| Tag Pattern | Description | Mutability |
|---|
latest | Current default branch build | Mutable |
sha-* | Git commit SHA for build traceability | Immutable |
vX.Y.Z | Semantic version release | Immutable |
vX.Y | Minor version (resolves to latest patch) | Mutable |
vX | Major version (resolves to latest minor) | Mutable |
| Environment | Recommended Tag | Reason |
|---|
| Local development | latest | Always current, fast iteration |
| Shared testing | vX.Y.Z | Predictable, reproducible |
| Staging | vX.Y.Z or sha-* | Exact version control |
| Production-like | @sha256:... or sha-* | Immutable, auditable |
- Patch releases (
vX.Y.Z → vX.Y.Z+1): No runtime contract changes.
- Minor releases (
vX.Y → vX.Y+1): Additive, backward-compatible changes.
- Major releases (
vX → vX+1): May include breaking changes with migration notes.
Each published image includes:
- Multi-architecture build outputs
- SBOM generation
- Cosign provenance attestation
- Trivy vulnerability scanning in CI
