--- title: "Install a pinned tool release" description: "Download one pinned, checksummed release in shared setup and skip the per-worker package-manager upgrade." url: https://starsling.dev/ci-playbooks/techniques/pin-small-tool-install canonicalUrl: https://starsling.dev/ci-playbooks/techniques/pin-small-tool-install --- # Install a pinned tool release Download one pinned, checksummed release in shared setup and skip the per-worker package-manager upgrade. ## How to choose an approach This technique currently has one documented company example. Validate its prerequisites, tradeoffs and original CI environment against your repository before adapting it. - **[Stripe](https://starsling.dev/ci-playbooks/stripe#pin-small-tool-install)**: Use it when Shared CI setup updates a package manager on every run to obtain one CLI. Check before adopting: Verify the checksum before running the binary, keep platform compatibility, and give someone ownership of version updates. ## Apply this technique ````text Evaluate and apply this CI technique to my repository: Install a pinned tool release. Download one pinned, checksummed release in shared setup and skip the per-worker package-manager upgrade. Read the technique and its source-backed company examples: https://starsling.dev/ci-playbooks/techniques/pin-small-tool-install.md Inspect this repository’s CI workflows, build and test commands, dependencies, and recent run timings. Identify where this technique applies and explain the expected benefit using this repository’s evidence. Measure a baseline from recent comparable runs: elapsed time, queue time, runner minutes and failures where available. If data is unavailable, say what cannot be measured. Compare relevant company approaches, checking prerequisites, platform differences and tradeoffs. Rank applicable options by evidence, fit and measurable opportunity; do not present company results as predictions for this repo. Recommend the smallest safe change, show what checks and fallback paths remain, and ASK ME WHICH CHANGE TO APPROVE BEFORE EDITING ANY FILES. Only after approval, work on a new feature branch, make one reversible change, and open a reviewable pull request. Never merge or push to a default or protected branch. Keep required checks, test coverage, deployment and release behavior intact. Validate the change and compare equivalent runs where possible; report limitations and what should be monitored after merge. ```` ## How Stripe used this technique Read what Stripe changed and follow the original sources. ### Stripe: Install a pinned tool release Stripe iOS replaced a Homebrew upgrade of xcodes on every worker with a download of a specific release, checked against a SHA-256, in one shared install workflow. Evidence: Source PR/commit evidence Use it when: Shared CI setup updates a package manager on every run to obtain one CLI. Before applying it: Verify the checksum before running the binary, keep platform compatibility, and give someone ownership of version updates. [Read more in the Stripe playbook](https://starsling.dev/ci-playbooks/stripe#pin-small-tool-install) [Primary source](https://github.com/stripe/stripe-ios/pull/7331) ## CI optimization is continuous work. Apply this technique yourself, or use StarSling Runners for faster GitHub Actions and optional agent-driven optimization PRs, which teams on eligible paid plans can turn on. [Get self-improving CI](https://starsling.dev/products/runners) ## Related techniques ### [Build before starting the emulator](https://starsling.dev/ci-playbooks/techniques/avoid-emulator-build-contention) Compile the app first, then boot the emulator and install the finished build. 1 implementation · 1 company (Stripe) ### [Release query results before they become a timeout](https://starsling.dev/ci-playbooks/techniques/release-query-results) A query can finish while its unread response still holds the connection. 1 implementation · 1 company (Mastra) ### [Reuse exact baseline analysis results](https://starsling.dev/ci-playbooks/techniques/cache-baseline-results) Cache the default branch’s analysis result by revision, so each PR analyzes only its own side. 1 implementation · 1 company (Stripe) ## Company Playbooks ### [Anthropic](https://starsling.dev/ci-playbooks/anthropic) Run only affected tests ### [DoorDash](https://starsling.dev/ci-playbooks/doordash) Run build and test in parallel, sharded across CI agents ### [Linear](https://starsling.dev/ci-playbooks/linear) Benchmark the same job on faster hardware ### [Mastra](https://starsling.dev/ci-playbooks/mastra) StarSling runners for the slowest test workflow ### [OpenAI](https://starsling.dev/ci-playbooks/openai) Rank CI fixes by the minutes they save ### [Ramp](https://starsling.dev/ci-playbooks/ramp) Move a CPU-bound test suite to a faster CPU ### [Shopify](https://starsling.dev/ci-playbooks/shopify) Let an agent iterate against one CI metric ### [Spotify](https://starsling.dev/ci-playbooks/spotify) Build arm64 on native arm64 runners ### [Stripe](https://starsling.dev/ci-playbooks/stripe) Run only the tests a change can reach ### [Uber](https://starsling.dev/ci-playbooks/uber) Build the merge-queue speculations most likely to be needed