Your company is developing a web-based application. You need to make sure that production deployments are linked to source code commits and are fully auditable. What should you do?

To create a fully auditable and traceable link between a production deployment and its source code, the deployed artifact must have a unique, immutable identifier that corresponds to the code version. Using the source code commit hash (e.g., a Git SHA) as the container image tag is a standard industry best practice. The commit hash is a unique fingerprint of the code at a specific point in time. This creates an unambiguous, machine-readable link from the running container back to the exact source code commit that produced it, fulfilling the auditability requirement.

A. A date and time stamp is not unique; multiple commits could occur within the same second, and it's not a direct link to the code's state.
B. Comments are manual, prone to human error, and not easily parsed by automated auditing tools, making them an unreliable linking mechanism.
D. The :latest tag is mutable and should not be used in production. It can be repointed to different images, which breaks traceability and makes deployments unpredictable.

1. Google Cloud Documentation, "Cloud Build," "Best practices for building containers," Section: "Tagging images." It advises, "Tag your images with more than just the latest tag... Consider using a tagging scheme, for example... Git commit SHA."

2. Google Cloud Architecture Center, "CI/CD for hybrid and multi-cloud workloads," Section: "Build and test." The article emphasizes creating immutable artifacts and states, "A common practice is to tag the container image with the commit ID of the source code."

3. DevOps on Google Cloud, "Continuous integration," Section: "Artifacts." The documentation highlights the importance of versioning build artifacts and suggests using the commit SHA as a version identifier for traceability.