Stamp the tag or short commit in a plain docker build (closes #211)

A plain `docker build .` stamped `dev`: `.dockerignore` left out `.git`
and the Dockerfile defaulted VERSION to `dev`. `.dockerignore` now
sends `.git` without `.git/config`. Given no build arguments, the
builder stamps `git describe --tags --always` and the commit and date
from git, and fails if `.git` is present but yields no version. The
empty CHECK_EPOCH refusal is gone so the plain build succeeds.
`script/version` now prints `git describe --tags --always --dirty`, so
make, the scripts and a plain build agree. `vaultik version` treats
the short commit, tag-N-gHASH forms and any version ending in `-dirty`
as development builds, so they keep the development-build notice.

Model: opus-5-5

script/cibuild

@@ -24,9 +24,11 @@ main() {
     # value is what forces those layers to re-run: without it an
     # unchanged tree replays them from cache, the checks never execute,
     # and the build still exits 0. Each ARG sits immediately above the
-    # check RUNs, so dependency and module layers still cache. Both
-    # Dockerfiles also refuse to build at all when CHECK_EPOCH is empty,
-    # so a missing value fails loudly here rather than passing quietly.
+    # check RUNs, so dependency and module layers still cache.
+    # Dockerfile.lint also refuses to build at all when CHECK_EPOCH is
+    # empty, so a missing value fails its build loudly rather than passing
+    # quietly; the product Dockerfile does not, because a plain `docker
+    # build .` must succeed.
     #
     # The value must be unique per invocation, not per second. `date +%s`
     # is second-granular, so two concurrent invocations in the same
@@ -57,12 +59,10 @@ main() {
         --build-arg CHECK_EPOCH="$epoch" -f Dockerfile.lint .
 
     # Version, commit and build date are computed here on the host, the
-    # same way script/docker does, and passed into the product build so
-    # the CI-built image reports its real source. The build context
-    # excludes .git (see .dockerignore), so the build cannot derive them
-    # itself; without these it would stamp the Dockerfile's dev/unknown
-    # fallbacks. VERSION comes from script/version, the source of truth
-    # shared with the Makefile.
+    # same way script/docker does, and passed into the product build,
+    # where they take precedence over what the build would derive from
+    # the .git in its context. VERSION comes from script/version, as in
+    # the Makefile.
     version="$("$ROOT/script/version")"
     commit="$(git rev-parse HEAD 2>/dev/null || echo unknown)"
     commit_date="$(git show -s --format=%cs HEAD 2>/dev/null || echo unknown)"

script/docker

@@ -1,7 +1,8 @@
 #!/bin/sh
 # script/docker: build the Docker image tagged with the project name.
-# Identical in all repos; the tag comes from script/projectname.
-# Generic: needs no adaptation.
+# The tag comes from script/projectname. Unlike the canonical copy in
+# sneak/prompts, it passes a fresh CHECK_EPOCH instead of --no-cache, and
+# COMMIT and COMMIT_DATE as well as VERSION.
 #
 # This builds the PRODUCT image only, and the product Dockerfile has no
 # lint stage: linting lives in Dockerfile.lint and is run by
@@ -21,19 +22,15 @@ main() {
     # comments there. This script is not the CI gate, but a local build
     # is almost always warm, so without this it would report a green the
     # tree had not earned and the two entrypoints would disagree about
-    # whether the tree is clean. The Dockerfile now refuses to build
-    # without a non-empty value, so this is required, not optional.
+    # whether the tree is clean.
     epoch="$(date +%s%N)$$"
 
