Jenkins ORAS Plugin Offloads CI Artifacts to OCI Registries via OCI 1.1 Referrers

The Jenkins project highlighted the ORAS Artifact Manager plugin as its featured tool, detailing an architectural model that redefines how continuous integration environments handle build stashes and archived assets. Developed around the CNCF ORAS (OCI Registry As Storage) Java SDK, the plugin replaces traditional local disk and filesystem storage on the Jenkins controller by routing all archived artifacts directly to any OCI-compliant registry, such as Harbor, GitHub Packages, or cloud-native registry services. Technically, the integration maps each Jenkins job path to a sanitized OCI repository name. During pipeline execution, the build generates a root artifact tagged with the build number to anchor the execution. Individual archived files are pushed as discrete single-layer OCI manifests linked back to the build root via OCI 1.1 `subject` fields—the same mechanism used to attach Software Bills of Materials (SBOMs) and digital signatures to container images. Pipeline stashes are similarly encapsulated and stored as tagged, compressed layers. This release addresses a persistent failure mode in CI/CD infrastructure: controller disk starvation and the complexity of managing disparate storage backends. By shifting storage responsibilities onto standard OCI registries, platform engineering teams can consolidate access control, vulnerability scanning, and lifecycle retention policies under a single registry control plane. CI runners and external consumers can discover all outputs associated with a specific build through standard OCI Referrers API queries without requiring Jenkins controller intervention. The update aligns with the wider DevOps and DevSecOps trend of treating container registries as universal artifact storage. As modern delivery pipelines increasingly standardize on OCI packaging for Helm charts, WebAssembly modules, and attestations, integrating build-level CI artifacts into the same specification bridges legacy build automation with modern cloud-native supply chains. In practice, teams looking to adopt the ORAS Artifact Manager must ensure their target container registry fully implements the OCI 1.1 Distribution Specification and Referrers API. Platform teams should assess networking throughput and credential management between agents and registry endpoints. Adopting this architecture enables leaner, stateless Jenkins controllers, simplifying disaster recovery and automated horizontal scaling.