Stamp the git tag or short commit in a plain docker build (closes #67)

.dockerignore now sends .git, without .git/config, which can hold a credential. The build stage takes the VERSION build argument when one is given, otherwise git describe --tags --always of that .git, and fails if the context carries .git and still yields no version. A plain docker build . used to stamp dev. The CI checkout fetches full history so CI sees the tag and stamps the same value as make build. Model: opus-5-5
2026-10-02 08:49:03 +02:00
parent c737490a53
commit c9bf22d483
5 changed files with 36 additions and 6 deletions
@@ -16,10 +16,10 @@
 # implies the repo is green.
 #
 # That implication holds only because of CHECK_EPOCH. A COPY layer is
-# invalidated by changed content, and a merge commit's tree is
-# byte-identical to the branch head it merges, so without a fresh value
-# here Docker serves the gate layers from cache and the build reports a
-# green it never earned. Passing the current epoch invalidates the gate
+# invalidated only by changed content, and a rebuild of an unchanged
+# checkout sends the same content, so without a fresh value here Docker
+# serves the gate layers from cache and the build reports a green it
+# never earned. Passing the current epoch invalidates the gate
 # layers on every run while leaving the pinned base images and
 # go mod download cached; see the Dockerfile for the placement.
 set -eu