I see commit hashes used all the time, like in yocto recipes for example