Build Artifacts

Build once, ship that exact thing

The 'build once, deploy many' principle from the foundations track plays out in the artifact pipeline. The artifact is what you actually ship. It must be:

Reproducible — the same source produces a bit-equivalent artifact on a fresh machine.
Versioned — has a unique name (Git SHA, semantic version, timestamp).
Immutable — once published, never overwritten.
Verifiable — has a checksum, signature, or both.

Artifact storage destinations

GitHub Releases — for human-shippable binaries (CLI tools, installers).
GitHub Container Registry (ghcr.io) — for Docker images.
npm / PyPI / crates.io — for language packages.
S3 / R2 / GCS — for general blobs.
Internal artifact stores — Artifactory, Nexus, etc.

Versioning

Two common schemes:

SemVer + Git SHA — v1.4.2+abc1234 for human-shippable releases. SemVer for API stability promise; SHA for traceability.
Date + SHA — 2026-04-30-abc1234 for internal builds that don't have user-facing semantics.

Code

Build a Python wheel + checksum + upload·yaml

  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v3
      - run: uv build  # produces dist/*.whl + dist/*.tar.gz
      - name: Compute checksums
        working-directory: dist
        run: sha256sum *.whl *.tar.gz > SHA256SUMS
      - uses: actions/upload-artifact@v4
        with:
          name: wheels-${{ github.sha }}
          path: dist/

Build once, ship that exact thing

Artifact storage destinations

Versioning

Code

External links

Exercise

Progress

Comments 0