Stamp the tag or short commit in a plain docker build (closes #112)

.dockerignore now sends .git but not .git/config, which can hold a
credential and which git describe does not need. The build stage stamps
main.Gitrev from the VERSION build argument when one is given, otherwise
from git describe --tags --always, and fails if .git is present and no
version comes out. git there trusts /src whoever owns it, since a
context sent as a tar archive keeps its files' owners. script/docker is
replaced by the canonical copy, which passes VERSION; bin/gitrev.sh uses
--tags too, so every entrypoint stamps the same value for a clean
commit.

Model: opus-5-5

Dockerfile

@@ -48,7 +48,26 @@ COPY . .
 RUN touch mfer/mf.pb.go
 
 RUN make test
-RUN cd cmd/mfer && go build -tags urfave_cli_no_docs -o /mfer .
+
+# A build context sent as a tar archive, as upaas sends it, keeps its files'
+# owners, and git refuses to read a checkout owned by another user.
+RUN git config --system --add safe.directory /src
+
+# The revision `mfer version` prints, stamped into main.Gitrev: the VERSION
+# build argument when one is given (script/docker passes one), otherwise
+# `git describe --tags --always` of the .git the build context carries: the
+# tag on a tagged commit, tag-N-gHASH on a commit after one, the short commit
+# when no tag is reachable. git ships in this base image. A context that
+# carries .git and still yields no version fails the build.
+ARG VERSION
+RUN version="${VERSION:-$(git describe --tags --always)}"; \
+    if [ -e .git ] && { [ -z "$version" ] || [ "$version" = dev ] || \
+        [ "$version" = unknown ]; }; then \
+        echo "no version could be derived although the build context carries .git" >&2; \
+        exit 1; \
+    fi; \
+    cd cmd/mfer && \
+    go build -tags urfave_cli_no_docs -ldflags "-X main.Gitrev=$version" -o /mfer .
 
 FROM scratch
 COPY --from=builder /mfer /mfer