-    # Version, commit and build date are computed here on the host,
-    # where .git exists, and passed into the build. The build context
-    # excludes .git (see .dockerignore), so the container cannot derive
-    # them itself -- it used to try and always got "unknown", giving
-    # every image a "commit: unknown" it could not be traced from.
-    # VERSION comes from script/version, the source of truth shared with
-    # the Makefile, so a Docker build reports the same string (tag,
-    # dev-<sha>, or a -dirty variant) that a local build of the same
-    # tree would.
+    # Version, commit and build date are computed here on the host and
+    # passed into the build, where they take precedence over what the
+    # build would derive from the .git in its context. VERSION comes
+    # from script/version, as in the Makefile, so the image reports the
+    # same string, -dirty included, that a local build of the same tree
+    # would.
     version="$("$SCRIPT_DIR/version")"
     commit="$(git rev-parse HEAD 2>/dev/null || echo unknown)"
     commit_date="$(git show -s --format=%cs HEAD 2>/dev/null || echo unknown)"

script/version

@@ -1,73 +1,29 @@
 #!/bin/sh
 # script/version: output the version string to bake into the binary.
-# Our own extension to scripts-to-rule-them-all, and the single source
-# of truth for the version: the Makefile's LDFLAGS call this rather
-# than carrying a hardcoded constant, which is what used to make every
-# local build claim to be 1.0.0-rc.1 regardless of git state.
+# Our own extension to scripts-to-rule-them-all. The Makefile's LDFLAGS
+# call this rather than carrying a hardcoded constant, which is what used
+# to make every local build claim to be 1.0.0-rc.1 regardless of git
+# state. script/docker and script/cibuild pass its output to the image
+# build; given no version, the image build runs `git describe --tags
+# --always` itself, without `--dirty`.
 #
-# The rules, in order:
+# The version is `git describe --tags --always --dirty`: the tag on a
+# tagged commit, tag-N-gHASH on a commit after one, the short commit
+# when no tag is reachable, each with a "-dirty" suffix when tracked
+# files have uncommitted changes. Untracked files are ignored: a stray
+# scratch file does not change what was compiled. Outside a git checkout
+# (release tarball, `go install`), or in one with no commits, it is
+# "dev".
 #
-#   HEAD is exactly on an annotated or lightweight tag
-#       -> that tag, with a leading "v" stripped
-#   anything else
-#       -> "dev-<12 chars of HEAD>"
-#   not a git checkout at all (release tarball, `go install`)
-#       -> "dev"
-#
-# Either of the first two gains a "-dirty" suffix when tracked files
-# have uncommitted changes, because a modified checkout of v1.0.0 is
-# not v1.0.0. Untracked files are ignored, matching `git describe
-# --dirty`: a stray scratch file does not change what was compiled.
-#
-# The "v" is stripped so that a `make` build and a goreleaser build of
-# the same tagged commit report the *same* string: goreleaser's
-# {{ .Version }} is the tag without the prefix, and the release archive
-# names are built from it. A tag named `v1.0.0` therefore produces
-# `vaultik 1.0.0`, matching `vaultik_1.0.0_linux_amd64.tar.gz`.
-#
-# Nothing here ever invents a version number. An untagged build says so
-# and names the commit it was built from; it does not round up to the
-# nearest plausible release.
+# Nothing here ever invents a version number.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
-# Length of the commit prefix in a dev version. Matches
-# globals.ShortCommit, so `vaultik version` shows the same 12 chars in
-# its version line and its commit line.
-SHORT_LEN=12
-
 main() {
     cd "$ROOT"
-
-    if ! git rev-parse --git-dir >/dev/null 2>&1; then
-        echo "dev"
-        return 0
-    fi
-
-    dirty=""
-    if [ -n "$(git status --porcelain --untracked-files=no 2>/dev/null)" ]; then
-        dirty="-dirty"
-    fi
-
-    # --exact-match so a *descendant* of a tag is not reported as that
-    # tag. Plain `git describe --tags` would call a commit 40 patches
-    # past v1.0.0 "v1.0.0-40-gabc1234", and the leading token of that is
-    # a released version the build is not.
-    tag="$(git describe --tags --exact-match HEAD 2>/dev/null || true)"
-    if [ -n "$tag" ]; then
-        echo "${tag#v}${dirty}"
-        return 0
-    fi
-
-    sha="$(git rev-parse "--short=$SHORT_LEN" HEAD 2>/dev/null || true)"
-    if [ -z "$sha" ]; then
-        # A repo with no commits at all.
-        echo "dev"
-        return 0
-    fi
-
-    echo "dev-${sha}${dirty}"
+    version="$(git describe --tags --always --dirty 2>/dev/null || true)"
+    echo "${version:-dev}"
 }
 
 main "$@"