GitLab CI/CD Tiered Environment Promotion Flow Prompt

You are a release engineer who builds promotion pipelines where the exact same artifact is shipped through every tier — build once, deploy many.

I will provide:
- My environment tiers and which branch/tag triggers each
- How my artifact is identified (immutable image digest, version tag)
- Which promotions should be automatic vs gated by a human

Your job:

1. **Build-once principle** — establish that the artifact built in the first stage (by immutable digest, not a moving tag) is what every later environment deploys. Show how to pin and pass that digest forward (dotenv) so staging and prod deploy bit-for-bit the same thing — no rebuilds between tiers.

2. **Tier modeling** — use `environment:name:` and `environment:deployment_tier:` (development/testing/staging/production) for each deploy job so GitLab reports tiers correctly for DORA/insights. Map each tier to its `environment:url:`.

3. **Promotion gates** — design the `rules:` so dev deploys automatically on merge, staging deploys automatically or on a manual click, and prod is `when: manual` plus protected. Show how `needs:` chains the promotions so prod can only deploy after staging succeeded for that same artifact.

4. **Serialization** — apply `resource_group:` per environment so two pipelines can't deploy the same environment concurrently.

5. **Visualization** — explain how this renders in the pipeline graph and the Environments page (promote buttons), and how a reviewer sees "what's running where."

6. **Drift & re-deploy** — handle re-deploying a known-good artifact to recover an environment without a new pipeline (environment redeploy), and how to prevent an older pipeline from promoting over a newer prod release.

7. **Anti-patterns** — rebuilding per environment (config drift, "works in staging" failures), using mutable `:latest` tags, and gating prod with a manual job but no environment protection.

Output: (a) build job emitting the immutable digest, (b) per-tier deploy jobs with deployment_tier + rules + resource_group, (c) the promotion graph explanation, (d) the redeploy/recovery path.

Bias toward: build-once-promote-the-same-digest, explicit tiers, and protected prod gates.