Ask HN: Do you label deployments/releases in your organisation repositories?

We release from master (or whatever you want to call the default branch nowadays). When we’re ready to release, we push a new tag, then the CI will build a docker image with the same tag. Finally we deploy the tagged image. This implies that the master branch must be at all times able to be released to production, that we release only from master, and that the tip of master is what is running in production right now. We have procedures in place to make sure this is always true. The advantage is that when something happens in production, anyone can git pull the master branch (or checkout an earlier the tag) and start debugging the code right away