is there a way to set a docker's tag to current commit SHA hermetically? i.e. without relying on an external env var, such as

GIT_COMMIT

. Ideally, some pants hook would run

$(git rev-parse HEAD)

and inject the output as build_arg.

Not today https://github.com/pantsbuild/pants/issues/19981