Artifact registry
Storage for built things: images, packages, binaries. Deploys pull a finished build from it instead of rebuilding from source.
See it
What it is
The registry is the locker between build and deploy. CI produces a container image, a jar, a wheel, a tarball, or a signed binary, pushes it once, and every environment afterwards pulls that same object. Concrete ones: GitHub Container Registry (ghcr.io), Docker Hub, Amazon ECR, Google Artifact Registry, JFrog Artifactory, npm, PyPI, Maven Central.
The point is build once, promote many. The exact bytes that passed tests on a pull request are the bytes staging runs and the bytes production runs, so a green staging run actually means something. Reach for a private registry as soon as you have internal packages, compliance rules about where code is stored, or deploys that currently rebuild from source on the server.
Gotcha: tags lie. 'latest' moves constantly, and even 'v1.2.3' can be force-pushed over unless you turn on tag immutability. Deploy by content digest (sha256:...) when you need certainty, wire CI in with short-lived OIDC tokens instead of a long-lived password, and set a retention policy early, because untagged layers quietly become one of the largest lines on the cloud bill.
Ask AI for it
Set up an artifact registry flow for this repo. On every push to main, build the container image once and tag it with the git SHA. Add a semver tag only when the workflow is triggered by a release tag, since an ordinary main build does not have a version. Push once, capture the content digest the registry returns, and have staging and production deploy by that digest rather than by any tag that can move. Authenticate CI with the shortest-lived credential the chosen registry supports (OIDC where it exists, a scoped short-lived token otherwise) instead of a long-lived password. Turn on tag immutability and a retention policy that keeps release tags forever and untagged images for 14 days where the registry offers those natively; where it does not, implement the cleanup as a scheduled job against its API and tell me plainly which controls it is missing.