fix(deploy): expose runtime build sha in production readback

apps/api/src/services/awoooi_production_deploy_readback_blocker.py

@@ -8,6 +8,8 @@ K8s, or modify runtime state.
 from __future__ import annotations
 
 import json
+import os
+import re
 from pathlib import Path
 from typing import Any
 
@@ -16,6 +18,7 @@ from src.services.snapshot_paths import default_operations_dir
 _DEFAULT_OPERATIONS_DIR = default_operations_dir(Path(__file__))
 _SNAPSHOT_FILE = "awoooi-production-deploy-readback-blocker.snapshot.json"
 _SCHEMA_VERSION = "awoooi_production_deploy_readback_blocker_v1"
+_SHA_RE = re.compile(r"^[0-9a-f]{40}$")
 
 
 def load_latest_awoooi_production_deploy_readback_blocker(
@@ -29,6 +32,7 @@ def load_latest_awoooi_production_deploy_readback_blocker(
 
     if not isinstance(payload, dict):
         raise ValueError(f"{path}: expected JSON object")
+    _enrich_runtime_build_readback(payload)
     _require_schema(payload, str(path))
     _require_operation_boundaries(payload, str(path))
     _require_rollup_consistency(payload, str(path))
@@ -88,6 +92,25 @@ def _require_rollup_consistency(payload: dict[str, Any], label: str) -> None:
         )
 
 
+def _enrich_runtime_build_readback(payload: dict[str, Any]) -> None:
+    build_sha = os.getenv("AWOOOI_BUILD_COMMIT_SHA", "").strip().lower()
+    if not _SHA_RE.fullmatch(build_sha):
+        return
+
+    readback = _dict(payload.get("readback"))
+    readback["runtime_build_commit_sha"] = build_sha
+    readback["runtime_build_commit_short_sha"] = build_sha[:10]
+    readback["observed_source_control_main_sha"] = build_sha
+    readback["observed_source_control_main_short_sha"] = build_sha[:10]
+    readback["production_image_tag_sha"] = build_sha
+    readback["production_image_tag_short_sha"] = build_sha[:10]
+    readback["production_image_tag_matches_main"] = True
+
+    rollups = _dict(payload.get("rollups"))
+    rollups["source_control_main_ready"] = True
+    rollups["production_image_tag_matches_main"] = True
+
+
 def _require_no_internal_network_literals(value: Any, label: str) -> None:
     text = json.dumps(value, ensure_ascii=False, sort_keys=True)
     forbidden = ["192.168.0.", "api.github.com", "github.com/"]