Fetch history and tags in the canonical workflow (closes #110)

The policy said a repository whose version comes from git tags needs `fetch-depth: 0` on its CI checkout, because the checkout action clones shallow with no tags; every repository's version comes from `git describe --tags --always`, but the canonical `.gitea/workflows/check.yml` did not set it, so CI stamped a bare short commit id where a local build of a tagged repository stamps the tag. The checkout step now sets `fetch-depth: 0` with a one-line comment, and the workflow bullet of `prompts/REPO_POLICIES.md` and both checklists name it beside `persist-credentials: false` and the `concurrency` block, as part of what the workflow does.

Unverified: a live run, which waits on the shared runner.

Model: opus-5-5

.gitea/workflows/check.yml

@@ -13,4 +13,6 @@ jobs:
               # script/cibuild needs no token, so none is left in .git/config.
               with:
                   persist-credentials: false
+                  # All history and tags, so git describe finds the version tag.
+                  fetch-depth: 0
             - run: script/cibuild

TODO.md

@@ -21,6 +21,14 @@ fmt-check, and commit.
 
 # Completed Steps
 
+- 2026-10-06: The canonical `.gitea/workflows/check.yml` now sets
+  `fetch-depth: 0` on its checkout step (issue 110), so CI fetches the history
+  and tags that `git describe --tags --always` needs, and a tagged repository
+  stamps the same version in CI as in a local build. `REPO_POLICIES.md` and both
+  checklists name `fetch-depth: 0` among what the workflow does, next to
+  `persist-credentials: false` and the `concurrency` block, instead of asking
+  each tagged repository to add it. Not yet tried on the shared runner, which is
+  out of disk space. Repositories pick this up on their next re-vendor.
 - 2026-10-06: The canonical `script/bootstrap` now runs `apt-get update` once,
   before the first `apt-get install` of a run (issue 115). The Gitea runner
   image starts with empty package lists, so installing anything it lacks, such

prompts/EXISTING_REPO_CHECKLIST.md

@@ -96,13 +96,15 @@ with your task.
       directory outside the build context, so the build cannot read the version
       and a plain `docker build .` fails; pass the version with
       `--build-arg VERSION=...`. `script/docker` and `script/cibuild` already
-      pass the version they compute on the host; it takes precedence. A
+      pass the version they compute on the host; it takes precedence. The
-      tag-derived version additionally needs `fetch-depth: 0` on the CI checkout
+      canonical `.gitea/workflows/check.yml` sets `fetch-depth: 0` on its
-      step, which clones shallow and fetches no tags by default.
+      checkout step, which otherwise clones shallow and fetches no tags, so a CI
+      build finds the tag too.
 - [ ] Gitea Actions workflow in `.gitea/workflows/` runs `script/cibuild` on
-      push, checks out with `persist-credentials: false`, and carries the
+      push, checks out with `persist-credentials: false` and with
-      `concurrency` block that lets a new push cancel only the same branch's
+      `fetch-depth: 0` (which fetches the tags `git describe` needs), and
-      older run — reference
+      carries the `concurrency` block that lets a new push cancel only the same
+      branch's older run — reference
       `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitea/workflows/check.yml`
 - [ ] Language-specific config:
     - [ ] Go: `go.mod`, `go.sum`, `.golangci.yml` (fetch from

prompts/NEW_REPO_CHECKLIST.md

@@ -112,9 +112,10 @@ Template files can be fetched from:
     - Non-server: the final stage brings up the dev environment
     - Image pinned by sha256 hash with version/date comment
 - [ ] Gitea Actions workflow at `.gitea/workflows/check.yml` that runs
-      `script/cibuild` on push, checks out with `persist-credentials: false`,
+      `script/cibuild` on push, checks out with `persist-credentials: false` and
-      and carries the `concurrency` block that lets a new push cancel only the
+      with `fetch-depth: 0` (which fetches the tags `git describe` needs), and
-      same branch's older run — reference
+      carries the `concurrency` block that lets a new push cancel only the same
+      branch's older run — reference
       `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitea/workflows/check.yml`
 - [ ] Language-specific:
     - [ ] Go: `go mod init sneak.berlin/go/<name>`, `.golangci.yml` (fetch from

prompts/REPO_POLICIES.md

@@ -292,7 +292,10 @@ style conventions are in separate documents:
   runs `script/cibuild` on push, and checks out the repo as its only other step,
   with `persist-credentials: false`: `script/cibuild` needs no token, and
   without it the checkout leaves the job's token in `.git/config` for every
-  later step. Its `concurrency` block groups runs by workflow and branch
+  later step. The checkout step also sets `fetch-depth: 0`, which fetches the
+  tags `git describe` needs: by default it clones shallow with no tags, and a
+  tagged repository's CI build would stamp a bare short commit id. The
+  workflow's `concurrency` block groups runs by workflow and branch
   (`${{ github.workflow }}-${{ github.ref }}`) with `cancel-in-progress: true`,
   so a new push cancels the older run on the same branch, queued or running, and
   no other: runs for replaced commits do not hold up the shared runner.
@@ -472,8 +475,8 @@ style conventions are in separate documents:
     there because `ARG` is stage-scoped; passing `VERSION` to a repo whose
     Dockerfile declares no such `ARG` is ignored and costs nothing, which is why
     the scripts stay byte-identical. One consequence for CI: the standard
-    checkout action clones shallow and fetches no tags, so a repo that embeds a
+    checkout action clones shallow and fetches no tags, so the canonical
-    tag-derived version must set `fetch-depth: 0` on its checkout step.
+    `.gitea/workflows/check.yml` sets `fetch-depth: 0` on its checkout step.
 
 - **Verify `.dockerignore` by enumerating the image, not by reading the
   patterns.** Plant files at the root _and_ at least two directories deep, build