SW-1254: log image SHA on deploy for traceability

[wheelsandcogs]

SW-1254 — Deploy → SHA → PR traceability (backend)

Part of SW-1254. After the 2026-04-23 incident, identifying which code was running in production at a given moment took hours of cross-referencing. This change makes the backend self-report the commit it was built from.

What changed

• Bake the git SHA into the image. Dockerfile accepts ARG GIT_SHA and exposes it as ENV GIT_SHA; the Docker build workflow passes build-args: GIT_SHA=${{ github.sha }}. Local builds default to unknown.
• Expose it at runtime. New build.gitSha config field (interface + default.ts), read from process.env.GIT_SHA.
• Structured boot log. The startup line is now logger.info({ event: 'app_boot', gitSha, appEnv, port }, …). Container stdout already flows to the swprod-log-analytics workspace, so this is queryable with no new infra — filter ContainerAppConsoleLogs_CL on app_boot to see what SHA was running at any time.
• Healthcheck. /healthcheck/ now returns gitSha alongside message, so "what's running right now" needs no log query. Updated the one integration test that pinned the exact response body.

Companion PRs

• statswales-frontend — same boot-log pattern across publisher & consumer.
• statswales-terraform — SHA in the Azure DevOps run name + runbook lookup steps.

Verification

npm run check passes (lint, build, 1714 tests). Local bake check: docker build --build-arg GIT_SHA=test123 -t sw-be:t . then hit /healthcheck/ → {"message":"success","gitSha":"test123"}. End-to-end (ADO run name + KQL lookup) confirms once a build reaches prod.

[Copilot]

Pull request overview

Adds end-to-end deploy traceability by baking the build commit SHA into the Docker image and exposing it at runtime (boot log + /healthcheck/) so operators can quickly correlate a running container with a specific commit/PR.

Changes:

• Inject GIT_SHA at Docker build time (Dockerfile ARG/ENV) and pass it from GitHub Actions via docker/build-push-action.
• Extend app config (build.gitSha) sourced from process.env.GIT_SHA with a default of "unknown".
• Log the SHA on startup and include it in /healthcheck/ response; update the integration test accordingly.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
test/integration/routes/healthcheck.test.ts	Updates expected /healthcheck/ response to include gitSha.
src/server.ts	Adds structured boot log fields including gitSha.
src/routes/healthcheck.ts	Includes gitSha in /healthcheck/ JSON response.
src/config/envs/default.ts	Adds build.gitSha default config sourced from process.env.GIT_SHA.
src/config/app-config.interface.ts	Extends AppConfig with build.gitSha.
Dockerfile	Bakes GIT_SHA into the runtime image environment.
.github/workflows/docker-publish.yml	Passes GIT_SHA=${{ github.sha }} as a Docker build-arg.

[j-maynard]

LGTM 🤘🏻