, and tools for generating, collecting, and exporting telemetry such as traces, metrics, and logs. It provides vendor-neutral instrumentation rather than a telemetry storage or visualization backend.

An out-of-memory condition occurs when a workload cannot obtain required memory within its system or resource limit. The operating system, container runtime, or application may terminate work; an exit code alone is not conclusive evidence.

Parallelism is the simultaneous execution of multiple units of work on available processing resources. Build systems may parallelize independent tasks, but dependencies, memory requirements, and synchronization can limit the benefit of adding workers.

Persistent state is data retained beyond the lifetime of the process, job, or machine that created it. In CI, retention must be implemented explicitly through storage, caches, artifacts, or snapshots and paired with appropriate access controls.

A personal access token is a credential tied to one user account that authenticates API and Git requests as that person, under that person's permissions.

A pipeline is an ordered or dependency-driven collection of automated tasks that moves a code change through building, testing, packaging, and potentially deployment. Tasks may execute sequentially or concurrently when their dependencies permit.

PowerShell is a shell and scripting language that passes structured objects between commands. PowerShell and Windows PowerShell have different versions and compatibility characteristics, so a workflow should select the shell its scripts expect.

A private network restricts direct public access to resources using private addressing, routing, and access controls. Private connectivity does not by itself establish application identity or eliminate the need for authentication and authorization.

A provenance attestation is a statement about how a software artifact was produced, including its source, builder, and inputs. A verifiable signature can bind that statement to an identity but does not independently prove the build was safe.

A provisioning profile is an Apple signed file that binds an app identifier, the certificates allowed to sign it, and a device list or a distribution method.

QEMU emulation executes software for a target machine or instruction set by emulating its behavior. It enables some cross-architecture builds and tests, though native execution and cross-compilation are alternative approaches with different performance characteristics.

Queue time is the wait between a GitHub Actions job entering the queue and a runner starting it, measured apart from how long the job then takes to run.

A registry cache stores Docker build layers as a separate image in a container registry, so any builder able to pull from that registry reuses them.

A remote build cache stores build outputs on a shared store, keyed by the inputs that produced them, so a target built on one machine is reused elsewhere.

A remote Docker builder executes image builds on infrastructure separate from the machine invoking the build. The client supplies build inputs and credentials as needed, while compute capacity and caches live with the builder.

Remote execution is a build mode where the build tool dispatches each action to a pool of worker machines instead of running it on the local machine.

A reproducible build produces identical specified outputs when repeated with the same declared source, instructions, and environment. Timestamps, filesystem ordering, and nondeterministic tools can prevent reproducibility even when the code has not changed.

A reusable workflow is a GitHub Actions workflow that declares on: workflow_call, so other workflows call it as a job and share one pipeline definition.

Role-based access control grants permissions through roles assigned to users or service identities. It separates the definition of allowed actions from the identities receiving them, making access easier to manage and review at scale.

A runner group is a GitHub-side container around a set of runners that controls which repositories and which workflows are allowed to run jobs on them.

A runner image is the prepared disk image a CI runner boots from, carrying the operating system and the preinstalled toolchains a job expects to find.

Runner isolation separates one CI workload from other workloads and host resources. Its strength depends on boundaries such as virtual machines, containers, identities, storage, and network policy rather than the runner label alone.

A runner label is the string in a GitHub Actions runs-on key that GitHub matches against registered runners to decide which machine picks up the job.

A runner pool is the set of machines that accept GitHub Actions jobs for a given label, plus the rules that create and retire them.

A runner registration token is a short lived credential that a self-hosted runner presents to GitHub so that it can join a repository, organization, or enterprise runner pool.

Runner utilization describes how much of an allocated runner's resources a workload uses, or how much time a fleet spends busy. State the denominator explicitly: CPU usage, memory occupancy, and busy-time ratios measure different things.

runs-on is the GitHub Actions job key that selects which runner picks the job up, by a single label, a list of labels, or a runner group object.

A sandbox is a restricted execution environment designed to limit what code can access or change. Its boundary may use processes, containers, virtual machines, and policies; the word alone does not specify a particular security guarantee.

A software bill of materials, usually written SBOM, is a machine-readable inventory of the components and versions that went into a build output, together with the dependency relationships between them.

A secret is sensitive information such as a password, token, or private key that must be restricted to authorized users and workloads. CI secret handling includes storage, scoped injection, logging controls, and eventual rotation.

In AWS, a security group is a stateful set of allow rules controlling inbound and outbound traffic for associated network interfaces. Similarly named cloud features can have different rule and association semantics across providers.

A self-hosted runner is an execution environment supplied and managed outside GitHub's hosted runner service. Its operator controls hardware, operating system, and tools, and is responsible for maintenance, access, and job isolation.

A service account is an identity intended for software or automated workloads rather than a human user. Its permissions and credential mechanisms depend on the platform and should match the tasks the workload performs.

Simulator is Apple's tool for running and testing applications in simulated Apple-device environments on a Mac. It uses platform runtimes and does not reproduce every hardware behavior or performance characteristic of a physical device.

A simulator runtime supplies the platform-specific system components that Apple's Simulator uses to run applications for a particular OS version. It is installed and selected alongside compatible Xcode tooling and simulated device configurations.

Single sign-on (SSO) is an arrangement where one identity provider authenticates a user once and asserts that identity to the other applications that user opens, so each application trusts a signed statement about the person instead of holding a password for them.

A snapshot lifecycle covers creation, naming, use, refresh, retention, and deletion of captured machine state. Managing this lifecycle prevents stale dependencies, uncontrolled storage growth, and unintended retention of credentials or source data.

