Artifacts & Registries
Build once, promote many. Immutable outputs, digests versus tags, registries, retention, and why rebuilding per environment quietly destroys your evidence.
The immutable, stored, addressable output of a build — the unit that gets tested, promoted, deployed and rolled back.
One artifact is built, then promoted unchanged through every environment, and environment differences arrive as configuration rather than as a rebuild.
The store artifacts live in between build and deploy — and a piece of production infrastructure on the critical path of every scale-up.
A tag is a mutable human reference; a digest is content identity. Deploying by digest is what makes a rollout reproducible.
A version number is a compatibility promise to consumers who upgrade on their own schedule — and for a continuously deployed internal service there are none, so a build number is the honest answer.
Which artifacts you can delete, why "keep the last N" deletes the one you needed, and why retention policy is part of the rollback plan.
Moving one artifact forward through environments by changing what is claimed about it, never by changing its bytes.