Promoting one build through environments: configuration promotion and dev-prod parity

Goal

Every environment runs an artifact that was built exactly once, so that a failure in production cannot be explained by a different compiler, dependency resolution or build flag, and every difference between environments is an explicit configuration value.

Prerequisites

A build that produces an immutable artifact (container image by digest, versioned package) and a runtime that reads configuration from the environment or mounted files, in line with the twelve-factor separation of config from code (cited).

Steps

1. Build once per commit in CI and publish the artifact under an identity that is never rewritten; record the digest or checksum.
2. Define the release as artifact plus configuration: per the cited build-release-run factor, a release combines the build with the deploy's config and should have a unique release ID, so version the environment configuration files and name each deployment artifact@digest + config@revision.
3. Keep per-environment configuration to the values that must differ: endpoints, credentials, capacity, feature-toggle defaults. Anything else that differs is a parity gap to remove.
4. Promote by re-tagging or re-referencing the same artifact, never by rebuilding from the same branch; a rebuild is a different build until proven identical.
5. Align backing services: the dev/prod parity factor (cited) asks to keep development, staging and production as similar as possible in time (deploy soon after writing), personnel (developers deploy) and tools (the same backing services rather than lightweight local substitutes); the factor warns that even small incompatibilities between backing services let code that passed in development fail in production. Run the same engine and version in Compose locally and in CI.
6. Gate each promotion on checks that ran against that artifact in the previous environment, and keep a record of which artifact is live where.
7. Diff configuration between environments periodically and explain every line that differs.

Expected result

"It worked in staging" becomes a strong statement, because staging ran the same bytes with configuration that differs only in listed values. Rollback is a promotion of the previous artifact, not a rebuild.

Limits and test basis

Parity of data volume, traffic shape and third-party sandboxes is rarely achievable; promotion removes build variance, not environmental variance. Configuration values that alter code paths (toggles) reintroduce untested combinations and must be treated as part of the release. Guidance follows the cited factors; no measurement is claimed.