Build once promote artifact
What does “build once, promote many” mean in CI/CD, and what goes wrong if you rebuild for production?
Answers use simple, clear English.
Quick interview answer
Create one immutable artifact (container digest/package version) in CI, then promote that same artifact through staging to prod. Rebuilding for prod can pull newer transitive deps or different build flags, so staging proof no longer applies. Pin by digest; sign and scan that artifact.
Detailed answer
Create one immutable artifact (container digest/package version) in CI, then promote that same artifact through staging to prod. Rebuilding for prod can pull newer transitive deps or different build flags, so staging proof no longer applies. Pin by digest; sign and scan that artifact.
Real example & use case
ghcr.io/acme/api@sha256:abc promoted staging→prod unchanged.
Pros & cons
Pros: reproducibility. Cons: requires registry discipline.