13.2.1.2 Staging Promotion Tags

Staging promotion tags mark an image as having successfully passed whatever validation gates qualify it for the staging environment, representing a meaningfully stronger level of confidence than a development-stage tag, since reaching staging typically implies passing a more substantial set of checks.

Applying the Staging Tag After Passing Required Gates

A staging tag is applied only once an image has cleared whatever specific checks are required to advance beyond the development stage.

promote-to-staging:
  needs: [unit-tests, integration-tests, image-scan]
  steps:
    - run: |
        docker pull registry.example.com/myapp:${{ github.sha }}
        docker tag registry.example.com/myapp:${{ github.sha }} registry.example.com/myapp:staging
        docker push registry.example.com/myapp:staging

The explicit needs dependency ensures this promotion only happens after every one of these required checks has actually passed.

Why Staging Represents a Meaningful Trust Boundary

An image carrying the staging tag should represent something genuinely deployable to a production-like environment for final verification — this tag's meaning depends entirely on the gates actually enforced before it's applied.

docker pull registry.example.com/myapp:staging
docker compose -f docker-compose.staging.yml up -d
curl https://staging.example.com/health

Running Additional, Staging-Specific Validation

Some validation — load testing, manual QA, exploratory testing — only makes sense once an image is actually running in a staging environment, rather than as part of the earlier, automated pipeline checks.

k6 run load-test.js --env BASE_URL=https://staging.example.com

Why Staging Promotion Tags Matter

A staging tag, applied only after meaningful validation gates, provides both a clear deployment target for that environment and a trustworthy signal that an image has cleared a substantial portion of the overall validation a production deployment ultimately requires.