Harness、DevSecOps向けに新アーティファクトレジストリを発表

Harness has announced the general availability of Harness Artifact Registry, a platform capability designed to simplify how engineering teams store, secure, and govern software artifacts within modern DevSecOps pipelines. Rather than treating artifact repositories as standalone infrastructure components, the new registry embeds artifact management directly inside the software delivery platform, allowing security policies, governance controls, and CI/CD workflows to operate within a single system.

Artifacts, such as container images, libraries, and compiled build outputs, are central to the modern software supply chain. CI pipelines produce them, promote them through deployment environments, and reuse them across development teams. Yet many organizations still manage artifacts in separate tools disconnected from build and deployment pipelines. This fragmented architecture often forces teams to move between multiple systems to publish, retrieve, scan, and govern artifacts, increasing operational complexity and weakening supply chain visibility.

Harness's approach aims to address this fragmentation by treating the artifact registry as a control point within the software delivery lifecycle. In this model, artifacts are stored, scanned, governed, and promoted within the same platform that builds and deploys them. The registry supports multiple artifact ecosystems, including Docker images, Helm charts, Python, npm, Go, and NuGet packages, allowing teams to consolidate artifacts across programming environments into a single repository.

A key focus of the release is software supply chain security. The registry introduces a capability called Dependency Firewall, which evaluates packages and their dependencies when they enter the registry rather than waiting for downstream pipeline scans. Policies can automatically block artifacts containing known vulnerabilities, license violations, or untrusted sources before builds consume them. Artifacts that fail security checks can also be quarantined until they meet policy requirements.

Security scanning is integrated directly into the artifact lifecycle, using tools such as Trivy, enabling automatic vulnerability detection and policy enforcement as artifacts are stored. Combined with role-based access control, audit trails, and lifecycle management, the registry is designed to provide governance and traceability across the entire artifact lifecycle, from build creation through deployment and archival.

Harness enters a competitive market dominated by established artifact management platforms.

One of the most widely adopted tools is JFrog Artifactory. This universal repository manager stores and distributes a wide range of artifacts and integrates with CI/CD systems and security tools, such as Xray, for vulnerability scanning. Artifactory is known for its enterprise features, including high availability, replication, and extensive automation capabilities.

Another major platform is Sonatype Nexus, which offers similar functionality, including policy enforcement, artifact promotion workflows, and integrations with popular build tools. Nexus is widely used by organizations seeking scalable repository management, available in both open-source and commercial editions.

Integrated DevOps platforms also provide their own artifact registries. For example, GitHub Packages and GitLab Package Registry allow teams to store artifacts alongside their source code repositories and automate publishing through CI pipelines. These tools prioritize tight integration with source control and automation workflows rather than standalone artifact governance.

Where Harness differentiates itself is through platform integration and supply chain controls built directly into the registry. Rather than relying on separate scanning tools or downstream policy engines, the platform applies governance policies when artifacts are ingested into the registry. This architecture aims to prevent vulnerable or untrusted components from entering the delivery pipeline.

The release reflects a broader shift in DevOps tooling. Artifact repositories were once treated primarily as storage systems for build outputs, but they are increasingly becoming critical governance points within the software supply chain. As organizations adopt DevSecOps practices and confront growing supply chain threats, artifact registries are evolving into systems that enforce security policies, maintain auditability, and provide traceability across software components.

About the Author

Craig Risi

Craig Risi is a man of many talents but has no sense of how to use them. He could be out changing the world but prefers to make software instead. He possesses a passion for software design, but more importantly software quality and designing systems in a technically diverse and constantly evolving tech world.

Craig is also the writer of the book, Quality By Design: Designing Quality Software Systems, and writes regular articles on his blog sites and various other tech sites around the world.

When not playing with software, he can often be found writing, designing board games, or running long distances for no apparent reason.

Show moreShow less