Execution: stamp git SHA / build-id into codeq --version + manifest.json (both envs)

[Kenny-Heitritter]

Parent

Map #16 · implements the Phase 0 decision locked in #19 (SHA/build-id stamping — the observability substrate).

What to build

Today manifest.json carries only version/timestamp/binaries, and the only on-pod way to tell which binary a user is on is codeq --version — which exposes no SHA. Make every codeq build self-identifying: stamp the opencode git SHA plus the Cloud Build $SHORT_SHA/$BUILD_ID into codeq --version output, and add "sha" + "build_id" keys to the emitted manifest.json, in both staging and prod.

Cheap — the build-binary step already installs git and sets OPENCODE_BUMP=1. This is the prerequisite for the rollout smoke-test and for verifying any auto-rebuild.

Lands in qbraid-infrastructure (terraform/environments/{staging,prod}/gcp/cloud-build-codeq.tf). Full ordered spec: #19 → Phase 0.

Acceptance criteria

• A staging codeq push writes latest/manifest.json including a sha (opencode git SHA) and a build_id key.
• codeq --version on the produced binary reports the same SHA / build id.
• The same stamping is applied to the prod build (opencode-prod-main → gs://qbraid-codeq).
• No change to the existing version/timestamp/binaries fields — additive only.

Blocked by

• None — can start immediately.

[Kenny-Heitritter]

Implemented — PR open for review (not merged).

qBraid/qbraid-infrastructure#620 (commit eb95042) — stamps the opencode git SHA + Cloud Build $BUILD_ID into codeq --version (via OPENCODE_VERSION) and adds sha/build_id keys to manifest.json in both staging & prod cloud-build-codeq.tf. Additive only (version/timestamp/binaries untouched).

Note: no opencode code change needed — OPENCODE_VERSION is already honored at build time, so this is fully contained to the Cloud Build step. terraform fmt/validate pass.