Artifact Management

An artifact is the one thing that should never be ambiguous in a delivery pipeline: given a version or digest, everyone — CI, CD, an engineer debugging an incident six months later — should be able to retrieve the exact same bytes. The moment an artifact can be overwritten, rebuilt with a different result, or referenced by a mutable tag like latest, every downstream promise (this is what passed CI, this is what's in staging, this is what's in prod) becomes unverifiable.

If you can't prove two environments are running the exact same artifact, you can't actually debug the difference between them.

An artifact, once built, is immutable — every later stage promotes it, none of them rebuild it.

1. Build once, promote the same bytes everywhere