SW-1254: log image SHA on deploy for traceability

.github/workflows/docker-publish.yml

@@ -98,6 +98,8 @@ jobs:
         uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
         with:
           context: .
+          build-args: |
+            GIT_SHA=${{ github.sha }}
           platforms: ${{ github.event_name == 'pull_request' && 'linux/amd64' || 'linux/amd64,linux/arm64' }}
           push: ${{ github.event_name != 'pull_request' }}
           load: ${{ github.event_name == 'pull_request' }}

Dockerfile

@@ -33,6 +33,11 @@ HEALTHCHECK --interval=60s --timeout=3s --start-period=30s --retries=3 \
 ENV NODE_ENV=production
 EXPOSE 3000
 
+# Bake the git SHA into the image so the running app can report which commit it was built from.
+# Passed at build time by CI (build-args: GIT_SHA=${{ github.sha }}); defaults to "unknown" for local builds.
+ARG GIT_SHA=unknown
+ENV GIT_SHA=${GIT_SHA}
+
 # set the user to non-root (node)
 USER node
 

src/config/app-config.interface.ts

@@ -22,6 +22,9 @@ export interface EntraIdConfig {
 
 export interface AppConfig {
   env: AppEnv;
+  build: {
+    gitSha: string;
+  };
   frontend: {
     port: number;
     url: string;

src/config/envs/default.ts

@@ -12,6 +12,9 @@ const DEFAULT_TIMEOUT_MS = 2500;
 export const getDefaultConfig = (): AppConfig => {
   return {
     env: AppEnv.Default, // MUST be overridden by other configs
+    build: {
+      gitSha: process.env.GIT_SHA || 'unknown'
+    },
     frontend: {
       port: parseInt(process.env.FRONTEND_PORT || '3000', 10),
       url: process.env.FRONTEND_URL!

src/routes/healthcheck.ts

@@ -92,7 +92,7 @@ const checkConnections = async (req: Request, res: Response): Promise<void> => {
 };
 
 healthcheck.get('/', (_req: Request, res: Response) => {
-  res.json({ message: 'success' }); // server is up
+  res.json({ message: 'success', gitSha: config.build.gitSha }); // server is up
 });
 
 healthcheck.get('/ready', checkConnections); // server is up and has active connections to dependencies

src/server.ts

@@ -30,7 +30,10 @@ Promise.resolve()
   })
   .then(() => {
     app.listen(PORT, async () => {
-      logger.info(`Server is running on port ${PORT}`);
+      logger.info(
+        { event: 'app_boot', gitSha: config.build.gitSha, appEnv: config.env, port: PORT },
+        `Server is running on port ${PORT}`
+      );
     });
   })
   .catch(async (err) => {

test/integration/routes/healthcheck.test.ts

@@ -31,7 +31,7 @@ describe('Healthcheck', () => {
     test('/healthcheck/ returns success', async () => {
       const res = await request(app).get('/healthcheck/');
       expect(res.status).toBe(200);
-      expect(res.body).toEqual({ message: 'success' });
+      expect(res.body).toEqual({ message: 'success', gitSha: 'unknown' });
     });
   });