Skip to content
ProtocolSoup

Release And Tag Policy

Release And Tag Policy

Section titled “Release And Tag Policy”

Release Cadence

Section titled “Release Cadence”

Versioned releases are cut monthly from master. A month with no user-facing change is skipped rather than padded with a release.

latest is rebuilt on every push to master and therefore moves continuously between releases. Pin a version tag if you need a stable target.

Pre-releases use a hyphen suffix such as v3.0.0-rc.1. They publish only that exact tag: vX.Y, vX, and latest are never moved onto a pre-release build.

Available Tags

Section titled “Available Tags”
Tag Pattern Description Mutability
latest Current default branch build Mutable
sha-* Git commit SHA for build traceability Immutable
vX.Y.Z Semantic version release Immutable
vX.Y Minor version (resolves to latest patch) Mutable
vX Major version (resolves to latest minor) Mutable
Section titled “Recommended Tags By Environment”
Environment Recommended Tag Reason
Local development latest Always current, fast iteration
Shared testing vX.Y.Z Predictable, reproducible
Staging vX.Y.Z or sha-* Exact version control
Production-like @sha256:... or sha-* Immutable, auditable

Compatibility

Section titled “Compatibility”
  • Patch releases (vX.Y.Z → vX.Y.Z+1): No runtime contract changes.
  • Minor releases (vX.Y → vX.Y+1): Additive, backward-compatible changes.
  • Major releases (vX → vX+1): May include breaking changes with migration notes.

Supply Chain Signals

Section titled “Supply Chain Signals”

Each published image includes:

  • Multi-architecture build outputs
  • SBOM generation
  • Cosign provenance attestation
  • Trivy vulnerability scanning in CI
Section titled “Related”