> For the complete documentation index, see [llms.txt](https://docs.heeler.com/mrecEO40m5D6bt7Pq5pE/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.heeler.com/mrecEO40m5D6bt7Pq5pE/get-started/registries-and-artifacts/gcp-artifact-registry.md). # GCP Artifact Registry Analyze the packages your teams publish to GCP Artifact Registry as first-party code, reusing your existing GCP cloud credential. Heeler analyzes the libraries your organization publishes to **GCP Artifact Registry** — so the packages your teams build and consume are treated as first-party code: correlated with your inventory and evaluated for vulnerabilities, secrets, and policy drift, just like the repositories they come from. On the **Add Registry** menu, this provider is listed as **Google Cloud Platform**. ## Credentials used There's **no separate credential to create**. Heeler reuses the **same GCP service account** (Workload Identity Federation identity) from your existing [GCP cloud connection](/mrecEO40m5D6bt7Pq5pE/get-started/cloud-and-runtime/google-cloud-platform.md). Heeler's inventory job discovers Artifact Registry repositories on its schedule, and the **Add Registry** modal lets you opt-in specific repositories, scoped to a single ecosystem. ## Before you start * A [**GCP cloud connection in Heeler**](/mrecEO40m5D6bt7Pq5pE/get-started/cloud-and-runtime/google-cloud-platform.md) for the project(s) that own the repositories. * The Heeler service account has **`roles/artifactregistry.reader`** on every project you're enabling (included in the standard GCP setup). To add it to a new project: ```bash gcloud projects add-iam-policy-binding \ --member=serviceAccount:heeler-collector@heeler-security.iam.gserviceaccount.com \ --role=roles/artifactregistry.reader ``` * Heeler's GCP inventory has run since you granted the role — the **Repositories** picker is populated from inventory. ## Supported artifact types Each connection covers **one** artifact type. Publish to more than one ecosystem? Create a connection per type.
Artifact TypeEcosystem
MavenJava
NPMJavaScript
NuGet.NET
PyPIPython
Only repositories whose format matches the selected Artifact Type appear in the **Repositories** dropdown. ## Add GCP Artifact Registry {% stepper %} {% step %} ### Open the modal In Heeler, go to **Connections → Registries → Add Registry → Google Cloud Platform**. {% endstep %} {% step %} ### Fill in the form * **Artifact Type** — Maven, NPM, NuGet, or PyPI. * **Name** — a label (e.g. `Acme Maven Artifacts`). * **Credential** — the existing GCP service-account credential Heeler uses for inventory (the dropdown lists all configured GCP credentials). * **Repositories** — multi-select of the Artifact Registry repositories your teams *publish into*; each shows its full URL (e.g. `https://us-east1-maven.pkg.dev/acme/acme-java-artifacts`). Select them individually — see **Choose publishing repositories only** below before using **Select All**.
The Add Registry modal for Google Cloud Platform, showing Artifact Type, Name, Credential, and a Repositories multi-select.

GCP Artifact Registry reuses your existing GCP credential and inventoried repositories.

{% hint style="warning" %} **Choose publishing repositories only.** Artifact Registry repositories come in three modes, and the dropdown lists them all as plain URLs with no indication of which is which: * **Standard** — holds the artifacts your teams publish. **These are the ones to select.** * **Remote** — a caching proxy in front of a public registry such as Maven Central, npmjs, or PyPI. Its contents are other people's packages. * **Virtual** — an aggregator presenting several repositories behind one URL, often mixing your own with an upstream proxy. Adding a registry tells Heeler the packages there are yours, so selecting a remote or virtual repository asserts that public open-source packages are your first-party code — which distorts the first-party/third-party split wherever it's used, including the **Classification** filter on [Dependencies](/mrecEO40m5D6bt7Pq5pE/catalog/dependencies.md) and the **Exclude first-party packages** option in SBOM exports. **Select All** takes every repository of the chosen type, proxies included. List the modes first and pick the standard ones by hand: ```bash gcloud artifacts repositories list --project= \ --format="table(name, format, mode)" ``` {% endhint %} {% endstep %} {% step %} ### Save Heeler validates with a lightweight `repositories.get()` call against the first selected repository. On success the registry shows **Healthy** and package pulls begin. {% endstep %} {% endstepper %} {% hint style="info" %} **Multiple ecosystems?** Repeat for each artifact type — each connection is independent and can be enabled, disabled, or removed on its own. The artifact type **can't be changed** after creation; create a new connection if you need a different one. {% endhint %} ## Troubleshooting If validation fails, confirm the selected credential's service account has `roles/artifactregistry.reader` on the owning project, the **Artifact Registry API** (`artifactregistry.googleapis.com`) is enabled there, and the repository still exists at the URL shown. ## Related * [Connect Your Cloud & Runtime → GCP](/mrecEO40m5D6bt7Pq5pE/get-started/cloud-and-runtime/google-cloud-platform.md) — the GCP connection this reuses. * [Connect Registries and Artifacts](/mrecEO40m5D6bt7Pq5pE/get-started/registries-and-artifacts.md) — the common flow. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.heeler.com/mrecEO40m5D6bt7Pq5pE/get-started/registries-and-artifacts/gcp-artifact-registry.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.