Hermetic Build Pipeline Architecture Specification

Role: Staff Build Engineer with 12+ years of experience architecting deterministic compilation and test pipelines.

Context

• Repository topology and monorepo structure: {{repository_structure}}
• Target application runtimes and toolchains: {{target_runtimes}}
• Layer and dependency caching architecture: {{caching_strategy}}
• Artifact storage and package registry: {{artifact_registry}}
• Applicable governance and security baseline: {{compliance_framework}}
• Maximum acceptable end-to-end pipeline execution time: {{max_build_duration}}

Task

Draft an exhaustive engineering specification for a hermetic, deterministic CI pipeline that enforces reproducible builds, artifact provenance tracking, and deterministic caching within the target execution budget.

Method

1. Analyze {{repository_structure}} to establish pipeline entry points, boundary matrices, and parallelization opportunities.
2. Map {{target_runtimes}} to explicit containerized toolchain environments with immutable digest pins.
3. Design hermetic build stages that isolate external network calls during compilation phases using {{caching_strategy}}.
4. Define cache eviction, cryptographic hashing of inputs, and cache restoration order to meet {{max_build_duration}}.
5. Establish automated artifact packaging, SBOM generation, and provenance metadata validation for {{artifact_registry}}.
6. Incorporate mandatory compliance controls and SLSA provenance checks aligned with {{compliance_framework}}.
7. Detail failure modes, timeout policies, and debug artifact retention strategies for aborted runs.

Constraints

• MUST eliminate all unpinned network dependencies during the build execution step.
• MUST NOT allow untrusted external scripts or ephemeral base image tags in build runner definitions.
• All build stage inputs and outputs must be specified with deterministic cryptographic hash verifications.
• The specification must strictly target execution times under {{max_build_duration}}.
• Provide concrete YAML/declarative architecture patterns for each major pipeline tier.

Output format

Provide the specification organized under the following exact section headers:

1. Pipeline Architecture Overview (diagram description and stage flow)
2. Environment & Runner Toolchain Matrix
3. Caching & Hermeticity Guarantees
4. Artifact Publishing & Supply Chain Metadata
5. Failure Handling & Telemetry Specifications Maximum length: 1,200 words.

Self-review

• Confirm all variables ({{repository_structure}}, {{target_runtimes}}, {{caching_strategy}}, {{artifact_registry}}, {{compliance_framework}}, {{max_build_duration}}) are directly addressed.
• Verify that hermetic isolation mechanisms are explicitly detailed without relying on network access.
• Ensure each section provides actionable declarative configurations or pseudocode parameters.