Build/Release/Run & Provenance

Purpose and scope

Separate build, release, and run; record provenance for traceability.

Outcomes

• Reproducible releases with signed artifacts.
• Faster rollback and audit readiness.
• Lower cross-env drift.

Signals of trouble

• Rebuilding per environment.
• Unclear origin of production artifacts.
• Manual promotion without records.

Remediation steps

1. Build once; sign OCI images; store provenance (SLSA/Sigstore).
2. Promote via GitOps; record approvals and environment diffs.
3. Automate rollback; test reversibility regularly.

Checklists and assets

• playbooks/12factor-modernized/checklist.md build/run items.

References

• SLSA, Sigstore, supply chain playbooks.