{
  "slug": "wrangler-containers-registries-configure-supports-google-artifact-registry-crede-901987f49767",
  "title": "wrangler containers registries configure supports Google Artifact Registry credentials",
  "tools": [
    "wrangler"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-06-25T13:25:31.000Z",
  "announced_at": "2026-06-25T13:25:31.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "For a Google Artifact Registry host matching `*-docker.pkg.dev`, configure access with the service account email and key. The email must match the key’s `client_email`; if reusing an existing Secrets Store secret, omit the key and Wrangler validates it when images are pulled.",
    "examples": [
      "cat <PATH_TO_KEY.json> | npx wrangler containers registries configure <REGION>-docker.pkg.dev --gar-email=<SERVICE_ACCOUNT_EMAIL> --secret-name=<SECRET_NAME> --skip-confirmation",
      "npx wrangler containers registries configure <REGION>-docker.pkg.dev --gar-email=<SERVICE_ACCOUNT_EMAIL> --secret-name=<EXISTING_SECRET_NAME> --skip-confirmation"
    ],
    "gotchas": [
      "Version: 4.105.0",
      "DOMAIN (required): Registry domain; for Google Artifact Registry, use a `*-docker.pkg.dev` host.",
      "--gar-email: Google service account email for the registry; must match `client_email` in the service account key.",
      "stdin secret: Service account JSON key as a file path, raw JSON, or base64; not needed when reusing an existing secret.",
      "--secret-store-id: ID of the Secrets Store for registry credentials.",
      "--secret-name: Name under which Wrangler stores the registry credentials, or the name of the existing secret to reuse.",
      "credential flags: Registry credential flags are mutually exclusive; use the one matching the registry provider.",
      "Prerequisite: Create a Google service account and grant it the Artifact Registry Reader role; obtain its JSON key.",
      "Prerequisite: Supported Google registry hosts match `*-docker.pkg.dev`; `gcr.io` and `*.gcr.io` are unsupported.",
      "The `--gar-email` value must match `client_email` in the service account key.",
      "The service account JSON key is provided via stdin (a file path, raw JSON, or base64) or an interactive prompt (a file path or base64); it is never a CLI flag.",
      "When the target Secrets Store secret already exists, it is reused by reference and the key is not required.",
      "When reusing an existing secret, the email cannot be verified locally; it is validated against the key when images are pulled."
    ]
  },
  "why_it_matters": "Configure a repository’s container registry access for images hosted in Google Artifact Registry.",
  "sources": [
    "https://github.com/cloudflare/workers-sdk/releases/tag/wrangler%404.105.0",
    "https://developers.cloudflare.com/containers/guides/image-management/",
    "https://developers.cloudflare.com/containers/reference/wrangler-commands/"
  ],
  "rank": 0.98033,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v1+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "backfill-20261007",
    "verdict_id": "backfill-20261007:backfill-20261007-1c9e521c0d002840-0:gate",
    "evidence_hash": "c46c093f498e5903cf36a882f8a674d0871eda84a24fd5b2cc3b68e4e3244bc1"
  },
  "review": {
    "draft_hash": "397503d9a20364b85c1c9793bb891c03ddff31963a19d906706ff1423296ffd6",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "backfill-20261007:gate",
    "reason": "3 of 3 judge runs approved with p_yes >= 0.9 (mean 0.98 >= 0.9; 2 needed) and Jev gave 0.68 (>= 0.6 needed)."
  }
}