Beginner · Builds

Turn a repository into an artifact you could still rebuild next year

A service is deployed by pulling the main branch onto each server and running the start script. You are asked to produce a proper build artifact instead. The build currently takes two minutes and "works fine".

The fix that looks right

Trap

Declaring the build reproducible because the lockfile is committed and CI is green. The lockfile pins the language dependencies and nothing else — FROM node:20 still moves, apt-get install curl still resolves to whatever the mirror has today, and the runner image gets updated by the CI provider on their schedule. The first sign is an image that grew 60 MB from an unchanged commit, and by then the difference between what was tested and what shipped has been invisible for weeks.