Image Tagging and Metadata
Every image receives OCI labels for source repository, revision, version, and build time. Immutable tags include a short SHA; release tags use semantic or approved calendar versions.
Mutable aliases exist only to support human convenience or Image Updater policy. They are never the sole rollback reference. Tags are not moved across unrelated commits.
Pipeline summaries publish registry, repository, immutable tag, digest, source SHA, scan outcome, SBOM name, and signature status.
Environment policy
Section titled “Environment policy”Branch tags express eligibility, not deployment success. A develop-* tag is eligible for Dev, a release-* tag is eligible for Test, and a final version is eligible for Prod. Argo CD Image Updater configuration constrains which environment may select each tag family.
Retention
Section titled “Retention”Keep final release images according to the product retention policy. Keep lower-environment immutable images long enough to investigate a failed release and reproduce the deployed state. Registry cleanup rules must preserve any digest still referenced by an environment or active incident. Mutable aliases may be cleaned and recreated; immutable release evidence may not.