Container Registry and Software Supply Chain Platform  ·  View 21 of 33  ·  4 · Runtime

Promotion, Demotion and Retention

How an artifact moves between environments without being rebuilt, re-tagged or trusted twice.

Editable source SVG draw.io All views
Build output Development Repository untagged 30 d Development gate Signature valid SBOM present Staging gate Scan complete No unsuppressed critical Builder on allowlist Production gate All staging gates Base image allowlisted Finding age within limit Record Promotion Attestation signed · names both Bundle Version Recorded Production Production Repository 2 y after last deploy Immutable Tags Reverse Quarantine next admission denies Demotion signed, like promotion marks ineligible Promotion, Demotion and Retention Interface / broker Decision point Security / platform Data store Risk / gap Application we own failure / alternate Promotion is an assertion about an existing digest. Nothing is rebuilt and nothing is re-tagged. v 1.0 · owner Platform Engineering · date 2026-09

Decisions

  • Promotion is an assertion about an existing digest, recorded as a signed attestation naming both environments, the approver and the bundle version
  • An artifact entering an environment must have satisfied every gate of the preceding environment
  • Demotion and quarantine are signed the same way, and take effect at the next admission of that artifact

Why not a promoted flag

  • A promotion flag in the metadata store is exactly the stored boolean the architecture exists to avoid
  • The promotion attestation is evidence about the past — it says a gate was passed on a date, not that the artifact is safe now
  • Whether the artifact is admissible today is still computed from current evidence

Lifecycle

  • Production artifacts retained 2 years after last deployment; development artifacts 30 days untagged
  • Nothing referenced by a running workload or a retained attestation is collected, regardless of tag state
  • Owners are notified when a newer patched base image exists — one fact, fanned out, not one ticket per image
◀  Air-Gapped Verification All views Exceptions and Suppressions  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 33 views · open-source, on-premises21-promotion-and-lifecycle