Generally what we see people do is:
- build in CI
- push to a cache (eg: S3-compatible/HTTPS/SSH)
- use the cache elsewhere
In that paradigm, the artifacts live in the binary cache (sometimes called substituter), much like container images live in a registry. This raises the question of if or how to track precise artifacts in use. There is no standard for this yet. I've seen people use tags, branches, separate repos with manifests, DNS TXT records, etc. [ I work for https://floxdev.com/ where we are creating a standard for artifact lifecycle management and distribution called the Catalog into which you publish your artifacts, contact us if interested ].
The key selling point is that the resulting artifacts often have high de-duplication compared to container layers and have good correctness/completeness properties. We also can keep track of how things are built, so SBOM and supply chain information is very good.
