Build Once, Promote to Production: Docker + Traefik + X-App-Env Without Rebuilding

I spent a weekend watching GitHub Actions rebuild the same Docker image twice — once for preprod, once for production. Same code. Same Dockerfile. Two builds. The second one existed purely because I didn't trust the first. That's dumb. Here's how I fixed it — and a Traefik trick that eliminated all hardcoded environment strings from the app code at the same time. The Problem: Rebuilding What You Already Tested The naive CI/CD setup for a preprod + production workflow: push to preprod branch → build image → deploy to preprod PR merged to main → build AGAIN → deploy to production You validated the preprod image. Then you threw it away and built a new one from the same commit. If the production build behaves differently — different cache state, transient npm issue, flaky native module compilation — you've introduced a gap between what you tested and what you shipped. The fix is conceptually simple: build once, re-tag to promote. Build Once, Tag Twice In deploy.yml (the reusable workflow),