City 311 builds must record immutable provenance so support can map a production binary to exact source. Which metadata should be stamped?
Select an answer to reveal the explanation.
Short Explanation
You can use the Git commit SHA as provenance: it identifies the exact source revision behind a 311 build. A developer’s first name, a rotating joke string, or an unlabeled binary cannot provide that source link.
Full Explanation
The Git commit SHA recorded in 311 build metadata and artifact labels is immutable provenance: it identifies the exact source revision that produced a build. Stamping the SHA into build metadata, artifact labels, and support-facing version endpoints lets support and developers check out the same source tree the pipeline built when citizens report a defect, rather than guessing which “latest” revision was live. Municipal systems under public scrutiny need this serial-number-style link to explain production behavior. Recording only a developer’s first name from a chat greeting fails because names are not unique, are not tied to a repository object, and do not identify a commit. A rotating joke string is intentionally non-deterministic and conveys no source identity. Leaving binaries unlabeled makes rollback selection and root-cause analysis a mystery, defeating the purpose of provenance. Exam caveat: a commit SHA shows which source tree was built; by itself, it does not prove the binary was untampered with after the build or that dependency versions were pinned. For supply-chain assurance, pair SHA provenance with artifact integrity controls, but do not substitute a first name or timestamp when immutable source mapping is required. Practical check: after a build, inspect its artifact metadata or /version endpoint and confirm the recorded SHA matches git rev-parse HEAD for the pipeline checkout. During a production incident, retrieve that SHA and verify that git show resolves the expected change.