Artifact Registry

Google Cloud Artifact Registry manages container images and language packages. Cartography models repositories, repository-scoped image references, digest-scoped images, image layers, Helm charts, language packages, and generic artifacts.

        graph LR
    Project[GCPProject] -->|RESOURCE| Repository[GCPArtifactRegistryRepository]
    Repository -->|CONTAINS| RepositoryImage[GCPArtifactRegistryRepositoryImage]
    Repository -->|CONTAINS| HelmChart[GCPArtifactRegistryHelmChart]
    Repository -->|CONTAINS| LanguagePackage[GCPArtifactRegistryLanguagePackage]
    Repository -->|CONTAINS| GenericArtifact[GCPArtifactRegistryGenericArtifact]
    RepositoryImage -->|IMAGE| Image[GCPArtifactRegistryImage]
    TrivyFinding[TrivyImageFinding] -->|AFFECTS| Image
    PackageVersion[PackageVersion] -->|DEPLOYED| Image
    

Tagged DockerImage API records are expanded into one GCPArtifactRegistryRepositoryImage node per tag. These nodes preserve the repository-scoped, pullable image identity. Each repository-image node resolves through IMAGE to digest-scoped GCPArtifactRegistryImage content, so multiple tags, repositories, or projects may resolve to the same immutable image node.

OCI image layers are modeled independently by uncompressed diff ID. The current model does not create a relationship between an image and its layer nodes.

Trivy integration queries

Find all vulnerabilities affecting Artifact Registry container images:

MATCH (vuln:TrivyImageFinding)-[:AFFECTS]->(img:GCPArtifactRegistryImage)<-[:IMAGE]-(repo_img:GCPArtifactRegistryRepositoryImage)
RETURN vuln.name, vuln.severity, repo_img.uri, img.digest
ORDER BY vuln.severity DESC

Find packages deployed in Artifact Registry images with their vulnerabilities:

MATCH (pkg:PackageVersion)-[:DEPLOYED]->(img:GCPArtifactRegistryImage)<-[:IMAGE]-(repo_img:GCPArtifactRegistryRepositoryImage)
OPTIONAL MATCH (vuln:TrivyImageFinding)-[:AFFECTS]->(pkg)
RETURN repo_img.uri, pkg.name, pkg.version, collect(vuln.name) AS vulnerabilities

Find critical vulnerabilities in Artifact Registry images with available fixes:

MATCH (vuln:TrivyImageFinding {severity: 'CRITICAL'})-[:AFFECTS]->(img:GCPArtifactRegistryImage)<-[:IMAGE]-(repo_img:GCPArtifactRegistryRepositoryImage)
MATCH (vuln)-[:AFFECTS]->(pkg:PackageVersion)
OPTIONAL MATCH (pkg)-[:SHOULD_UPDATE_TO]->(fix:TrivyFix)
RETURN vuln.name, repo_img.uri, pkg.name, pkg.version, fix.version AS fixed_version