A build has produced an API client SDK and a deployable release candidate. Other teams need the SDK, while later pipeline stages need the exact release candidate that passed the build. An artifact repository gives both a versioned place to publish and retrieve those outputs, rather than rebuilding them or putting binary files in source control. section 9.3.4 section 8.3
An artifact repository stores software packages and other build artifacts with metadata in a defined structure. A mainline build can publish a passing release candidate; downstream stages fetch it for testing and deployment. This differs from an API registry, where consumers browse and search API definitions. section 8.3
Use the repository as a handoff point between CI and CD:
- Publish each build output as a versioned artifact. SDKs, compiled code, and deployable packages are possible outputs. section 9.3.4
- Have later stages and other teams fetch the published artifact instead of regenerating it. A central repository can receive outputs from multiple CI servers and hold build dependencies. section 9.3.4
- Retain metadata such as the artifact hash and build time. Published artifacts and their metadata do not change, making a reported release retrievable for debugging. Artifacts can also be promoted between environments. section 9.3.4
For an OpenAPI-based SDK workflow, generate the client from a bundled definition, then publish the package during the build. GitHub Packages is one repository option; Sonatype Nexus and JFrog Artifactory are others. Choose where consumers and downstream stages will retrieve the generated package before adding publication to the pipeline. section 9.3 section 9.3.4
Listing 9.11 Step to publish the Java SDK
- name: Build - Publish SDK to GitHub Packages
run: |
cd build-output/java-client
mvn --batch-mode deploy #1
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} #2
In a GitHub Actions build step, change to the generated Java client directory and run `mvn --batch-mode deploy` to publish the SDK to GitHub Packages. The step supplies `GITHUB_TOKEN` from GitHub Actions secrets. The publish command uploads the SDK JAR with metadata and MD5 and SHA1 hash files. section 9.3.5
After merging the workflow change, check that the build ran and that the generated package appears under the repository’s Packages area. Publication completes the build-stage handoff; deploying the API to higher environments is a subsequent CD task. section 9.3.5
