Glossary / Build caching
Build caching
Build caching reuses outputs from previous build steps when their inputs are unchanged, reducing repeated compilation, bundling, linting, or test work. Correct caching depends on a complete and stable cache key: if relevant inputs are omitted, stale output can be reused and make builds incorrect; if irrelevant inputs are included, cache hits are lost.
Cache keys and artifacts
A build task's cache key may include source files, dependency lockfiles, compiler and plugin versions, configuration, environment variables, platform, and upstream task outputs. The cache stores artifacts and sometimes logs/metadata. Local incremental caches and remote shared caches have different trust, eviction, and concurrency properties. A remote cache can be poisoned if untrusted contributors can publish artifacts accepted by protected builds.
Caches should be treated as an optimization, not the source of truth. A clean uncached build should remain possible. Verify restored artifacts match current inputs and avoid embedding secrets or machine-specific absolute paths. Toolchains may need cache version salts when output semantics change.
Engineering guidance
Define inputs explicitly, include every behavior-changing environment value, and scope remote cache writes by trust level. Monitor hit rate and time saved, not only cache size. Provide cache bypass and clean commands for diagnosis. Periodically compare cached and uncached outputs; protect signing and release steps from untrusted cache artifacts.
Interview questions
- What makes a cache incorrect? An incomplete key that omits an input affecting output.
- Should caches be required for builds? No; they should accelerate a reproducible uncached build.
- What is cache poisoning? A malicious or incorrect artifact is stored and later trusted for a matching key.
- What belongs in a build key? All source, dependency, config, toolchain, environment, and upstream-output inputs that affect results.
- How diagnose stale output? Bypass/clear cache and compare with a clean build, then audit the key.