Artifacts

Artifacts preserve evidence and deployable outputs: bundles, packages, test reports, coverage, screenshots, logs, SBOMs, and provenance metadata. They connect a commit to what was verified and shipped.

					- uses: actions/upload-artifact@v4
  with:
    name: dist
    path: dist/
    retention-days: 14
				

Immutable promotion means deploy uses the same binary that passed tests—not a fresh rebuild with slightly different inputs. Reports should be retained for audit without leaking credentials in logs or uploads.

On interviews: artifact retention, immutable promotion, traceability from commit to deploy, report publishing, and scanning uploads for secrets.

Common pitfalls: rebuilding separately per environment creates drift; uploading logs or coverage without redaction exposes credentials; no retention policy fills storage unbounded.

The trade-off is storage cost and retention policy versus auditability and fast rollbacks.

Checklist:

• Promote immutable artifacts through environments.
• Retain reports for audit with redaction.
• Scan artifacts and logs for secret leakage.
• Tie artifact names to commit SHA or version.