3 Commits

Include renames

Author	SHA1	Message	Date
clawbot	ca07a78990	Stamp the tag or short commit in a plain docker build (closes #211) ... A plain `docker build .` stamped `dev`: `.dockerignore` left out `.git` and the Dockerfile defaulted VERSION to `dev`. `.dockerignore` now sends `.git` without `.git/config`. Given no build arguments, the builder stamps `git describe --tags --always` and the commit and date from git, and fails if `.git` is present but yields no version. The empty CHECK_EPOCH refusal is gone so the plain build succeeds. `script/version` now prints `git describe --tags --always --dirty`, so make, the scripts and a plain build agree. `vaultik version` treats the short commit, tag-N-gHASH forms and any version ending in `-dirty` as development builds, so they keep the development-build notice. Model: opus-5-5	2026-10-02 07:22:20 +00:00
clawbot	e3f407b440	Make the tagged-release path work on Gitea (closes #65) ... No tag could be cut at all: .goreleaser.yaml had no gitea_urls block, so goreleaser defaulted to the GitHub API, and the repo has zero tags. .goreleaser.yaml now points at git.eeqj.de. Version derives from git via a new script/version - exact tag with any leading v stripped, else dev-<12-char sha>, with a -dirty suffix when tracked files are modified - replacing the hardcoded 1.0.0-rc.1 that every local build was stamping regardless of git state. A tag-triggered .gitea/workflows/release.yml runs goreleaser with a scoped token (RELEASE_TOKEN); script/bootstrap installs a sha256-verified goreleaser, and make release / release-snapshot become script shims like every other target. Two fabrications were removed rather than merely replaced. goreleaser's snapshot.version_template was `{{ incpatch .Version }}-next`, which invents a release number from the last tag - and with no tags, from goreleaser's own fabricated v0.0.0. And internal/cli/version.go gated its development-build notice on Version == "dev" exactly, so the moment untagged builds carried a sha that notice would have gone silent and an unreleased binary would have read as a release. Replaced with a tested IsDevVersion predicate, and closed at both layers: the Makefile now refuses to build when script/version yields nothing, and an empty version counts as a development build - reachable today via `docker build --build-arg VERSION=`. The release workflow installs Go from a sha-pinned actions/setup-go (v5.6.0) using go-version-file, so the compiler that produces released binaries is pinned like every other external reference. Without it the first tag push would either fail at goreleaser's before-hook or compile the published artifacts with whatever unpinned Go the runner happened to carry - the one unpinned thing in a release path that already refuses an unpinned goreleaser. Known gap: the Go tarball setup-go fetches is version-pinned but not checksum-verified against a value in this repo, unlike the goreleaser install and the Dockerfile digest.	2026-08-09 18:03:18 +02:00
4 people	c24e7e6360	Add make check target and CI workflow (#42) ... Adds a `make check` target that verifies formatting (gofmt), linting (golangci-lint), and tests (go test -race) without modifying files. Also adds `.gitea/workflows/check.yml` CI workflow that runs on pushes and PRs to main. `make check` passes cleanly on current main. Co-authored-by: user <user@Mac.lan guest wan> Co-authored-by: clawbot <clawbot@noreply.git.eeqj.de> Co-authored-by: clawbot <clawbot@sneak.berlin> Reviewed-on: #42 Co-authored-by: clawbot <sneak+clawbot@sneak.cloud> Co-committed-by: clawbot <sneak+clawbot@sneak.cloud>	2026-03-17 12:39:44 +01:00