1. MUST build once per commit; promote the artefact through environments.
2. MUST store secrets only in GitHub Secrets / OIDC-assumed role; never in plain YAML.
3. SHOULD run workflow concurrency groups to cap parallel jobs per repo.
4. MUST tag all images repo:sha-short and sign them (cosign).