Artifact Registry

Google Cloud Artifact Registry manages container images and language packages. Cartography models repositories, repository-scoped image references, digest-scoped images, image layers, Helm charts, language packages, and generic artifacts.

        graph LR
    Project[GCPProject] -->|RESOURCE| Repository[GCPArtifactRegistryRepository]
    Repository -->|CONTAINS| RepositoryImage[GCPArtifactRegistryRepositoryImage]
    Repository -->|CONTAINS| HelmChart[GCPArtifactRegistryHelmChart]
    Repository -->|CONTAINS| LanguagePackage[GCPArtifactRegistryLanguagePackage]
    Repository -->|CONTAINS| GenericArtifact[GCPArtifactRegistryGenericArtifact]
    RepositoryImage -->|IMAGE| Image[GCPArtifactRegistryImage]
    Image -->|HAS_LAYER| Layer[GCPArtifactRegistryImageLayer]
    Image -->|HEAD| Layer
    Image -->|TAIL| Layer
    Layer -->|NEXT| Layer
    TrivyFinding[TrivyImageFinding] -->|AFFECTS| Image
    PackageVersion[PackageVersion] -->|DEPLOYED| Image
    

Tagged DockerImage API records are expanded into one GCPArtifactRegistryRepositoryImage node per tag. These nodes preserve the repository-scoped, pullable image identity. Each repository-image node resolves through IMAGE to digest-scoped GCPArtifactRegistryImage content, so multiple tags, repositories, or projects may resolve to the same immutable image node.

OCI image layers are modeled independently by uncompressed diff ID. HAS_LAYER links an image to every layer, HEAD and TAIL mark the ordered boundaries, and NEXT links adjacent layers.

Trivy integration queries

Find all vulnerabilities affecting Artifact Registry container images:

MATCH (vuln:TrivyImageFinding)-[:AFFECTS]->(img:GCPArtifactRegistryImage)<-[:IMAGE]-(repo_img:GCPArtifactRegistryRepositoryImage)
RETURN vuln.name, vuln.severity, repo_img.uri, img.digest
ORDER BY vuln.severity DESC

Find packages deployed in Artifact Registry images with their vulnerabilities:

MATCH (pkg:PackageVersion)-[:DEPLOYED]->(img:GCPArtifactRegistryImage)<-[:IMAGE]-(repo_img:GCPArtifactRegistryRepositoryImage)
OPTIONAL MATCH (vuln:TrivyImageFinding)-[:AFFECTS]->(pkg)
RETURN repo_img.uri, pkg.name, pkg.version, collect(vuln.name) AS vulnerabilities

Find critical vulnerabilities in Artifact Registry images with available fixes:

MATCH (vuln:TrivyImageFinding {severity: 'CRITICAL'})-[:AFFECTS]->(img:GCPArtifactRegistryImage)<-[:IMAGE]-(repo_img:GCPArtifactRegistryRepositoryImage)
MATCH (vuln)-[:AFFECTS]->(pkg:PackageVersion)
OPTIONAL MATCH (pkg)-[:SHOULD_UPDATE_TO]->(fix:TrivyFix)
RETURN vuln.name, repo_img.uri, pkg.name, pkg.version, fix.version AS fixed_version