Fail the build when Git is present but unreadable

v0.1.0's Debian packages shipped as 0.0.0. The debian jobs run in a
debian:trixie container, so the build runs as root over a workspace owned
by the runner account, and Git has refused to read a repository owned by
another user since 2.35. The resolver swallowed that refusal and answered
with its Git-less fallback, which is how a package stamped 0.0.0 got built
underneath a changelog stanza that already said 0.1.0, beside DMGs the
non-container macOS jobs versioned correctly.

Both halves of that were wrong. The resolver now passes -c safe.directory
for the source directory it was pointed at -- reading the identity of a
tree the caller has already asked to compile needs no further permission
-- which covers CI, the local container path and any sudo build in one
place, so build-deb.sh no longer needs its own workaround. And a tree that
has a .git yet yields nothing is now a hard error: an absent repository is
0.0.0, an unreadable one is a broken build.

release.yml re-checks the built filenames against the tag before it
publishes, since four jobs resolving the version separately is exactly how
they came to disagree.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CaJar47XxqehpSd7chyAk5

Author: singular0

.github/workflows/release.yml

@@ -97,6 +97,34 @@ jobs:
           merge-multiple: true
           path: dist
 
+      # The gate resolved the tag on its own runner; each package job resolves
+      # it again on its own. v0.1.0 shipped with the two of them disagreeing --
+      # correct DMGs beside debs that called themselves 0.0.0, because the
+      # container builds could not read the checkout and said so to nobody.
+      # Every asset carries its version in its name, so the tag can be checked
+      # against what four separate jobs actually produced, one step before the
+      # release exists.
+      - name: Check the packages carry the tag's version
+        working-directory: dist
+        run: |
+          wrong=
+          for f in corelet_*.deb; do
+              case $f in
+                  corelet_${{ needs.gate.outputs.package }}_*.deb) ;;
+                  *) wrong="$wrong $f" ;;
+              esac
+          done
+          for f in Corelet-*.dmg; do
+              case $f in
+                  Corelet-${{ needs.gate.outputs.version }}-*.dmg) ;;
+                  *) wrong="$wrong $f" ;;
+              esac
+          done
+          if [ -n "$wrong" ]; then
+              echo "::error::$GITHUB_REF_NAME did not build as itself:$wrong"
+              exit 1
+          fi
+
       # Nothing here is notarized or signed with a key anyone can check
       # against, so the checksums are the only way a download can be verified
       # at all. The -dbgsym packages stay out of the release: they are for

