Build verifiable artifacts
Build from clean inputs
Create releases in an isolated environment from reviewed source, locked dependencies, declared tools, and no hidden workstation state.
8 minute lesson
A release should come from source and declared inputs, not from whatever happened to exist on one laptop.
Use an ephemeral builder, deterministic dependency installation, fixed tool versions, and a clean workspace. Keep release credentials out of normal test steps. Record the source revision and build identity with the artifact.
A release built on a laptop quietly includes an untracked generated file and a globally installed compiler. Nobody reviewing the repository can reproduce those inputs.
Two clean builds can still differ because of timestamps, file order, or tool behavior. Reproducibility is evidence to investigate, not a promise produced by an ephemeral runner.
Build the same revision twice in separate clean environments and save both artifact digests plus the declared tool versions. If the digests differ, compare the artifacts and explain the first meaningful difference. Add an undeclared local file and prove the clean build ignores it or fails explicitly.
Lesson completed