CI Glossary
Definitions for GitHub Actions and CI infrastructure vocabulary, each with a concrete example.
- Actions Runner ControllerActions Runner Controller is the Kubernetes controller that registers self-hosted GitHub Actions runners as pods and scales the fleet with the job queue.
- Artifact CacheAn artifact cache stores dependencies or build outputs under a key so a later run restores them instead of rebuilding. How keys, hits and eviction work.
- Artifact RetentionArtifact retention is how long a platform keeps an uploaded build artifact before deleting it. How GitHub Actions sets the window and what expiry breaks.
- Audit LogAn audit log is an append only record of who changed what and when. What an entry carries, how a GitHub Actions team queries one, and how to export it.
- Autoscaling RunnerAn autoscaling runner is a self-hosted GitHub Actions runner created in response to queued jobs and released when demand falls. How the pattern works.
- Base ImageA base image is the image a Dockerfile FROM instruction names, supplying the filesystem a build starts from. How the reference resolves and invalidates cache.
- Build Duration PercentileA build duration percentile is the time below which a stated share of builds finish, such as p50 or p95. Why averages hide the slow tail developers feel.
- Build MatrixA build matrix expands one job definition into many jobs, one per combination of the values you list. How matrix keys, include, exclude and fail-fast behave.
- BuildKitBuildKit is the Docker build engine that resolves a Dockerfile into a graph of build steps, runs independent steps concurrently, and manages the layer cache.
- Docker BuildxDocker Buildx is the Docker CLI plugin that drives BuildKit: it selects the builder instance a build runs on and targets several platforms in one build.
- BYOC (Bring Your Own Cloud)BYOC, or bring your own cloud, is a deployment model where a vendor's control plane operates resources that run inside the customer's own cloud account.
- Cache EvictionCache eviction is the removal of cache entries to hold a store under a size ceiling or an age limit. How least recently used order plays out in GitHub Actions.
- Cache Hit RateCache hit rate is the share of cache lookups that return a usable entry. How to pick the numerator and the denominator, and how to count it in GitHub Actions.
- Cache KeyA cache key is the string that names one cache entry. How GitHub Actions builds a key from the runner platform and a lockfile hash, and how a restore matches.
- Cache ScopeCache scope is the boundary that decides which GitHub Actions runs may read a cache entry: the branch that wrote it, plus the default branch.
- Code SigningCode signing attaches a cryptographic signature to a binary so an operating system can check its origin and its integrity before it agrees to run it.
- Cold StartA cold start is the time between a GitHub Actions job being queued and its first useful step, spent on runner allocation, image boot, and setup.
- Compiler CacheA compiler cache stores object files from earlier compilations, keyed by source content and compiler flags, and returns them when the same inputs recur.
- Composite ActionA composite action bundles several GitHub Actions workflow steps into one reusable action defined by a single action.yml file. Syntax, limits, example.
- Concurrency GroupA concurrency group is a named lane in GitHub Actions that runs one workflow run or job at a time, and can cancel the run already in progress.
- Concurrency LimitA concurrency limit is a ceiling on how many GitHub Actions jobs run at the same time, set by a workflow concurrency key, the account plan, or runner capacity.
- Container RegistryA container registry stores and serves container images and their manifests over the registry API, addressing every layer and config blob by its digest.
- Control PlaneA control plane is the component that decides what should exist and issues the instructions that create it, while the workload runs elsewhere on the data plane.
- Cross CompilationCross compilation is compiling on one architecture to produce a binary that runs on another. Target triples, sysroots, and a GitHub Actions example.
- Data PlaneA data plane is the set of components that carry the actual workload, while the control plane beside it decides what should exist and schedules work onto them.
- Data ResidencyData residency is the requirement that data is stored and processed inside a defined geography. What it means for a GitHub Actions build, and how to prove it.
- Deployment EnvironmentA deployment environment is a named target in GitHub Actions that carries its own secrets, variables, and protection rules such as required reviewers.
- Docker BakeDocker Bake is the Buildx command that reads build targets from an HCL, JSON, or Compose file, so several images build from one declarative definition.
- Docker Layer CacheA Docker layer cache is the store of previously built image layers that a build reuses when an instruction and the inputs it reads are unchanged.
- Egress CostsEgress costs are the per-gigabyte charges a cloud provider applies to data leaving its network or crossing its zones and regions. Where they come from.
