Bake git provenance into Modal images via env vars

.git is intentionally excluded from Modal images (size + cache
invalidation). Capture GIT_COMMIT/GIT_BRANCH at image build time
(locally) and bake via .env(). get_git_provenance() falls back to
these env vars when git commands fail inside containers.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: baogorek

modal_app/local_area.py

@@ -13,6 +13,7 @@
 
 import os
 import subprocess
+import subprocess as _sp
 import json
 import modal
 from pathlib import Path
@@ -34,6 +35,24 @@
 )
 
 _REPO_ROOT = Path(__file__).resolve().parent.parent
+
+_GIT_ENV = {}
+try:
+    _GIT_ENV["GIT_COMMIT"] = (
+        _sp.check_output(["git", "rev-parse", "HEAD"], stderr=_sp.DEVNULL)
+        .decode()
+        .strip()
+    )
+    _GIT_ENV["GIT_BRANCH"] = (
+        _sp.check_output(
+            ["git", "rev-parse", "--abbrev-ref", "HEAD"], stderr=_sp.DEVNULL
+        )
+        .decode()
+        .strip()
+    )
+except Exception:
+    pass
+
 _IGNORE = [
     ".git",
     "__pycache__",
@@ -60,6 +79,7 @@
         copy=True,
         ignore=_IGNORE,
     )
+    .env(_GIT_ENV)
     .run_commands(
         "cd /root/policyengine-us-data && UV_HTTP_TIMEOUT=300 uv sync --frozen"
     )

modal_app/pipeline.py

@@ -44,6 +44,7 @@
 from typing import Optional
 
 import modal
+import subprocess as _sp
 
 # ── Modal resources ──────────────────────────────────────────────
 
@@ -56,6 +57,24 @@
 staging_volume = modal.Volume.from_name("local-area-staging", create_if_missing=True)
 
 _REPO_ROOT = Path(__file__).resolve().parent.parent
+
+_GIT_ENV = {}
+try:
+    _GIT_ENV["GIT_COMMIT"] = (
+        _sp.check_output(["git", "rev-parse", "HEAD"], stderr=_sp.DEVNULL)
+        .decode()
+        .strip()
+    )
+    _GIT_ENV["GIT_BRANCH"] = (
+        _sp.check_output(
+            ["git", "rev-parse", "--abbrev-ref", "HEAD"], stderr=_sp.DEVNULL
+        )
+        .decode()
+        .strip()
+    )
+except Exception:
+    pass
+
 _IGNORE = [
     ".git",
     "__pycache__",
@@ -82,6 +101,7 @@
         copy=True,
         ignore=_IGNORE,
     )
+    .env(_GIT_ENV)
     .run_commands(
         "cd /root/policyengine-us-data && UV_HTTP_TIMEOUT=300 uv sync --frozen"
     )

modal_app/remote_calibration_runner.py

@@ -1,5 +1,6 @@
 import os
 import subprocess
+import subprocess as _sp
 import modal
 
 app = modal.App("policyengine-us-data-fit-weights")
@@ -10,6 +11,24 @@
 from pathlib import Path
 
 _REPO_ROOT = Path(__file__).resolve().parent.parent
+
+_GIT_ENV = {}
+try:
+    _GIT_ENV["GIT_COMMIT"] = (
+        _sp.check_output(["git", "rev-parse", "HEAD"], stderr=_sp.DEVNULL)
+        .decode()
+        .strip()
+    )
+    _GIT_ENV["GIT_BRANCH"] = (
+        _sp.check_output(
+            ["git", "rev-parse", "--abbrev-ref", "HEAD"], stderr=_sp.DEVNULL
+        )
+        .decode()
+        .strip()
+    )
+except Exception:
+    pass
+
 _IGNORE = [
     ".git",
     "__pycache__",
@@ -36,6 +55,7 @@
         copy=True,
         ignore=_IGNORE,
     )
+    .env(_GIT_ENV)
     .run_commands(
         "cd /root/policyengine-us-data && "
         "UV_HTTP_TIMEOUT=300 uv sync --frozen --extra l0"

policyengine_us_data/calibration/unified_calibration.py

@@ -97,6 +97,12 @@ def get_git_provenance() -> dict:
         info["git_dirty"] = len(porcelain) > 0
     except Exception:
         pass
+    import os
+
+    if not info["git_commit"]:
+        info["git_commit"] = os.environ.get("GIT_COMMIT")
+    if not info["git_branch"]:
+        info["git_branch"] = os.environ.get("GIT_BRANCH")
     try:
         from policyengine_us_data.__version__ import __version__