Is there an easy way to get at the current git SHA of the repository containing my Pulumi code (such as is displayed in the web UI) from within my JS code? I’d like to use it to tag docker containers as well.

You can shell out to

git

or use a JS git library from within your program.