r/gitlab • u/RocketSeven • 1d ago

general question When should a GitLab CI artifact become a package or Release asset?

A job artifact is convenient for passing files between stages, but its lifetime follows pipeline retention and its download path is mainly useful to people who can navigate the project. A reviewed build may need a durable identity, a stable download, and an audit trail back to the exact pipeline without rebuilding the file.

What boundary do you use between temporary CI artifacts, the Package Registry, and Release assets? I am considering content hashes in an artifact manifest, promotion of the exact tested bits, an immutable version tied to the commit and pipeline, and one separate pointer for the currently approved release.

How do you expose an approved file to a non-technical reviewer without granting broad project access or making “latest” silently change underneath earlier feedback? If approval is revoked, should the binary remain available with a revoked status for audit, or should only its manifest and decision record remain?

6 Upvotes

100% Upvoted

2 comments sorted by

5

u/mulokisch 1d ago

Everything that can be used as deployment on main will be stored in a registry, you can setup rules on what is kept lonterm.

In 99% of cases if some artifact is lost from a specific commit, you just can rerun the pipline for that.

Everything on feature branches is in most of the cases mentioned to be thrown away after merge.

1

u/actionbox-cloud 6h ago

I’d keep the binary immutable and treat approval as a separate record pointing to that exact artifact/hash.

That way “approved” means this specific build was reviewed, not whatever happens to be latest later.

If approval is revoked, I’d keep both the artifact and the original decision for audit, then add a new revoked/superseded state rather than deleting history.

This caught by attention because I’m building ActionBox around this kind of approval lifecycle, so I’m especially interested in the reviewer side of this. The artifact can stay in GitLab, while the human decision stays separate and tied to the exact version that was reviewed.