Harbor users: how are you handling immutable tags without making cleanup a nightmare?

We're running a self-hosted Harbor registry and recently ran into an issue with our tag immutability rules.

Our CI pipelines generate unique `-beta` tags for builds, but those were getting caught by our immutability rules. That meant we couldn't delete old beta tags, which also prevented garbage collection from reclaiming the associated storage.

We're adjusting the rules to make release tags immutable while leaving development and beta tags disposable.

I'm curious how others handle this:

* Do you define immutability rules around release tag patterns and exclude everything else?
* Do you combine Harbor's immutability rules with retention policies?
* Do you enforce which tags can be deployed to production separately, using something like Kyverno?

It seems cleaner to separate artifact retention from deployment eligibility, but I'd be interested in hearing how others have approached it.

https://redd.it/1x18ib6
@r_SelfHosted