To know whether a release is the build that passed CI, test and qualify the exact output intended for release, then bind the test results and publication record to that artifact’s cryptographic digest. A rebuild—even from the same source revision—is a new candidate unless its equivalence is demonstrated and recorded.
What a passing test actually proves
A green check is evidence about a particular artifact, under a particular test execution. It does not automatically apply to a later rebuild, a package for another platform, or a container image reached through a mutable tag. The tag latest, for example, can point to different image bytes over time; a passing result for one image says nothing about bytes later published under the same tag. qnbs makes this distinction in the October 1, 2026 article “Test the Artifact You Built, Not an Equivalent Rebuild.”
As an Amazon Associate I earn from qualifying purchases.
Keep two kinds of evidence linked but distinct: artifact identity answers “which bytes?”; test and audit records answer “what checks ran, and what did they find?” A digest helps identify bytes, but by itself it does not show that they are safe, that tests were adequate, or that any checks passed.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Give every release candidate an immutable identity
Record enough information to distinguish one candidate from another. A useful identity includes the source commit, workflow run, build environment, output filename or package, target platform, and a cryptographic digest. For container images, use the image digest rather than relying on a friendly tag that can move.
The digest is the key link: checks should state which digest they consumed, and publication should identify the same digest. If a build is repeated, compare and record the resulting identity rather than assuming that the same commit produced interchangeable output.
Build once, then pass the output through the release path
- Choose the release candidate. Record the source commit and intended output, including the target platform or package type.
- Build that candidate. Retain the produced file or image and record its digest alongside the workflow and environment details.
- Transfer the retained output. Have test, scan, packaging, and publishing jobs consume that file or image instead of silently rebuilding it. GitHub Actions workflow artifacts are one way to persist outputs after a job ends and share them between jobs; GitHub documents their use for built binaries as well as logs and test results. GitHub Actions workflow artifacts documentation
- Bind each result to the candidate. Record the digest consumed by each required check and its outcome. Where supported, add provenance that identifies the subject digest and the build context.
- Publish only the qualified identity. Make the release record identify the same digest whose required checks passed. If the file or image is rebuilt or replaced, treat it as a new candidate and qualify it separately.
What artifact transfer checks do—and do not—establish
In GitHub’s documented upload/download artifact flow, the downloaded artifact’s SHA-256 digest is checked against the upload output, and a mismatch produces a warning. That check helps detect a change during transfer; it does not prove that the original build was correct or that the tests were sufficient. GitHub’s store-and-share-data tutorial
Preserving and transferring the output prevents a downstream job from accidentally testing a different rebuild. But transfer integrity is only one part of the chain: the checks still need to run against the retained candidate, and the publication step still needs to select that same candidate.
Add provenance to connect output with its origin
A provenance attestation can make the relationship between an artifact and its build context verifiable. GitHub documents signed claims that can include the repository, environment, commit SHA, and triggering event. GitHub artifact attestations documentation
Bind the attestation to the artifact’s subject digest. GitHub’s Docker publishing guidance provides an example of attaching an attestation to an image digest. GitHub’s Docker image publishing tutorial Provenance helps explain where an artifact came from; it does not replace testing or establish that the checks were appropriate.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Keep checks and release gates specific to each output
Different outputs are separate candidates. A container image, a desktop installer, and a package for another operating system can differ even when they originate from the same source commit. Each needs its own identity and relevant checks; passing one workflow is not evidence that another output was built, tested, or published.
Rank #4
Project-specific reports should be treated with the same care. The DEV Community article by qnbs reports differing CI/security, Tauri, and Docker outcomes for WorldScript Studio’s v1.29.0 tag, then describes qualification of a later candidate. Those are claims made by that article, not independently verified release records here. The article’s account illustrates why results should be evaluated per artifact and publication surface.
Whether a failed or missing check blocks publication is a policy decision your team must configure. Set explicit required checks for each release output, make publication depend on them, and ensure that the gate compares the artifact digest being published with the digest recorded by those checks. Documentation about artifact transfer and attestations does not configure your release gate automatically.
Quick Recap
Best Value
A release identity checklist
- Source commit and workflow run are recorded.
- Build environment, output type, and target platform are specified.
- The retained candidate has a recorded cryptographic digest.
- Downstream jobs test and scan that retained output rather than rebuilding it.
- Each result and any provenance evidence name the candidate’s digest.
- Publication uses the same digest that passed the required checks.
- Any replacement or rebuild is recorded and qualified as a new candidate.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
