runnerhut
Glossary
Plain definitions for the CI and GitHub Actions vocabulary.
A5
Actions Runner ControllerActions Runner Controller (ARC) is an open-source Kubernetes operator that provisions and autoscales self-hosted GitHub Actions runners as pods in your own cluster.Artifact cacheAn artifact cache stores build outputs between CI runs so that unchanged work does not have to be recomputed.Artifact retentionArtifact retention is the period GitHub keeps workflow artifacts before deleting them, defaulting to 90 days and configurable per repository or per upload.Audit logAn audit log is an append-only record of configuration and access changes, capturing who did what, when, and from where.Autoscaling runnerAn autoscaling runner is a self-hosted runner whose instance count grows and shrinks automatically in response to queued jobs.
B6
Base imageA base image is the image named in a Dockerfile's FROM instruction, providing the filesystem and tooling every subsequent layer builds on.Build duration percentileA build duration percentile expresses how long builds take at a given point in the distribution, such as p95 meaning 95% of builds finish faster.Build matrixA build matrix is a GitHub Actions feature that expands one job definition into many parallel jobs across combinations of variables such as OS and language version.BuildKitBuildKit is Docker's build engine, providing parallel layer execution, better caching and support for build secrets and multi-platform output.BuildxBuildx is the Docker CLI plugin that exposes BuildKit features, including multi-platform builds, remote builders and advanced cache backends.BYOCBYOC (bring your own cloud) is a deployment model where a vendor's control plane manages compute that runs inside your own cloud account.
C15
Cache evictionCache eviction is the removal of cache entries to stay within a size limit, usually by discarding the least recently used entries first.Cache hit rateCache hit rate is the proportion of cache lookups that find a usable entry, expressed as a percentage.Cache keyA cache key is the string that identifies a cache entry, typically built from a hash of the lockfiles that determine the cached content.Cache mountA cache mount is a BuildKit feature that persists a directory across builds without including it in the resulting image layer.Cache scopeCache scope defines which workflows, branches and repositories may read a given cache entry.Code signingCode signing is the process of cryptographically signing a binary so the operating system can verify its origin and integrity before running it.Cold startA cold start is the delay between a job being queued and the runner being ready to execute its first step.Compiler cacheA compiler cache such as ccache or sccache stores compiled object files keyed on preprocessed source, so identical compilations are served from cache rather than re-run.Composite actionA composite action bundles several workflow steps into a single reusable action defined in YAML, without needing JavaScript or a container.Concurrency groupA concurrency group is a named lock that limits how many workflow runs matching that name can be in progress at once.Concurrency limitA concurrency limit is the maximum number of jobs that can run simultaneously for an account, plan or runner group.Container jobA container job runs all of a job's steps inside a specified container image rather than directly on the runner.Container registryA container registry is a service that stores and distributes container images, such as GitHub Container Registry, Docker Hub or Amazon ECR.Control planeThe control plane is the part of a system that makes scheduling and configuration decisions, as distinct from the data plane that executes the work.Cross-compilationCross-compilation is building a binary on one architecture that is intended to run on a different one.
D5
Data planeThe data plane is the part of a system that executes the actual workload — in CI, the runners that check out code and run your steps.Data residencyData residency is the requirement that data be stored and processed within a defined geographic boundary.Deployment environmentA deployment environment is a named GitHub Actions target that can carry its own secrets, protection rules and required reviewers.Docker BakeDocker Bake is a buildx feature that builds multiple images from a declarative HCL or JSON file in one invocation.Docker layer cacheA Docker layer cache stores the filesystem layers produced by each Dockerfile instruction so unchanged instructions can be reused instead of re-executed.
E3
Egress costsEgress costs are the charges cloud providers levy on data transferred out of their network.Ephemeral runnerAn ephemeral runner executes exactly one job and is then destroyed, guaranteeing no state carries into the next job.Ephemeral storageEphemeral storage is disk attached to a runner for the duration of a job and wiped when the job ends.
F2
G4
GitHub Actions runnerA GitHub Actions runner is the agent process that polls GitHub for queued jobs, executes their steps and streams logs back.GitHub AppA GitHub App is an integration that authenticates as itself with scoped, short-lived installation tokens rather than as a user.GITHUB_TOKENGITHUB_TOKEN is the automatically generated, short-lived token available to every workflow run for authenticating to the GitHub API.GravitonGraviton is AWS's family of arm64 server processors, offering better price-performance than comparable x86 instances for many workloads.