- Ephemeral RunnerAn ephemeral runner is a GitHub Actions runner that takes exactly one job and is destroyed afterwards, so no state from that job reaches the next job.
- Ephemeral StorageEphemeral storage is disk tied to the lifetime of one instance, container, or pod, erased when that instance goes away. What it means for a GitHub Actions job.
- Fail FastFail-fast is the matrix strategy setting that cancels the remaining matrix jobs when one leg fails. What it defaults to, and when to switch it off.
- Flaky TestA flaky test passes and fails on the same commit. The mechanisms behind flakiness, how to measure a flake rate, and how to confirm one in GitHub Actions.
- GitHub Actions RunnerA GitHub Actions runner is the machine that executes one workflow job, picked by the labels in runs-on. How runners register, match jobs, and bill.
- GitHub AppA GitHub App is an installable integration with its own identity and scoped permissions that acts on a repository without using a human account.
- GITHUB_TOKENGITHUB_TOKEN is the GitHub App installation token created at the start of every workflow job, scoped to one repository and expiring when the job ends.
- AWS GravitonAWS Graviton is the ARM64 processor family AWS designs for its own instances, so anything a service ships to a Graviton instance has to be built for arm64.
- IAM Instance ProfileAn IAM instance profile is a container for one IAM role that an EC2 instance assumes, so code on the machine gets rotating AWS credentials with no stored keys.
- Image DigestAn image digest is the SHA-256 hash of an image manifest, so it names one exact image. How a digest differs from a tag, and how to pin one in a workflow.
- Incremental BuildAn incremental build reuses outputs from the previous build and recompiles only what changed. How the record works, and why a clean job rebuilds everything.
- Inline CacheInline cache is Docker build cache metadata embedded in the image you push, so pulling that image also supplies the cache hints for the next build.
- Instance Metadata ServiceThe instance metadata service is the link-local endpoint a cloud instance queries for its own metadata and role credentials. How IMDSv1 and IMDSv2 differ.
- Instance TypeAn instance type is a named cloud machine shape that fixes vCPU count, memory, storage, and network capability. How the name encodes each of them.
- Job SummaryA GitHub Actions job summary is a markdown panel a job writes to its own run page by appending to the GITHUB_STEP_SUMMARY file. Rules, limits, and an example.
- Job TimeoutA job timeout is the maximum number of minutes a GitHub Actions job may run before the platform cancels it, set with timeout-minutes on a job or a step.
- KVMKVM is the Linux kernel virtualization interface, exposed as the device /dev/kvm, that lets a process run a guest with hardware acceleration on the host CPU.
- Local SSDA local SSD is storage physically attached to the host running an instance. Why it beats network attached volumes for build scratch space, and why it is wiped.
- MCP ServerAn MCP server implements the Model Context Protocol and exposes a typed set of tools and data sources that an AI assistant can call over JSON-RPC 2.0.
- MonorepoA monorepo is one version control repository holding several projects that share tooling and one change history, and what that shape means for GitHub Actions.
- Multi Arch ImageA multi arch image is one image reference that resolves through a manifest list to a per architecture image, so a single tag serves x64 and ARM64 clients.
- Multi Stage BuildA multi stage Docker build is a Dockerfile with several FROM stages, where a later stage copies only the artifacts it needs out of an earlier one.
- NAT GatewayA NAT gateway is a managed device that lets instances in a private subnet start outbound connections to the internet while accepting none from it.
- Nested VirtualizationNested virtualization runs a virtual machine inside a machine that is already virtualized. It needs the host to expose hardware virtualization to the guest.
- OIDC Token ExchangeOIDC token exchange is the pattern where a workflow presents a short lived identity token to a cloud provider and receives temporary credentials back.
- OpenTelemetryOpenTelemetry is an open standard and a set of libraries for emitting traces, metrics, and logs in one vendor-neutral format. Signals, OTLP, and an example.
- Personal Access TokenA personal access token is a credential tied to one user account that authenticates API and Git requests as that person, under that person's permissions.
- Provenance AttestationA build provenance attestation is a signed statement describing how an artifact was built: the source commit, the builder, and the build parameters.
- Provisioning ProfileA provisioning profile is an Apple signed file that binds an app identifier, the certificates allowed to sign it, and a device list or a distribution method.
- QEMU EmulationQEMU emulation runs binaries built for another processor architecture by translating their instructions, which is how an x64 machine builds an ARM64 image.
- Queue TimeQueue time is the wait between a GitHub Actions job entering the queue and a runner starting it, measured apart from how long the job then takes to run.