CLAUDE.md

@@ -10,8 +10,9 @@ each other.
 ## Build
 
 Qt 6 Widgets, C++20, no dependencies beyond Qt. No formatter config. Tests are two CTest binaries
-built under `BUILD_TESTING` (`tests/history_test.cpp`, `tests/chat_model_test.cpp`); run them with
-`ctest --test-dir build`. `libqt6sql6-sqlite` is a Build-Depend as well as a runtime one because
+built under `BUILD_TESTING` (`tests/history_test.cpp`, `tests/chat_model_test.cpp`) plus
+`tests/version_test.cmake`, which drives the version resolver over throwaway repositories rather
+than compiling anything; run them with `ctest --test-dir build`. `libqt6sql6-sqlite` is a Build-Depend as well as a runtime one because
 the history test opens a real QSQLITE database and `dh_auto_test` fails without the driver plugin.
 
 ```sh
@@ -56,12 +57,24 @@ reads them, so no list of Qt packages is repeated in the script, workflow or REA
 Git is the only source of the current version. `cmake/version.cmake` accepts valid `v` + SemVer
 release tags and produces one canonical identity plus the syntax-constrained Debian and Apple
 forms. An exact `v1.2.3` reports `1.2.3`; later commits report `1.2.3-N-gHASH`; a Git checkout with
-no reachable release tag reports `0.0.0-HASH`; and a tree without usable Git metadata reports
-`0.0.0`. Staged or unstaged tracked changes add `-dirty`; untracked build products do not. The
+no reachable release tag reports `0.0.0-HASH`; and a source tree with no repository in it at all —
+a downloaded tarball, or the staging tree the Debian package builds from — reports `0.0.0`.
+Staged or unstaged tracked changes add `-dirty`; untracked build products do not. The
 resolver generates the header, man page and Info.plist on every build and only rewrites changed
 files, so tagging an already configured checkout updates its identity without forcing an otherwise
 unchanged rebuild.
 
+A tree that *does* have a `.git` and still yields nothing is a hard error rather than a `0.0.0`.
+That distinction is what v0.1.0 was missing: Git refuses a repository owned by another user, which
+is what a container job is — the workspace belongs to the runner account and the build runs as
+root — so the Debian jobs resolved nothing, said so to nobody, and shipped debs stamped `0.0.0`
+underneath a changelog that said `0.1.0`, beside correctly named DMGs. The resolver now passes
+`-c safe.directory` for the source directory it was pointed at (`safe.directory` is read only from
+protected scopes, so an environment variable would not do, and it must be the physical path, not a
+route through a symlink), which fixes CI, the local container path and any `sudo` build in one
+place. `release.yml` then re-checks the built filenames against the tag before publishing, because
+every job resolving the version separately is exactly how they came to disagree.
+
 Debian native versions cannot contain hyphens, so prereleases use `~` and development components
 use `+`/`.` there. Apple's standard bundle fields are numeric: `CFBundleShortVersionString` uses
 the tag's numeric core (or `0.0.0`) and `CFBundleVersion` uses the Git commit count (or `0`); the

cmake/version.cmake

@@ -57,17 +57,55 @@ else()
     set(CORELET_VERSION_BUILD "0")
     set(CORELET_VERSION_DATE "Thu, 01 Jan 1970 00:00:00 +0000")
 
+    # Two different things produce no version here, and only one of them is
+    # fine. A source copy with no repository -- a downloaded tarball, or the
+    # staging tree the Debian package builds from -- is genuinely 0.0.0. A tree
+    # that does have a .git and still yields nothing is a broken build, not a
+    # version: that case once put 0.0.0 packages into a tagged release,
+    # silently, and beneath the version the changelog itself already carried.
+    # So from here on, a .git that cannot be read is fatal.
     find_package(Git QUIET)
+    if(SOURCE_DIR AND EXISTS "${SOURCE_DIR}/.git" AND NOT GIT_EXECUTABLE)
+        message(FATAL_ERROR "no git to read the checkout at ${SOURCE_DIR}")
+    endif()
     if(GIT_EXECUTABLE AND SOURCE_DIR)
+        # Since 2.35 Git refuses to read a repository owned by another user,
+        # which is exactly what a container build is: the workspace belongs to
+        # the host's runner account and the build runs as root. Nothing here
+        # does more than read the identity of a tree the caller already told us
+        # to compile, so the directory we were pointed at is trusted for the
+        # duration. safe.directory is honoured only from protected scopes --
+        # system, global and command line -- so it has to be passed as -c
+        # rather than an environment variable, and it must be the physical path
