Fetch history and tags in the canonical workflow (closes #110)

The checkout step of the canonical `.gitea/workflows/check.yml` now sets `fetch-depth: 0`, with a one-line comment saying why. The checkout action otherwise clones shallow with no tags, so `git describe --tags --always` gave a bare short commit id in CI where a local build of a tagged repository gives the tag. `REPO_POLICIES.md` and the existing repo checklist told each tagged repository to add it itself, which a byte-identical re-vendor would remove; they now say the canonical file sets it.

Unverified: the live check, which waits on the shared runner.

Model: opus-5-5

TODO.md

@@ -24,25 +24,10 @@ fmt-check, and commit.
 - 2026-10-06: The canonical `.gitea/workflows/check.yml` now sets
   `fetch-depth: 0` on its checkout step (issue 110), so CI fetches the history
   and tags that `git describe --tags --always` needs, and a tagged repository
-  stamps the same version in CI as in a local build. `REPO_POLICIES.md` and both
+  stamps the same version in CI as in a local build. `REPO_POLICIES.md` and the
-  checklists name `fetch-depth: 0` among what the workflow does, next to
+  existing repo checklist now say the canonical file sets it, instead of asking
-  `persist-credentials: false` and the `concurrency` block, instead of asking
+  each repository to add it. Not yet tried on the shared runner, which is out of
-  each tagged repository to add it. Not yet tried on the shared runner, which is
+  disk space. Repositories pick this up on their next re-vendor.
-  out of disk space. Repositories pick this up on their next re-vendor.
-- 2026-10-06: The canonical `script/bootstrap` now runs `apt-get update` once,
-  before the first `apt-get install` of a run (issue 115). The Gitea runner
-  image starts with empty package lists, so installing anything it lacks, such
-  as Go, failed with `Unable to locate package`. A repository's own section no
-  longer needs a refresh of its own; `sneak/bsfirehose` and `sneak/dnswatcher`
-  drop theirs at their next re-vendor.
-- 2026-10-06: `REPO_POLICIES.md` and both checklists now say that a checkout
-  whose `.git` is a file, a linked worktree or a repository checked out as a
-  submodule, is the exception to a plain `docker build .` succeeding (issue
-  111): that file points to a git directory outside the build context, so the
-  build cannot read the version and the version check in the canonical
-  `Dockerfile` stops it. Such a build is given its version with
-  `--build-arg VERSION=...`, as `script/docker` and `script/cibuild` already do.
-  The check itself is unchanged.
 - 2026-10-06: The canonical `.gitea/workflows/check.yml` now has a `concurrency`
   block, so a new push cancels the older run on the same branch and no other,
   and its checkout step sets `persist-credentials: false`, so the job's token is

prompts/EXISTING_REPO_CHECKLIST.md

@@ -91,20 +91,14 @@ with your task.
       version still comes out empty, `dev` or `unknown`. A plain
       `docker build .` with no build arguments must succeed; a Dockerfile that
       refuses an empty build argument drops that refusal and keeps the argument.
-      A checkout whose `.git` is a file (a linked worktree, or a repository
+      `script/docker` and `script/cibuild` pass the version they compute on the
-      checked out as a submodule) is the exception: that file points to a git
+      host; it takes precedence. The canonical `.gitea/workflows/check.yml` sets
-      directory outside the build context, so the build cannot read the version
+      `fetch-depth: 0` on its checkout step, which otherwise clones shallow and
-      and a plain `docker build .` fails; pass the version with
+      fetches no tags, so a CI build finds the tag too.
-      `--build-arg VERSION=...`. `script/docker` and `script/cibuild` already
-      pass the version they compute on the host; it takes precedence. The
-      canonical `.gitea/workflows/check.yml` sets `fetch-depth: 0` on its
-      checkout step, which otherwise clones shallow and fetches no tags, so a CI
-      build finds the tag too.
 - [ ] Gitea Actions workflow in `.gitea/workflows/` runs `script/cibuild` on
-      push, checks out with `persist-credentials: false` and with
+      push, checks out with `persist-credentials: false`, and carries the
-      `fetch-depth: 0` (which fetches the tags `git describe` needs), and
+      `concurrency` block that lets a new push cancel only the same branch's
-      carries the `concurrency` block that lets a new push cancel only the same
+      older run — reference
-      branch's older run — reference
       `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitea/workflows/check.yml`
 - [ ] Language-specific config:
     - [ ] Go: `go.mod`, `go.sum`, `.golangci.yml` (fetch from

