Choose the appropriate artifact source
Release pipelines require traceability to establish package origin and ensure source integrity.
Traceability confirms that deployed packages match the exact sources built and committed to version control.
Source integrity verification is essential for production deployments across customer-facing environments.
Regulated industries require comprehensive audit trails to verify package integrity and deployment sources.
Auditability tracks code changes and build triggers, providing accountability throughout the deployment process.
Immutable packages provide reliable traceability and auditability mechanisms.
Implementation requires secure storage locations with restricted human access to prevent package modification.
Build pipelines must store packages in secure locations to maintain source integrity throughout the release process.
Package versioning enables immutable package identification and future reference.
Unique, immutable identifiers ensure end-to-end traceability and auditability from source code to production deployments.
Read more about Semantic Versioning.
Artifact source selection depends on traceability and auditability requirements.
Build artifacts provide optimal solutions for immutable multi-file packages requiring comprehensive traceability.
Single-file deployments can utilize direct source control links.
Disk or network shares introduce auditability and immutability risks due to potential unauthorized modifications.
See also Release artifacts and artifact sources.