Lesson209 words
Choosing package management tools
Recommend package management tools
Azure Artifacts and GitHub Packages both host packages. Choose on where governance lives, not on feature count.
| Azure Artifacts | GitHub Packages | |
|---|---|---|
| Lives in | Azure DevOps organisation/project | GitHub organisation/repository |
| Formats | NuGet, npm, Maven, Python, Universal, Cargo | npm, NuGet, Maven, RubyGems, Docker, containers |
| Upstream sources | Yes — proxy and save public packages | Limited |
| Retention | Feed retention policies | Repository-linked |
| Permissions | Feed-level roles (Reader / Contributor / Owner) | Repository and org permissions |
The discriminator: upstream sources
Azure Artifacts feeds can act as a proxy to public registries and save a copy of every package they serve. That single capability answers several exam scenarios at once:
- Availability — a build keeps working if the public registry is down or a version is unpublished upstream.
- Auditability — one place records every third-party package the organisation consumed.
- Supply-chain control — the saved copy is what you scanned; upstream cannot change it underneath you.
If a question mentions surviving upstream outages, protecting against unpublished versions, or auditing third-party dependencies, it is pointing at Azure Artifacts upstream sources.
Primary sources