From 9c526620a9f2aaa8a195d5098066841fcc779040 Mon Sep 17 00:00:00 2001
From: sneak <sneak@sneak.berlin>
Date: Mon, 19 Oct 2026 05:26:20 +0000
Subject: [PATCH] script/build stamps lightweight tags too (closes #156)

When VERSION is unset or empty, script/build now takes the version from
`git describe --tags --always --dirty`, the form script/docker and
script/cibuild use. Without --tags it ignored lightweight tags, so a
binary from `make build` could report a commit where the image built
from the same tree reported the tag. README.md Entrypoints names the
same form.

Model: opus-5-5
---
 README.md    | 3 ++-
 TODO.md      | 6 ++++++
 script/build | 7 ++++---
 3 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/README.md b/README.md
index d2800df..6e2778e 100644
--- a/README.md
+++ b/README.md
@@ -55,7 +55,8 @@ either one is broken. We provide:
 - `script/build` — build the frontend for production into `dist/`, then the
   static `netwatch-server` binary into the repo root with its version stamped
   in: `VERSION` from the environment, or when that is unset or empty,
-  `git describe` inside a git checkout, then `dev`
+  `git describe --tags --always --dirty` inside a git checkout, as
+  `script/docker` does, then `dev`
 - `script/run` — build with `script/build`, then run `netwatch-server` with its
   defaults (see [Settings](#settings))
 - `script/clean` — remove what `script/build` writes
diff --git a/TODO.md b/TODO.md
index 02ddbb6..9f120e6 100644
--- a/TODO.md
+++ b/TODO.md
@@ -22,6 +22,12 @@ Run `make frontend-viewport-test` in CI as its own step; it is not part of
 
 # Completed Steps
 
+- 2026-10-19: when `VERSION` is unset or empty, `script/build` stamps the
+  version from `git describe --tags --always --dirty`, as `script/docker` does
+  ([#156](https://git.eeqj.de/sneak/netwatch/issues/156)). Without `--tags` it
+  skipped lightweight tags, so `make run` could report a commit where the image
+  built from the same tree reported the tag. Checked once with a lightweight tag
+  on a scratch clone: `make build` stamped it
 - 2026-10-19: `.dockerignore` keeps Go test binaries and coverage output at the
   root out of the build context, with `/*.test` and `/*.out` in the repository's
   own section ([#155](https://git.eeqj.de/sneak/netwatch/issues/155)). Such
diff --git a/script/build b/script/build
index 1c5ff4f..599369e 100755
--- a/script/build
+++ b/script/build
@@ -10,9 +10,10 @@ main() {
     cd "$ROOT"
     "$ROOT/script/yarn" build
 
-    # VERSION comes from the environment. Unset or empty, it is git
-    # describe, or "dev" where there is no git or no repository history.
-    version="${VERSION:-$(git describe --always --dirty 2>/dev/null || echo dev)}"
+    # VERSION comes from the environment. Unset or empty, it is
+    # `git describe --tags --always --dirty`, as in script/docker, or
+    # "dev" where there is no git or no repository history.
+    version="${VERSION:-$(git describe --tags --always --dirty 2>/dev/null || echo dev)}"
 
     CGO_ENABLED=0 go build -trimpath \
         -ldflags "-s -w -X main.Version=$version" \
-- 
2.54.0