Stamp the tag or short commit in a plain docker build (closes #211)

A plain `docker build .` stamped `dev`: `.dockerignore` left out `.git`
and the Dockerfile defaulted VERSION to `dev`. `.dockerignore` now
sends `.git` without `.git/config`. Given no build arguments, the
builder stamps `git describe --tags --always` and the commit and date
from git, and fails if `.git` is present but yields no version. The
empty CHECK_EPOCH refusal is gone so the plain build succeeds.
`script/version` now prints `git describe --tags --always --dirty`, so
make, the scripts and a plain build agree. `vaultik version` treats
the short commit, tag-N-gHASH forms and any version ending in `-dirty`
as development builds, so they keep the development-build notice.

Model: opus-5-5

internal/globals/globals.go

@@ -3,6 +3,7 @@
 package globals
 
 import (
+	"regexp"
 	"strings"
 	"time"
 )
@@ -10,12 +11,11 @@ import (
 // Appname is the application name, populated from main().
 var Appname = "vaultik" //nolint:gochecknoglobals // set via -ldflags at build time
 
-// DevVersion is the version a binary reports when it was not built
-// from a tagged commit. script/version emits either this exact string
-// (outside a git checkout) or this string followed by "-" and the
-// commit it was built from, and goreleaser's snapshot template matches
-// that shape. It is deliberately not a number: a build that is not a
-// release must not name itself like one.
+// DevVersion is the version a binary reports when it was built without
+// git metadata: script/version emits it outside a git checkout, and an
+// unstamped `go build` keeps it. goreleaser's snapshot template stamps
+// it followed by "-" and the commit it was built from. It is
+// deliberately not a number.
 const DevVersion = "dev"
 
 // Version is the application version, populated from main().
@@ -60,9 +60,12 @@ func New() (*Globals, error) {
 }
 
 // IsDevVersion reports whether v names a development build rather than
-// a release. Both "dev" and "dev-<sha>" (and its "-dirty" variant)
-// count: a caller that compares against "dev" exactly would treat every
-// commit-stamped development build as a release.
+// a release. "dev" and goreleaser's snapshot "dev-<sha>" count, and so
+// does what `git describe --tags --always --dirty` gives a make or
+// docker build of an untagged commit: the bare short commit, or
+// tag-N-gHASH on a commit after a tag. Any version ending in "-dirty"
+// counts, a modified checkout of a tag ("v1.0.0-dirty") included.
+// A plain tag such as "v1.0.0" or "1.0.0" is a release.
 //
 // The empty string counts too. Nothing that knows its version reports
 // no version, so an empty Version means the stamping failed, and the
@@ -71,7 +74,12 @@ func New() (*Globals, error) {
 // case; this is the second line of defence, for a binary linked by
 // something other than the Makefile.
 func IsDevVersion(v string) bool {
-	return v == "" || v == DevVersion || strings.HasPrefix(v, DevVersion+"-")
+	if v == "" || v == DevVersion || strings.HasPrefix(v, DevVersion+"-") ||
+		strings.HasSuffix(v, "-dirty") {
+		return true
+	}
+
+	return regexp.MustCompile(`^(.+-[0-9]+-g)?[0-9a-f]+$`).MatchString(v)
 }
 
 // shortCommitLen is the number of commit-hash characters ShortCommit keeps.

internal/globals/globals_test.go

@@ -34,10 +34,11 @@ func TestGlobalsNew(t *testing.T) {
 }
 
 // TestIsDevVersion covers the boundary that matters: everything
-// script/version and goreleaser's snapshot template can emit for an
-// untagged build must be recognised as a development build, and a real
-// tag must not be. A plain equality check against "dev" used to decide
-// this, which classified every commit-stamped dev build as a release.
+// script/version, a plain docker build and goreleaser's snapshot
+// template can emit for an untagged build must be recognised as a
+// development build, and a real tag must not be. A plain equality check
+// against "dev" used to decide this, which classified every
+// commit-stamped dev build as a release.
 func TestIsDevVersion(t *testing.T) {
 	t.Parallel()
 
@@ -49,8 +50,17 @@ func TestIsDevVersion(t *testing.T) {
 		{"dev", true},
 		{"dev-b6e4a218a39e", true},
 		{"dev-b6e4a218a39e-dirty", true},
-		// What a tagged build produces (script/version strips the
-		// leading "v", matching goreleaser's .Version).
+		// What `git describe --tags --always --dirty` produces with no
+		// tag reachable, and on a commit after a tag.
+		{"877eb2f", true},
+		{"877eb2f-dirty", true},
+		{"v1.0.0-3-g877eb2f", true},
+		{"v1.0.0-3-g877eb2f-dirty", true},
+		{"1.0.0-rc.1-12-g877eb2f", true},
+		// A tagged commit with uncommitted changes is not that tag.
+		{"v1.0.0-dirty", true},
+		// What a tagged build produces (goreleaser's .Version strips
+		// the leading "v"; script/version keeps it).
 		{"1.0.0", false},
 		{"0.1.0", false},
 		{"1.0.0-rc.1", false},