Stamp the tag or short commit in a plain docker build (closes #211)

A plain `docker build .` stamped `dev`: `.dockerignore` left out `.git`
and the Dockerfile defaulted VERSION to `dev`. `.dockerignore` is now
the canonical one plus this repo's entries, sending `.git` without
`.git/config`. Given no build arguments, the builder stamps `git
describe --tags --always` and the commit and date from git, and fails
if `.git` is present but yields no version. The empty CHECK_EPOCH
refusal is gone so the plain build succeeds; the scripts still pass an
epoch. `script/version` now prints `git describe --tags --always
--dirty`, so make, the scripts and a plain build agree.

Model: opus-5-5

internal/globals/globals.go

@@ -10,12 +10,11 @@ import (
 // Appname is the application name, populated from main().
 var Appname = "vaultik" //nolint:gochecknoglobals // set via -ldflags at build time
 
-// DevVersion is the version a binary reports when it was not built
-// from a tagged commit. script/version emits either this exact string
-// (outside a git checkout) or this string followed by "-" and the
-// commit it was built from, and goreleaser's snapshot template matches
-// that shape. It is deliberately not a number: a build that is not a
-// release must not name itself like one.
+// DevVersion is the version a binary reports when it was built without
+// git metadata: script/version emits it outside a git checkout, and an
+// unstamped `go build` keeps it. goreleaser's snapshot template stamps
+// it followed by "-" and the commit it was built from. It is
+// deliberately not a number.
 const DevVersion = "dev"
 
 // Version is the application version, populated from main().
@@ -60,9 +59,10 @@ func New() (*Globals, error) {
 }
 
 // IsDevVersion reports whether v names a development build rather than
-// a release. Both "dev" and "dev-<sha>" (and its "-dirty" variant)
-// count: a caller that compares against "dev" exactly would treat every
-// commit-stamped development build as a release.
+// a release. Both "dev" and goreleaser's snapshot "dev-<sha>" count. A
+// make or docker build of an untagged commit reports `git describe`
+// output instead (the short commit, or tag-N-gHASH), which this does
+// not recognise.
 //
 // The empty string counts too. Nothing that knows its version reports
 // no version, so an empty Version means the stamping failed, and the

internal/globals/globals_test.go

@@ -34,9 +34,9 @@ func TestGlobalsNew(t *testing.T) {
 }
 
 // TestIsDevVersion covers the boundary that matters: everything
-// script/version and goreleaser's snapshot template can emit for an
-// untagged build must be recognised as a development build, and a real
-// tag must not be. A plain equality check against "dev" used to decide
+// goreleaser's snapshot template, and script/version outside a git
+// checkout, can emit must be recognised as a development build, and a
+// real tag must not be. A plain equality check against "dev" used to decide
 // this, which classified every commit-stamped dev build as a release.
 func TestIsDevVersion(t *testing.T) {
 	t.Parallel()
@@ -49,8 +49,8 @@ func TestIsDevVersion(t *testing.T) {
 		{"dev", true},
 		{"dev-b6e4a218a39e", true},
 		{"dev-b6e4a218a39e-dirty", true},
-		// What a tagged build produces (script/version strips the
-		// leading "v", matching goreleaser's .Version).
+		// What a tagged build produces (goreleaser's .Version strips
+		// the leading "v"; script/version keeps it).
 		{"1.0.0", false},
 		{"0.1.0", false},
 		{"1.0.0-rc.1", false},