The Power of Content-Addressed Hashing
Because our builds are hermetic and deterministic, we can do something powerful: treat build outputs as a pure function of their inputs. The same inputs will always produce the same output — so if we have already computed the output once, we never need to compute it again.
Before executing a build action, the tool calculates a cryptographic hash (typically SHA-256) of all its inputs: the source files, the declared dependencies' hashes, the compiler binary's hash, the build flags, and the target platform. This hash is a unique fingerprint for that specific build action. If any input changes by even one byte, the hash changes completely.
The Cache Lookup Protocol
The build tool checks a shared Remote Cache Server (a content-addressable storage system, often backed by object storage like GCS or S3) before running any build action:
- Cache Hit: "Yes, CI built that exact hash 10 minutes ago. Here is the resulting binary." The build tool downloads the pre-built output and skips the compilation step entirely. From the developer's perspective, the build is instant.
- Cache Miss: "No record of that hash." The build tool runs the build action locally, produces the output, and then uploads the output keyed by its hash to the cache server so that the next person who needs it can benefit.
In a large organization, the CI system typically runs first and populates the cache. When developers pull the latest code and run their local builds, the vast majority of targets are cache hits — because CI already built them. A build that would take 30 minutes of local compilation can become a 30-second download session.
Cache Correctness
A critical property: because the cache key is derived from all inputs (including the compiler version and all transitive dependency hashes), a cache hit is always correct. You will never get a stale or incorrect artifact from the cache. If anything in the dependency chain changed, the hash changes, and you get a cache miss — triggering a fresh build. This is fundamentally different from timestamp-based caching (like make), where a file with an old timestamp might incorrectly be considered up to date.