Build once, provenance, signing và promotion
Environment promotion phải dùng cùng digest; rebuild theo môi trường tạo artifact chưa được test và phá traceability.
Artifact identity
Package/image/chart/IaC plan có version + immutable digest, metadata commit/toolchain/dependencies. Registry permissions tách write/promote/deploy. Tag friendly nhưng deployment resolve/record digest.
SBOM and provenance
SBOM inventory components; provenance/attestation mô tả builder, source, command/materials. Signing verifies identity/integrity under trust policy, không chứng minh artifact không có vulnerability/logic bug.
SLSA threats
Compromised source, dependency, build platform, artifact registry hoặc deployment identity. Pin actions/dependencies, hermetic/reproducible where possible, protected builders, review release workflow và verify at admission/deploy.
Scanning
SAST, dependency/container/IaC/secret/license scans trả tín hiệu khác nhau. Gate theo severity/exposure/fixability, suppression owner+expiry. Rescan stored artifacts khi vulnerability database đổi và rebuild patched base.
Promotion
Dev→staging→prod changes only environment config, not application artifact. Record approvals, policy, test evidence and deployment receipt. Rollback selects known digest, but data/schema compatibility remains.