Snapshot restore recreates disk or machine state from a previously captured snapshot. Disk-only restoration boots a new operating system session, so running processes and in-memory data are not restored with filesystem contents.

A snapshot runner starts a CI job using disk state captured from an earlier runner. Reusing installed dependencies or build data can reduce setup work, while the new job still requires its own execution environment.

SOC 2 Type 2 is an independent attestation report evaluating the design and operating effectiveness of a service organization's controls over a specified period against applicable Trust Services Criteria.

A software development kit packages tools, libraries, and interfaces for building against a platform or service. It can include compilers, API clients, headers, and examples; SDK versions may affect both build compatibility and runtime behavior.

Software supply-chain security protects the sources, dependencies, build systems, and distribution paths used to produce software. It combines controls such as dependency review, isolated builds, artifact verification, and provenance to reduce tampering risks.

A spot instance is spare cloud capacity sold at a discount to on-demand rates, on the condition that the provider can reclaim the machine on short notice.

SSH debugging uses an authenticated remote shell to inspect an execution environment while diagnosing a problem. Access lifetime, authorization, and the point at which the session opens determine what job state remains available.

In WarpBuild, a standby disk is a preinitialized runner VM kept shut down until needed. Its prepared disk and configuration reduce repeated initialization, while storage remains allocated and the VM is started to serve a job.

A static IP address is an address intended to remain stable rather than changing with each resource allocation. In CI, a stable outbound address often comes from shared network infrastructure instead of the individual runner.

A step is an individual task within a workflow job, such as a shell command or reusable action. Steps share the job's workspace, but shell processes and ordinary exported variables do not automatically persist between steps.

A subnet is a subdivision of an IP network defined by an address range. Cloud subnets place resources within a virtual network, but their zone scope, routing, and firewall behavior differ between providers.

A task graph is the directed acyclic graph a build tool computes over the tasks it has been asked to run, with one node per task and one edge per dependency between tasks.

Test sharding splits a test suite into disjoint slices that run on separate machines at the same time, then merges the shard results into one verdict.

A token is a value used to represent an identity, authorization grant, or other security claim. Tokens may be opaque or structured, and their scope, audience, expiry, and validation rules determine their permitted use.

Total cost of ownership combines direct service charges with the cost of operating and maintaining a system over time. For CI, it can include infrastructure, storage, networking, engineering effort, and the impact of delays.

Tracing records the progress of an operation through a sequence of timed spans, potentially across multiple services. Parent-child relationships and shared trace identifiers help explain where time was spent and which dependency introduced a delay.

Ubuntu is a Linux distribution that packages a kernel, system utilities, and a software repository into a versioned operating system. CI runner images add development tools on top of a particular Ubuntu release.

A vCPU (virtual CPU) is one virtual processor that a cloud instance exposes to its guest operating system, appearing as a single entry in the processor list the guest can schedule threads onto.

A virtual machine is a software-defined computer with virtual processors, memory, storage, and devices. It runs a guest operating system on a host through a hypervisor, providing an execution boundary separate from other guests.

A virtual private network creates an authenticated, encrypted connection over another network. It can give CI runners access to private services, but routes, DNS configuration, and access policies still determine reachable destinations.

A VM snapshot captures disk state and, in some implementations, memory and device state at a point in time. Restoring it can recreate a previous environment, but persistence and consistency depend on what was captured.

A VPC (virtual private cloud) is an isolated virtual network inside a cloud account, with its own private IP address range, subnets that divide that range, and routing rules that decide which traffic stays inside and which leaves.

A warm cache is a cache that already holds the entries a run needs, so the run restores them and skips the work of building them again.

A warm pool is a set of machines kept booted and ready ahead of demand, so a queued GitHub Actions job attaches to one and skips the cold boot.

A WarpBuild Stack groups the cloud infrastructure used to run BYOC workflows in a selected cloud account and region. Its resources include networking and object storage, with configuration and import options varying by provider.

Windows containers package applications with Windows user-space dependencies and run using a compatible Windows host. Process isolation shares the host kernel; Hyper-V isolation provides a separate optimized virtual machine boundary for the container.

A Windows runner is a CI environment running a Windows operating system and compatible build tools. It supports workloads that depend on Windows APIs, desktop testing, or toolchains unavailable on Linux and macOS.

A workflow is a configurable automation defined in a repository that runs when an event occurs. In GitHub Actions, YAML files under .github/workflows specify triggers, jobs, permissions, and their dependencies.

workflow_dispatch is the GitHub Actions trigger that starts a workflow run on demand from the Actions tab, the GitHub CLI, or the REST API, with typed inputs.

A workflow event is the repository activity that starts a GitHub Actions workflow run, such as a push, activity on a pull_request, a schedule tick, or a manual workflow_dispatch.

Workflow permissions are the per scope grants on the token a GitHub Actions run uses, declared with a permissions key at workflow level or job level.

x86-64 is the 64-bit extension of the x86 instruction set used by many Intel and AMD processors. Operating systems and compiled dependencies must target a compatible architecture to execute natively on these machines.

Xcode is Apple's development environment for building, testing, signing, and distributing applications for Apple platforms. It bundles compilers, platform SDKs, debugging tools, and simulator support whose versions can affect CI results.

xcodebuild is the command-line tool for building, testing, analyzing, and archiving Xcode projects and workspaces. It selects targets through schemes and destinations, making Apple-platform build steps repeatable in shell-based CI workflows.

XCTest is Apple's testing framework for writing and running unit, performance, and UI tests for supported Apple platforms. Tests execute through Xcode tooling against a suitable application, device, simulator, or host environment.