build: stamp the release, and refuse a dirty tree
The scaffold's release target did neither. rastrillo.BuildVersion defaults to 'dev', so an unstamped binary answers 'dev' from /api/version forever — and a deploy check comparing that to the expected version has no failing case, which is a green light that means nothing.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SiWVaR69Vb2Lzc9wgfit1v
1 file changed,
+13
−7
Makefile+13 −7
diff --git a/Makefile b/Makefile| index df896d1..45b0ecf 100644 |
| --- a/Makefile |
| +++ b/Makefile |
| @@ -27,14 +27,20 @@ build: |
| # and go version -m still reports module metadata. What you lose is |
| # source-level debugging with delve or gdb — build without the flags for |
| # that. rastrillo dev never strips, for the same reason. |
| +# The scaffold's release target stamped no version and did not refuse a |
| +# dirty tree. Both matter: rastrillo.BuildVersion defaults to "dev", and |
| +# an unstamped binary answers "dev" from /api/version forever — which |
| +# makes the deploy check structurally incapable of failing, since the |
| +# thing it compares can never disagree. |
| release: |
| - @mkdir -p releases |
| - CGO_ENABLED=0 GOOS=$(RELEASE_GOOS) GOARCH=$(RELEASE_GOARCH) \ |
| - go build -ldflags="-s -w" -o $(RELEASE_BIN) ./cmd/$(APP) |
| - @echo |
| - @echo "built $(RELEASE_BIN)" |
| - @echo "ship it with:" |
| - @echo " carlos ship -app $(APP) -target $(RELEASE_GOOS)-$(RELEASE_GOARCH) $(RELEASE_BIN)" |
| + @git diff --quiet && git diff --cached --quiet || \ |
| + { echo "refusing to build a release from a dirty tree"; exit 1; } |
| + CGO_ENABLED=0 GOOS=$(RELEASE_GOOS) GOARCH=$(RELEASE_GOARCH) go build -trimpath \ |
| + -ldflags "-s -w -X github.com/carlosframework/rastrillo.BuildVersion=$$(git rev-parse --short HEAD)" \ |
| + -o $(RELEASE_BIN) ./cmd/$(APP) |
| + @echo "built $(RELEASE_BIN) stamped $$(git rev-parse --short HEAD)" |
| + @echo "deploy it with:" |
| + @echo " carlos deploy --app $(APP) --account bds --channel edge --timeout 5m $(RELEASE_BIN)" |
| test: |
| go test ./... |