Artifact Management#

Artifacts — container images, packages, binaries — are the output of your CI pipeline and the input to your CD pipeline. Managing them well means consistent tagging, secure storage, vulnerability scanning, and retention policies.

Container Registries#

A container registry stores and distributes Docker/OCI images. Choose based on your ecosystem:

ECR Lifecycle Policy Example#

Automatically clean old images to control storage costs:

{
  "rules": [
    {
      "rulePriority": 1,
      "description": "Keep last 20 tagged images",
      "selection": {
        "tagStatus": "tagged",
        "tagPrefixList": ["v"],
        "countType": "imageCountMoreThan",
        "countNumber": 20
      },
      "action": { "type": "expire" }
    },
    {
      "rulePriority": 2,
      "description": "Remove untagged images after 7 days",
      "selection": {
        "tagStatus": "untagged",
        "countType": "sinceImagePushed",
        "countUnit": "days",
        "countNumber": 7
      },
      "action": { "type": "expire" }
    }
  ]
}

Artifact Repositories (Non-Container)#

For JARs, npm packages, Python wheels, and generic binaries:

When to Use What#

• Small team, single language → GitLab/GitHub built-in package registry
• Multi-language monorepo or enterprise → Artifactory or Nexus (central proxy + cache)
• AWS-native, need upstream proxy → CodeArtifact (proxies npmjs, PyPI, Maven Central)

Semantic Versioning in Pipelines#

Every artifact should carry a meaningful version. SemVer (MAJOR.MINOR.PATCH) is the standard:

Automating Version Bumps#

Tools that derive the next version from commit messages (Conventional Commits):

# semantic-release (Node.js ecosystem)
npx semantic-release

# commitizen + standard-version
npx standard-version

# Python: python-semantic-release
semantic-release publish

Conventional Commits → version mapping:

Image Tagging Strategies#

Recommended Approach#

# GitLab CI example
variables:
  IMAGE_TAG: "${CI_COMMIT_TAG:-${CI_COMMIT_SHORT_SHA}}"
  IMAGE: "${CI_REGISTRY_IMAGE}:${IMAGE_TAG}"

build:
  script:
    - docker build -t $IMAGE .
    - docker push $IMAGE
    # Also tag as latest for convenience (non-prod only)
    - docker tag $IMAGE ${CI_REGISTRY_IMAGE}:latest
    - docker push ${CI_REGISTRY_IMAGE}:latest

Immutable Tags#

Production images should use immutable tags — once pushed, a tag cannot be overwritten:

# ECR: enable image tag immutability
aws ecr put-image-tag-mutability \
  --repository-name myapp \
  --image-tag-mutability IMMUTABLE

Vulnerability Scanning in CI#

Scan images and dependencies before they reach production:

Scanning Tools#

Trivy in CI Pipeline#

# GitLab CI
scan:
  stage: security
  image: aquasec/trivy:latest
  script:
    - trivy image --exit-code 1 --severity HIGH,CRITICAL $IMAGE
    - trivy image --format json --output trivy-report.json $IMAGE
  artifacts:
    paths:
      - trivy-report.json
  allow_failure: false

# GitHub Actions
- name: Trivy vulnerability scan
  uses: aquasecurity/trivy-action@master
  with:
    image-ref: ${{ env.IMAGE }}
    format: 'sarif'
    output: 'trivy-results.sarif'
    severity: 'HIGH,CRITICAL'
    exit-code: '1'

- name: Upload scan results
  uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: 'trivy-results.sarif'

Gate Policy#

Shifting Left: Dependency Scanning#

Scan dependencies before building the image:

# Python
pip-audit --requirement requirements.txt

# Node.js
npm audit --audit-level=high

# Go
govulncheck ./...

Retention & Cleanup Policies#

Unmanaged registries grow indefinitely. Define policies:

Key Takeaways#

1. Use your platform’s native registry for simplicity (ECR for AWS, GitLab Registry for GitLab CI) — add Artifactory/Nexus only when you need cross-platform proxying.
2. Tag images with SemVer + SHA for both human readability and commit traceability. Never deploy latest to production.
3. Enable immutable tags in production registries to prevent accidental overwrites.
4. Scan every image in CI — fail the pipeline on Critical/High findings. Use Trivy or Grype as a free baseline.
5. Automate cleanup — lifecycle policies prevent registry bloat and reduce storage costs.
6. Automate version bumps from Conventional Commits — removes human error from the versioning process.