From @LincolnBryant,
When an image is published to Harbor, part of the metadata includes:
LABEL org.opencontainers.image.version="X.Y.Z"
Adding a tag in Git to the master commit that provided the image source would make it easier to audit what source generated what image later down the line.