docker: stamp the version into the image, and assert it on every build

.github/workflows/docker.yml

@@ -95,12 +95,37 @@ jobs:
       # If the default was resolving to amd64 on the arm runner, every RUN line
       # was going through qemu, which explains the 20x. Pinning it costs nothing
       # if the default was already correct.
+      # The version has to be handed to the build: .dockerignore excludes .git,
+      # so `make version`'s `git describe` finds nothing inside the container
+      # and the binaries used to report "Build: unknown" even on a release tag.
+      - name: Resolve the version to stamp
+        run: |
+          if [[ "${GITHUB_REF}" == refs/tags/v* ]]; then
+            ver="${GITHUB_REF#refs/tags/}"
+          else
+            ver="dev-${GITHUB_SHA:0:12}"
+          fi
+          echo "ORLY_VERSION=$ver" >> "$GITHUB_ENV"
+          echo "stamping: $ver"
+
       - name: Build image
         run: |
           docker build --platform "linux/${{ matrix.arch }}" \
             --build-arg JHM_WORKER_COUNT=${{ matrix.workers }} \
+            --build-arg ORLY_VERSION="$ORLY_VERSION" \
             -t "$IMAGE" .
 
+      # Assert the stamp landed, on every build including pull requests -- the
+      # point being that this runs constantly rather than only on a publish.
+      # The manifest check in this same workflow was gated to publishes only,
+      # so it went unexercised until it failed its first real run (#559).
+      - name: Confirm the binaries know their own version
+        run: |
+          got=$(docker run --rm --entrypoint orlyc "$IMAGE" --help 2>&1 \
+                  | sed -n 's/^Build: //p')
+          echo "orlyc reports: ${got:-<nothing>}"
+          [ "$got" = "$ORLY_VERSION" ]
+
       - name: Confirm the built image is the intended architecture
         run: |
           got=$(docker image inspect "$IMAGE" --format '{{.Architecture}}')

Dockerfile

@@ -25,10 +25,24 @@ WORKDIR /src/orly
 COPY . .
 
 # Bootstrap jhm + nycr, then build just the two production binaries this
-# image ships (jhm emits to /src/out_orly). `make version` degrades to
-# "unknown" without git -- fine for an image whose tag carries the version.
+# image ships (jhm emits to /src/out_orly).
+#
+# The version has to be passed IN. `make version` derives it from `git
+# describe`, and .dockerignore excludes .git -- deliberately, it is build
+# context nothing here needs -- so inside this build it always degraded to
+# "unknown". That was tolerable while the image was only ever :latest; it is
+# not once there are release tags, because `orlyc --help` reporting
+# "Build: unknown" leaves a user with no way to ask the binary what it is.
+# The workflow passes the tag on a release and dev-<short sha> otherwise.
 ARG JHM_WORKER_COUNT=4
-RUN make bootstrap version \
+ARG ORLY_VERSION=
+RUN if [ -n "$ORLY_VERSION" ]; then \
+      printf '#pragma once\n\n/* Generated by the image build; see Dockerfile. */\n#define ORLY_BUILD_VERSION "%s"\n' \
+        "$ORLY_VERSION" > orly/build_version.h; \
+      make bootstrap; \
+    else \
+      make bootstrap version; \
+    fi \
     && PATH="/src/orly/tools:$PATH" \
        jhm -c release --worker-count "$JHM_WORKER_COUNT" \
            orly/server/orlyi orly/orlyc