Artifact Management — cheat sheet¶

A one-page lookup for the concepts and tools used across this course. Grouped by task; the course pages cover the why behind each one — this page is just the what.

Where an artifact lives¶

Task	Reach for
Container images only, GitHub-native	GHCR
Container images only, AWS-native	Amazon ECR
Container images only, public or platform-agnostic	Docker Hub
Containers and language packages (npm, Maven, PyPI) in one system	Nexus or Artifactory
Never rebuild an artifact at deploy time	pull the one CI already built and tested from the registry

Versioning and immutability¶

Task	Guidance
Deploying from a registry	reference a specific version tag or, better, a digest — never `latest`
Stopping a tag from being silently overwritten	enable tag immutability on the repository
Getting the real, permanent identity of an artifact	its content digest (`sha256:...`), not its tag
Confirming "the same tag" really is the same artifact after a rollback	compare the digest it currently resolves to

Retention¶

Task	Guidance
Stopping unbounded registry growth	a retention/lifecycle policy (age- or count-based)
Deciding what to purge	anything old/untagged and not referenced by a live deployment
Deciding what to always keep	anything a running deployment currently points to; typically release-tagged images

Trust: signing and provenance¶

Task	Reach for
Verify an artifact hasn't been tampered with since publish	cosign (Sigstore) signature
Verify who/which pipeline identity signed it, without managing long-lived keys	cosign keyless signing (OIDC identity)
Verify an artifact was built from the expected source/commit by the expected pipeline	a provenance attestation (the concept SLSA formalizes)
Check for known vulnerabilities	image scanning — a separate concern from signing/provenance

How this connects¶

What an artifact registry is (page 1) is the durable home CI publishes to instead of letting every consumer rebuild; container and package registries (page 2) covers which system that home actually is; versioning, immutability, and retention (page 3) covers keeping references to it trustworthy and its storage bounded over time; signing and provenance (page 4) covers verifying what's in it before you trust it.