Artifact Repository
also called Binary Repository, Package Registry
The system of record for built binaries, container images and packages, holding immutable versioned artifacts with their metadata.
The repository exists so that "what is running in production" has an answer that does not depend on a build server's disk. It stores the artifact, its checksum, its provenance and its dependency manifest, and it must treat published versions as immutable — a mutable version is a supply-chain vulnerability with a friendly name.
This is why floating tags are a production hazard. Two deployments of the same tag can ship different code, which makes rollback ambiguous and incident forensics guesswork. Deploy by digest, tag for humans.
Promotion is the other half. An artifact moves between repositories or gains labels as it passes stages — built, tested, security-scanned, production-approved — so the promotion history is queryable and an unapproved artifact cannot be deployed by accident.
Retention deserves a decision rather than a default: keeping every build of every branch forever becomes one of the larger unexamined storage bills in an engineering organisation.