Pin Nomad artifact to deployed commit

.forgejo/workflows/deploy.yml

@@ -79,7 +79,17 @@ jobs:
             --retry-all-errors \
             -H "X-Nomad-Token: $NOMAD_TOKEN" \
             "$NOMAD_ADDR/v1/job/familyfed" \
-            | jq '(.TaskGroups[].Tasks[].Env //= {}) | .TaskGroups[].Tasks[].Env.DEPLOY_COMMIT = env.DEPLOY_COMMIT | {Job: .}' \
+            | jq '
+                (.TaskGroups[].Tasks[].Env //= {})
+                | .TaskGroups[].Tasks[].Env.DEPLOY_COMMIT = env.DEPLOY_COMMIT
+                | (.TaskGroups[].Tasks[].Artifacts[]?.GetterSource |=
+                    if startswith("git::") and test("[?&]ref=") then
+                      sub("ref=[^&]*"; "ref=" + env.DEPLOY_COMMIT)
+                    elif startswith("git::") then
+                      . + (if contains("?") then "&" else "?" end) + "ref=" + env.DEPLOY_COMMIT
+                    else . end)
+                | {Job: .}
+              ' \
             > /tmp/familyfed-job.json
 
           curl -fsS -X POST \