A release review can become misleading when its evidence refers to a different build from the one waiting for promotion. A passing test run, an approval message and a deployment ticket may each be accurate while describing different candidates. Start the review by asking which exact artifact every record concerns.
Give the candidate a stable identity
Record the source revision, build run and immutable artifact digest together. A friendly version label remains useful for people, but a label alone should not decide which bytes are promoted. Include the registry location and an authorized way to retrieve the artifact. Keep credentials in the approved secret store rather than copying them into the release record.
GitHub documents artifact attestations as a way to establish build provenance for binaries and container images. An attestation can support an identity check; it does not establish that the software meets a team's functional or recovery requirements. Define those acceptance checks separately.
Attach evidence with enough context to review it
For each required check, retain the candidate identifier, check version, execution time, environment and result. Link to the underlying run instead of reducing the evidence to a green badge. Record skipped checks and exceptions with a named owner and an expiry or review condition. A reviewer needs to see the boundaries of the decision as well as the successful checks.
Configuration needs its own identity. Record the reviewed configuration revision and the names or versions of secret references without exposing secret values. Describe environment-specific substitutions. If the deployment resolves a different reference later, the original approval may no longer cover that combination.
Decide what a rebuild invalidates
Treat a rebuilt artifact as a new candidate when its digest changes, even if the source commit remains the same. Dependencies, base images and build inputs can change the output. Carry forward only evidence whose scope is explicitly independent of that change. Repeat the checks that rely on the built output and request approval for the new candidate according to the team's policy.
