Release and respond
Verify before deployment
Check artifact digest, provenance, signer, source revision, policy, and environment before promoting exactly the reviewed build.
8 minute lesson
Do not rebuild between approval and production. Promote the same verified artifact.
The deployment system should verify that the artifact came from the approved project and workflow, references the expected source, and matches its digest. Keep environment-specific configuration outside the immutable artifact. Record what entered production.
Staging passes, but production rebuilds the source an hour later. A dependency or tool has changed, so production receives bytes that never passed staging.
Promoting one immutable artifact keeps the reviewed bytes stable. Environment configuration should remain separate so promotion does not require rebuilding the release.
Record the artifact digest, source revision, provenance identity, and configuration version for one staging deployment. Promote that same digest and save production evidence. Then substitute an artifact with a valid signature from an unapproved builder and prove the deployment gate refuses it.
Lesson completed