prompts/NEW_REPO_CHECKLIST.md

@@ -97,12 +97,6 @@ Template files can be fetched from:
       version still comes out empty, `dev` or `unknown`. A plain
       `docker build .` with no build arguments must succeed; a Dockerfile that
       refuses an empty build argument drops that refusal and keeps the argument.
-      A checkout whose `.git` is a file (a linked worktree, or a repository
-      checked out as a submodule) is the exception: that file points to a git
-      directory outside the build context, so the build cannot read the version
-      and a plain `docker build .` fails; pass the version with
-      `--build-arg VERSION=...`, as `script/docker` and `script/cibuild` already
-      do.
     - The Dockerfile carries a `lint` phase and a `test` phase, each invoking
       its tool directly rather than through `make` or `script/`, and the final
       stage carries a `COPY --from=` of a harmless file from each so the image
@@ -112,10 +106,9 @@ Template files can be fetched from:
     - Non-server: the final stage brings up the dev environment
     - Image pinned by sha256 hash with version/date comment
 - [ ] Gitea Actions workflow at `.gitea/workflows/check.yml` that runs
-      `script/cibuild` on push, checks out with `persist-credentials: false` and
+      `script/cibuild` on push, checks out with `persist-credentials: false`,
-      with `fetch-depth: 0` (which fetches the tags `git describe` needs), and
+      and carries the `concurrency` block that lets a new push cancel only the
-      carries the `concurrency` block that lets a new push cancel only the same
+      same branch's older run — reference
-      branch's older run — reference
       `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitea/workflows/check.yml`
 - [ ] Language-specific:
     - [ ] Go: `go mod init sneak.berlin/go/<name>`, `.golangci.yml` (fetch from

prompts/REPO_POLICIES.md

@@ -281,21 +281,12 @@ style conventions are in separate documents:
       `.git` and the version still comes out empty, `dev` or `unknown`. A plain
       `docker build .` with no build arguments must succeed; a Dockerfile that
       refuses an empty build argument drops that refusal and keeps the argument.
-      A checkout whose `.git` is a file (a linked worktree, or a repository
-      checked out as a submodule) is the exception: that file points to a git
-      directory outside the build context, so the build cannot read the version
-      and a plain `docker build .` fails; pass the version with
-      `--build-arg VERSION=...`, as `script/docker` and `script/cibuild` already
-      do.
 
 - Every repo should have a Gitea Actions workflow (`.gitea/workflows/`) that
   runs `script/cibuild` on push, and checks out the repo as its only other step,
   with `persist-credentials: false`: `script/cibuild` needs no token, and
   without it the checkout leaves the job's token in `.git/config` for every
-  later step. The checkout step also sets `fetch-depth: 0`, which fetches the
+  later step. Its `concurrency` block groups runs by workflow and branch
-  tags `git describe` needs: by default it clones shallow with no tags, and a
-  tagged repository's CI build would stamp a bare short commit id. The
-  workflow's `concurrency` block groups runs by workflow and branch
   (`${{ github.workflow }}-${{ github.ref }}`) with `cancel-in-progress: true`,
   so a new push cancels the older run on the same branch, queued or running, and
   no other: runs for replaced commits do not hold up the shared runner.

script/bootstrap

@@ -19,7 +19,6 @@ YARN_VERSION="1.22.22"
 
 PKGMGR=""
 SUDO=""
-APT_UPDATED=""
 
 detect_pkgmgr() {
     [ -n "$PKGMGR" ] && return 0
@@ -48,14 +47,7 @@ pkg_install() {
     detect_pkgmgr
     case "$PKGMGR" in
         nix) nix-env -iA "nixpkgs.$1" ;;
-        apt)
+        apt) $SUDO env DEBIAN_FRONTEND=noninteractive apt-get install -y "$2" ;;
-            # Package lists may be empty (fresh images); refresh once per run.
-            if [ -z "$APT_UPDATED" ]; then
-                $SUDO env DEBIAN_FRONTEND=noninteractive apt-get update
-                APT_UPDATED=1
-            fi
-            $SUDO env DEBIAN_FRONTEND=noninteractive apt-get install -y "$2"
-            ;;
         brew) brew install "$3" ;;
         apk) apk add --no-cache "$4" ;;
     esac