Execution: stamp git SHA / build-id into codeq --version + manifest.json (both envs)

[Kenny-Heitritter]

Parent

Map #16 · implements the Phase 0 decision locked in #19 (SHA/build-id stamping — the observability substrate).

What to build

Today manifest.json carries only version/timestamp/binaries, and the only on-pod way to tell which binary a user is on is codeq --version — which exposes no SHA. Make every codeq build self-identifying: stamp the opencode git SHA plus the Cloud Build $SHORT_SHA/$BUILD_ID into codeq --version output, and add "sha" + "build_id" keys to the emitted manifest.json, in both staging and prod.

Cheap — the build-binary step already installs git and sets OPENCODE_BUMP=1. This is the prerequisite for the rollout smoke-test and for verifying any auto-rebuild.

Lands in qbraid-infrastructure (terraform/environments/{staging,prod}/gcp/cloud-build-codeq.tf). Full ordered spec: #19 → Phase 0.

Acceptance criteria

• A staging codeq push writes latest/manifest.json including a sha (opencode git SHA) and a build_id key.
• codeq --version on the produced binary reports the same SHA / build id.
• The same stamping is applied to the prod build (opencode-prod-main → gs://qbraid-codeq).
• No change to the existing version/timestamp/binaries fields — additive only.

Blocked by

• None — can start immediately.

[Kenny-Heitritter]

Implemented — PR open for review (not merged).

qBraid/qbraid-infrastructure#620 (commit eb95042) — stamps the opencode git SHA + Cloud Build $BUILD_ID into codeq --version (via OPENCODE_VERSION) and adds sha/build_id keys to manifest.json in both staging & prod cloud-build-codeq.tf. Additive only (version/timestamp/binaries untouched).

Note: no opencode code change needed — OPENCODE_VERSION is already honored at build time, so this is fully contained to the Cloud Build step. terraform fmt/validate pass.

[Kenny-Heitritter]

Verified working on staging.

Full three-hop cascade exercised end-to-end 2026-08-01:

Hop	Build	Result
hop-1 opencode-staging-branch	79610d09	SUCCESS — all 11 steps, incl. trigger-lab-base-rebuild
hop-2 build-lab-base	0632971f	auto-fired by hop-1, SUCCESS, ASSERT PASSED
operator verify	./scripts/verify-codeq-rollout.sh staging	PASS

codeq --version raw: 0.0.0-c6444f71f910b39ff3425d820eebbbe3a3fb2b6b+79610d09-e6fe-46a4-8ffc-f3849db1f2a3
expected sha (manifest.json): c6444f71f910b39ff3425d820eebbbe3a3fb2b6b
observed sha (image codeq --version): c6444f71f910b39ff3425d820eebbbe3a3fb2b6b
ASSERT PASSED

Note the build_id segment is hop-1's own build ID — proof the binary baked into lab-base:latest came from the auto-triggered chain rather than an earlier manual run.

Landed across: qbraid-infrastructure anomalyco#620, anomalyco#699 (custom-role 403 → builds.editor), anomalyco#700 (actAs on the executor SA); opencode #45 (unblocked a CRITICAL seroval CVE at the security gate).

Prod remains gated — qbraid-infrastructure#698 plus the IAM prerequisites listed in #29.