Check that the build version reaches the binary

.github/workflows/pr.yml

@@ -49,6 +49,18 @@ jobs:
           make VERSION=version-probe
           test "$(./build/dims version)" = "version-probe"
 
+      # A build arg only reaches make when the Dockerfile declares it. Both
+      # image builds once took VERSION without declaring it, so every released
+      # artifact carried the commit hash instead of the tag.
+      - name: Check every image build declares VERSION
+        run: |
+          for file in Dockerfile Dockerfile.lambda Dockerfile.binaries; do
+            grep -qE '^ARG VERSION' "$file" || {
+              echo "$file takes a VERSION build arg but never declares it"
+              exit 1
+            }
+          done
+
       - name: Scan for vulnerabilities
         run: |
           go install golang.org/x/vuln/cmd/govulncheck@latest
@@ -86,8 +98,20 @@ jobs:
         with:
           context: .
           push: false
+          load: true
+          tags: go-dims:pr
+          build-args: VERSION=pr-${{ github.event.pull_request.number }}
           platforms: ${{ matrix.platform }}
 
+      - name: Check the version reaches the container
+        run: |
+          expected="pr-${{ github.event.pull_request.number }}"
+          actual="$(docker run --rm go-dims:pr version)"
+          test "$actual" = "$expected" || {
+            echo "want $expected, got $actual"
+            exit 1
+          }
+
       - name: Build Lambda Function
         uses: docker/build-push-action@v5
         id: lambda

.github/workflows/release.yml

@@ -98,6 +98,17 @@ jobs:
           platforms: ${{ matrix.platform }}
           outputs: type=local,dest=build
 
+      # The runner matches the target architecture, so the released binary
+      # answers for itself.
+      - name: Check the version reaches the binary
+        run: |
+          unzip -o -q build/dims-linux-${{ matrix.targetarch }}.zip -d /tmp/dims-release
+          actual="$(/tmp/dims-release/dims version)"
+          test "$actual" = "${{ env.TRACKING_TAG }}" || {
+            echo "want ${{ env.TRACKING_TAG }}, got $actual"
+            exit 1
+          }
+
       - name: Upload Standalone Binary
         uses: actions/upload-artifact@v4
         with:

Makefile

@@ -1,4 +1,4 @@
-VERSION ?= $(shell git rev-parse --short=8 HEAD)
+VERSION ?= $(shell git rev-parse --short=8 HEAD 2>/dev/null || echo unknown)
 BUILD_DIR := build
 BOOTSTRAP := $(BUILD_DIR)/bootstrap
 REGISTRY  := ghcr.io/beetlebugorg/go-dims
@@ -9,17 +9,28 @@ LAMBDA_BINARY := $(BUILD_DIR)/bootstrap
 LD_FLAGS = "-X 'github.com/beetlebugorg/go-dims/internal/core.Version=${VERSION}'"
 STATIC_LDFLAGS = "-X 'github.com/beetlebugorg/go-dims/internal/core.Version=${VERSION}' -linkmode 'external' -extldflags '-fno-PIC -static -Wl,-z,stack-size=8388608 -lpng -lz -ltiff -lwebp -lwebpmux -lwebpdemux -ljpeg -lbz2 -lexpat -llcms2 -lgomp -lsharpyuv'"
 
+# verify-version reads the linker flags back out of a built binary and fails
+# when VERSION did not reach it. Dockerfile.lambda and Dockerfile.binaries once
+# took a VERSION build arg they never declared, so every released artifact
+# carried the commit hash instead of the release tag and nothing reported it.
+# The lambda binary cannot be run to ask for its version, so this reads the
+# recorded build settings instead.
+verify-version = @go version -m $(1) | grep -qF "core.Version=$(VERSION)" \
+	|| { echo "VERSION=$(VERSION) did not reach $(1)"; exit 1; }
+
 # -- Build targets
 
 # Builds the shared library version of dims
 all:
 	go generate ./...
 	go build -o $(BINARY) -ldflags $(LD_FLAGS) ./cmd/dims
+	$(call verify-version,$(BINARY))
 
 # Builds a static binary version of dims
 static:
 	go generate ./...
 	go build -o $(BINARY) -ldflags $(STATIC_LDFLAGS) ./cmd/dims
+	$(call verify-version,$(BINARY))
 
 binary-amd64:
 	docker buildx build \
@@ -40,6 +51,7 @@ binary-arm64:
 lambda:
 	go generate ./...
 	go build -o $(LAMBDA_BINARY) -tags "lambda.norpc lambda" -ldflags $(STATIC_LDFLAGS) ./cmd/dims
+	$(call verify-version,$(LAMBDA_BINARY))
 	cd $(BUILD_DIR) && zip lambda.zip bootstrap
 
 lambda-amd64: