Manage Artifacts

Configure private artifact registries, security scanning policies, and cross-region replication in Harness Artifact Registry.

Instructions

Step 1: Establish Scope

Confirm the user’s org, project, and artifact format requirements.

Call MCP tool: harness_list
Parameters:
  resource_type: "project"
  org_id: "<organization>"

Step 2: Identify the AR Task

Determine which workflow the user needs:

1. Private Registry Setup – Docker, Helm, Maven, npm, PyPI repositories with RBAC
2. Security Scanning Policy – Vulnerability scanning with CVE thresholds and license checks

Step 3: Configure Private Registry

Gather from the user:

• Artifact formats to support (Docker, Helm, Maven, npm, PyPI)
• Upstream proxy preferences (Docker Hub, ECR Public, GCR)
• Image signing requirements (Cosign, Notary, none)
• Multi-architecture support needs

Docker Registry:

• Repository name and upstream proxy configuration
• Image signing with Cosign or Notary v2
• Multi-arch support (amd64 + arm64)

Helm Chart Repository:

• Chart validation on push
• Dependency resolution enabled

Additional Formats (Maven, npm, PyPI):

• Separate repositories per format
• Snapshot/release policies
• Upstream proxies for public registries

Access Controls:

• Read access: all developers in the org scope
• Push access: CI/CD service accounts only (no personal credentials)
• Admin: platform team
• LDAP/SAML integration with identity provider

Replication:

• Primary region with replication to secondary regions
• Configurable sync interval (real-time, 15 minutes, hourly, daily)

Step 4: Configure Security Scanning Policies

Gather from the user:

• Artifact types to scan
• Security scanner (Aqua Trivy, Snyk, Grype, Prisma Cloud)
• CVE severity thresholds (block on CRITICAL and HIGH above N)

Configure scanning policies:

• Scan on push and periodic rescans for stored artifacts
• Block download if critical or high CVE count exceeds thresholds
• License compliance: block artifacts with disallowed licenses (GPL-3.0, AGPL)
• SBOM generation: auto-generate CycloneDX or SPDX on every scan
• Exemption workflow: security team can approve specific CVEs with expiry dates

Call MCP tool: harness_create
Parameters:
  resource_type: "pipeline"
  org_id: "<organization>"
  project_id: "<project>"
  body:
    pipeline:
      name: "artifact-security-scan"
      identifier: "artifact_security_scan"
      stages:
        - stage:
            name: Scan
            type: SecurityTests
            spec:
              # vulnerability scanning step
        - stage:
            name: Policy Gate
            type: Approval
            spec:
              # block if thresholds exceeded

Examples

• “Set up a private Docker registry for our team” – Configure Docker repository with upstream proxy and RBAC
• “Add Helm chart repository to our artifact registry” – Configure Helm repo with chart validation
• “Configure vulnerability scanning for our container images” – Set up scanning with CVE thresholds and license checks
• “Set up cross-region replication for our artifacts” – Configure primary and replica regions with sync interval
• “Block images with critical CVEs from being deployed” – Create security scanning policy with severity gates

Performance Notes

• Upstream proxies significantly reduce build times by caching public images locally – enable for all formats.
• Security scanning on push adds latency to the push operation – consider async scanning for large images.
• Cross-region replication increases storage costs linearly – only replicate to regions where artifacts are consumed.
• Image signing adds a verification step to every pull – ensure signing infrastructure is highly available.

Troubleshooting

Push Rejected by Security Policy

• Check the scan results for specific CVEs that triggered the block
• Use the exemption workflow to approve known false positives
• Verify the CVE threshold is not set too low for the artifact’s dependency tree

Replication Lag

• Check network connectivity between primary and replica regions
• Verify the sync interval is appropriate for the artifact volume
• Large artifacts (multi-GB images) may need a longer sync window

Registry Authentication Failures

• Verify the service account has push permissions in the target repository
• Check that LDAP/SAML integration is syncing correctly
• Ensure Docker login credentials are not expired