- Registry CacheA registry cache stores Docker build layers as a separate image in a container registry, so any builder able to pull from that registry reuses them.
- Remote Build CacheA remote build cache stores build outputs on a shared store, keyed by the inputs that produced them, so a target built on one machine is reused elsewhere.
- Remote ExecutionRemote execution is a build mode where the build tool dispatches each action to a pool of worker machines instead of running it on the local machine.
- Reusable WorkflowA reusable workflow is a GitHub Actions workflow that declares on: workflow_call, so other workflows call it as a job and share one pipeline definition.
- Runner GroupA runner group is a GitHub-side container around a set of runners that controls which repositories and which workflows are allowed to run jobs on them.
- Runner ImageA runner image is the prepared disk image a CI runner boots from, carrying the operating system and the preinstalled toolchains a job expects to find.
- Runner LabelA runner label is the string in a GitHub Actions runs-on key that GitHub matches against registered runners to decide which machine picks up the job.
- Runner PoolA runner pool is the set of machines that accept GitHub Actions jobs for a given label, plus the rules that create and retire them. How depth sets queue time.
- Runner Registration TokenA runner registration token is the short lived credential a self-hosted runner presents to GitHub to join a repository, organization, or enterprise pool.
- Runner UtilizationRunner utilization is the share of a runner's CPU, memory, disk, and network that a job actually uses while it holds the machine, and how to measure it.
- runs-onruns-on is the GitHub Actions job key that selects which runner picks the job up, by a single label, a list of labels, or a runner group object.
- SBOM (Software Bill of Materials)An SBOM is a machine-readable inventory of the components and versions inside a build output. What the formats record, and how a workflow generates one.
- Security GroupA security group is a stateful firewall attached to a cloud instance, holding allow rules for inbound and outbound traffic. How runner rules are written.
- Self-Hosted RunnerA self-hosted runner is a machine you operate that registers with GitHub and runs workflow jobs. How registration, labels, and the ownership split work.
- Simulator RuntimeA simulator runtime is the downloadable platform image a simulator boots, versioned apart from the tools that drive it. How to pin one in a test job.
- Single Sign OnSingle sign-on is an arrangement where one identity provider authenticates a user once and asserts that identity to the other applications the user opens.
- SOC 2 Type 2SOC 2 Type 2 is an independent audit report on whether a service organization's controls operated effectively across a period, and how a reviewer reads one.
- Spot InstanceA spot instance is spare cloud capacity sold at a discount to on-demand rates, on the condition that the provider can reclaim the machine on short notice.
- Standby DiskA standby disk is a storage volume prepared ahead of demand so a new machine can attach it and start work without downloading a machine image first.
- SubnetA subnet is a range of IP addresses inside a cloud network, bound to one zone and to a route table that decides whether machines in it reach the internet.
- Task GraphA task graph is the dependency graph a build tool computes over its tasks. How the graph fixes execution order, what runs in parallel, and what is skipped.
- Test ShardingTest sharding splits a test suite into disjoint slices that run on separate machines at the same time, then merges the shard results into one verdict.
- vCPUA vCPU is the virtual processor a cloud instance exposes to its guest operating system, usually one hardware thread of a core. Why build tools count them.
- VM SnapshotA VM snapshot is a saved copy of a virtual machine's disk at a point in time. What it captures, what it drops at boot, and how a job boots from one.
- VPC (Virtual Private Cloud)A VPC is an isolated virtual network inside a cloud account, with its own address range, subnets, and routing rules. What it holds and why builds run in one.
- Warm CacheA warm cache is a cache that already holds the entries a run needs, so the run restores them and skips rebuilding them. What keeps a cache warm.
- Warm PoolA warm pool is a set of machines kept booted and ready ahead of demand, so a queued GitHub Actions job attaches to one and skips the cold boot.
- Workflow Dispatchworkflow_dispatch is the GitHub Actions trigger that starts a workflow run on demand from the Actions tab, the GitHub CLI, or the REST API, with typed inputs.
- Workflow EventA workflow event is the repository activity that starts a GitHub Actions run: push, pull_request, schedule, or workflow_dispatch. How each one is declared.
- Workflow PermissionsWorkflow permissions are the per scope grants on the token a GitHub Actions run uses, declared with a permissions key at workflow level or job level.
Start with $10 in free credits
Change the runner label in your workflow and keep the rest of your GitHub Actions setup. Runner time is billed per minute.