I6
IAM instance profileAn IAM instance profile attaches an AWS role to an EC2 instance so software on it can obtain temporary credentials without stored keys.Image digestAn image digest is the content-addressed SHA-256 hash that uniquely identifies an exact container image.Incremental buildAn incremental build recompiles only the parts of a project affected by a change, reusing previously built outputs for everything else.Inline cacheInline cache embeds layer cache metadata inside the pushed image so a later build can reuse layers by pulling that image.Instance metadata serviceThe instance metadata service is a link-local HTTP endpoint that gives a cloud VM information about itself, including temporary IAM credentials.Instance typeAn instance type is a cloud provider's named combination of vCPU, memory, storage and network capacity.
J2
M5
Matrix explosionMatrix explosion is the combinatorial growth in job count that occurs when several matrix dimensions multiply together.MCP serverAn MCP server exposes tools and data to AI agents over the Model Context Protocol.MonorepoA monorepo is a single repository containing multiple projects or packages that are versioned and built together.Multi-arch imageA multi-arch image is a manifest list pointing at several per-architecture images, so a single tag works on both amd64 and arm64.Multi-stage buildA multi-stage build uses several FROM instructions so build-time tooling stays out of the final image.
N2
O2
P4
Path filterA path filter restricts a workflow trigger to runs where files matching given patterns changed.Personal access tokenA personal access token is a long-lived credential tied to an individual user account.Provenance attestationA provenance attestation is a signed statement describing how an artefact was built, including source, builder and inputs.Provisioning profileA provisioning profile is an Apple-signed file linking an app ID, certificates and devices, required to install a build on hardware.
Q2
R11
Registry cacheA registry cache stores Docker build layers as a separate image in a container registry so later builds can import them.Remote build cacheA remote build cache is a shared store of build outputs that every developer machine and CI job can read from and write to.Remote executionRemote execution distributes individual build actions across a fleet of workers rather than running them all on one machine.Reusable workflowA reusable workflow is a complete workflow called from another workflow with workflow_call, passing inputs and secrets.Runner groupA runner group is a collection of runners with access policies controlling which organisations and repositories may use them.Runner imageA runner image is the preconfigured disk image containing the operating system and preinstalled toolchain a job starts from.Runner labelA runner label is the string in a workflow's runs-on field that determines which runner picks up the job.Runner poolA runner pool is a set of runner instances kept ready so queued jobs can start without waiting for a machine to boot.Runner registration tokenA runner registration token is a short-lived credential a self-hosted runner uses to register itself with GitHub.Runner utilizationRunner utilization is the proportion of a runner's provisioned capacity actually used by the jobs running on it.runs-onruns-on is the GitHub Actions workflow key that specifies which runner or runner label a job should execute on.
S10
SBOMAn SBOM is a machine-readable inventory of every component and dependency contained in a piece of software.Security groupA security group is a stateful virtual firewall controlling inbound and outbound traffic for cloud instances.Self-hosted runnerA self-hosted runner is a machine you own and operate that connects to GitHub to execute Actions jobs.Service containerA service container is a supporting container, such as a database, started alongside a job and reachable over the network.Simulator runtimeA simulator runtime is the OS version image that an Xcode simulator boots, such as iOS 18.4.Single sign-onSingle sign-on lets users authenticate to multiple services through one central identity provider.SOC 2 Type 2SOC 2 Type 2 is an audit report attesting that an organisation's security controls operated effectively over a period, typically six to twelve months.Spot instanceA spot instance is spare cloud capacity sold at a large discount but reclaimable by the provider at short notice.Standby diskA standby disk is a pre-warmed volume holding a prepared runner filesystem so a job can start without provisioning storage.SubnetA subnet is a segment of a virtual network's IP address range, typically classified as public or private.
T2
V3
vCPUA vCPU is a virtual CPU presented to a virtual machine, usually mapping to one hardware thread rather than one physical core.VM snapshotA VM snapshot captures the complete state of a virtual machine so it can be restored later.VPCA VPC is an isolated virtual network within a cloud provider, with its own address space and routing.
W5
Warm cacheA warm cache already contains the entries a job needs, so work is restored rather than recomputed.Warm poolA warm pool is a set of pre-booted machines held ready to accept jobs immediately.Workflow eventA workflow event is the activity that triggers a workflow run, such as push, pull_request or schedule.Workflow permissionsWorkflow permissions set the scopes granted to GITHUB_TOKEN for a workflow or job.workflow_dispatchworkflow_dispatch is the trigger that allows a workflow to be run manually from the GitHub UI or API, optionally with inputs.