3 Commits

Include renames

Author	SHA1	Message	Date
sneak	8744e971b2	Label the commit date "commit date" in version and banner (closes #409) ... The value is the commit's date, which the Makefile and the Dockerfile stamp in, not the time of the build. `vaultik version` labelled it "build date" and the startup banner "built on". The other version labels gain one space so every value still starts in one column. The tests give the commit and the commit date different values, since the test binary is not stamped and holds "unknown" in both. Model: opus-5-5	2026-11-10 20:58:06 +00:00
clawbot	eed117fe25	Route direct-stdout command output through internal/ui (closes #149) ... version, info, remote info, config, and database delete wrote plain text straight to stdout, so they were unstyled and ignored --quiet. Output is now governed by internal/ui in two buckets. Status lines and confirmations (config init, config set, the database delete prompt) go through the ui message methods and are silenced by --quiet. The data a command exists to produce is written plain -- the version/info/remote-info reports, the snapshot list table, config get values, and the --json documents -- and is never suppressed, since a script depends on it and a marker would corrupt a table or document. The database delete confirmation prompt is always shown. Pure-cli commands reach ui through a small commandUI helper. Model: opus-4-8	2026-09-22 20:28:50 +02:00
clawbot	e3f407b440	Make the tagged-release path work on Gitea (closes #65) ... No tag could be cut at all: .goreleaser.yaml had no gitea_urls block, so goreleaser defaulted to the GitHub API, and the repo has zero tags. .goreleaser.yaml now points at git.eeqj.de. Version derives from git via a new script/version - exact tag with any leading v stripped, else dev-<12-char sha>, with a -dirty suffix when tracked files are modified - replacing the hardcoded 1.0.0-rc.1 that every local build was stamping regardless of git state. A tag-triggered .gitea/workflows/release.yml runs goreleaser with a scoped token (RELEASE_TOKEN); script/bootstrap installs a sha256-verified goreleaser, and make release / release-snapshot become script shims like every other target. Two fabrications were removed rather than merely replaced. goreleaser's snapshot.version_template was `{{ incpatch .Version }}-next`, which invents a release number from the last tag - and with no tags, from goreleaser's own fabricated v0.0.0. And internal/cli/version.go gated its development-build notice on Version == "dev" exactly, so the moment untagged builds carried a sha that notice would have gone silent and an unreleased binary would have read as a release. Replaced with a tested IsDevVersion predicate, and closed at both layers: the Makefile now refuses to build when script/version yields nothing, and an empty version counts as a development build - reachable today via `docker build --build-arg VERSION=`. The release workflow installs Go from a sha-pinned actions/setup-go (v5.6.0) using go-version-file, so the compiler that produces released binaries is pinned like every other external reference. Without it the first tag push would either fail at goreleaser's before-hook or compile the published artifacts with whatever unpinned Go the runner happened to carry - the one unpinned thing in a release path that already refuses an unpinned goreleaser. Known gap: the Go tarball setup-go fetches is version-pinned but not checksum-verified against a value in this repo, unlike the goreleaser install and the Dockerfile digest.	2026-08-09 18:03:18 +02:00