Ensure every production deployment is traceable and auditable to a specific source commit. What practice should you adopt?

Matching the container image tag to the source code commit hash creates a direct, immutable link between the deployed artifact and the exact code version. This ensures full traceability and auditability, as you can always determine precisely which commit produced a given running container. Requiring developers to tag commits with date/time is redundant, as Git already records this information. Requiring a commit message linking to the deployment is prone to human error and inconsistency, and doesn't provide a strong, programmatic link. Using the 'latest' tag is detrimental for traceability, as 'latest' constantly changes and doesn't point to a specific, immutable version.