How do you manage test sign-off during environment promotion from dev to staging to production?

The key principle: build once, deploy many. The Docker image or build artifact created from a commit never changes; it is promoted through dev → staging → production as-is. What changes is the required test depth at each gate.

Dev / PR: fast unit tests, lint, API contract tests. Must complete in minutes. Merge gate. Staging: full regression, integration tests, performance smoke, security scans. May run nightly or on-demand. Release gate. Production: post-deploy smoke only. Automated pass/fail with rollback.

In practice, track the required test suites for each promotion in your pipeline definition. Use environment-specific variables for base URLs and secrets. A promotion failure at staging should block the release and notify the team — never be silently retried.