The command for running special source in buildtools, located in build data, should contain --stable which would make reproducible spigot builds. This could then follow into the build <rev>.json the jenkins run creates could contain that hash (using the LTS java version the game supports at the time). Which would allow for buildtools or regular users to make sure there spigot jar is the jar theyre expecting.