+        # Git resolves the repository to, not a route through a symlink.
+        get_filename_component(source_path "${SOURCE_DIR}" REALPATH)
+        set(git "${GIT_EXECUTABLE}" -c "safe.directory=${source_path}")
+
         execute_process(
-            COMMAND "${GIT_EXECUTABLE}" rev-parse --verify HEAD
+            COMMAND ${git} rev-parse --is-inside-work-tree
             WORKING_DIRECTORY "${SOURCE_DIR}"
             OUTPUT_QUIET
-            ERROR_QUIET
-            RESULT_VARIABLE have_head)
+            ERROR_VARIABLE git_error
+            RESULT_VARIABLE in_repository)
+        if(NOT in_repository EQUAL 0 AND EXISTS "${SOURCE_DIR}/.git")
+            message(FATAL_ERROR
+                "Git cannot read the checkout at ${SOURCE_DIR}: ${git_error}")
+        endif()
+
+        # A repository whose HEAD is unborn -- git init with nothing committed
+        # yet -- has no identity to report and no build to break.
+        set(have_head 1)
+        if(in_repository EQUAL 0)
+            execute_process(
+                COMMAND ${git} rev-parse --verify HEAD
+                WORKING_DIRECTORY "${SOURCE_DIR}"
+                OUTPUT_QUIET
+                ERROR_QUIET
+                RESULT_VARIABLE have_head)
+        endif()
         if(have_head EQUAL 0)
             execute_process(
-                COMMAND "${GIT_EXECUTABLE}" rev-parse --short=7 HEAD
+                COMMAND ${git} rev-parse --short=7 HEAD
                 WORKING_DIRECTORY "${SOURCE_DIR}"
                 OUTPUT_VARIABLE short_hash
                 OUTPUT_STRIP_TRAILING_WHITESPACE
@@ -77,7 +115,7 @@ else()
                 message(FATAL_ERROR "cannot resolve Git hash: ${git_error}")
             endif()
             execute_process(
-                COMMAND "${GIT_EXECUTABLE}" rev-list --count HEAD
+                COMMAND ${git} rev-list --count HEAD
                 WORKING_DIRECTORY "${SOURCE_DIR}"
                 OUTPUT_VARIABLE CORELET_VERSION_BUILD
                 OUTPUT_STRIP_TRAILING_WHITESPACE
@@ -87,7 +125,7 @@ else()
                 message(FATAL_ERROR "cannot count Git commits: ${git_error}")
             endif()
             execute_process(
-                COMMAND "${GIT_EXECUTABLE}" show -s --format=%aD HEAD
+                COMMAND ${git} show -s --format=%aD HEAD
                 WORKING_DIRECTORY "${SOURCE_DIR}"
                 OUTPUT_VARIABLE CORELET_VERSION_DATE
                 OUTPUT_STRIP_TRAILING_WHITESPACE
@@ -98,7 +136,7 @@ else()
             endif()
 
             execute_process(
-                COMMAND "${GIT_EXECUTABLE}" tag --merged HEAD
+                COMMAND ${git} tag --merged HEAD
                 WORKING_DIRECTORY "${SOURCE_DIR}"
                 OUTPUT_VARIABLE merged_tags
                 OUTPUT_STRIP_TRAILING_WHITESPACE
@@ -108,7 +146,7 @@ else()
                 message(FATAL_ERROR "cannot list Git tags: ${git_error}")
             endif()
             string(REPLACE "\n" ";" merged_tags "${merged_tags}")
-            set(describe_command "${GIT_EXECUTABLE}" describe --tags --long --abbrev=7)
+            set(describe_command ${git} describe --tags --long --abbrev=7)
             set(release_tag_count 0)
             foreach(tag IN LISTS merged_tags)
                 is_release_tag("${tag}" valid)
@@ -163,7 +201,7 @@ else()
             # Match git describe --dirty: staged and unstaged tracked changes
             # count, while untracked build products do not.
             execute_process(
-                COMMAND "${GIT_EXECUTABLE}" status --porcelain --untracked-files=no
+                COMMAND ${git} status --porcelain --untracked-files=no
                 WORKING_DIRECTORY "${SOURCE_DIR}"
                 OUTPUT_VARIABLE dirty
                 OUTPUT_STRIP_TRAILING_WHITESPACE

scripts/build-deb.sh

@@ -162,7 +162,6 @@ build_container() {
             cp -a /src /work
             rm -rf /work/build /work/dist /work/.git
             /work/scripts/build-deb.sh deps
-            git config --global --add safe.directory /src
             cmake -DSOURCE_DIR=/src -DOUTPUT_MANIFEST=/tmp/corelet-version.cmake \
                 -P /src/cmake/version.cmake
             CORELET_VERSION_MANIFEST=/tmp/corelet-version.cmake \

tests/version_test.cmake

@@ -36,6 +36,16 @@ function(resolve source output)
     endif()
 endfunction()
 
+function(resolve_failure source output label)
+    execute_process(
+        COMMAND "${CMAKE_COMMAND}" -DSOURCE_DIR=${source}
+                -DOUTPUT_MANIFEST=${output} -P "${resolver}"
+        OUTPUT_QUIET ERROR_QUIET RESULT_VARIABLE status)
+    if(status EQUAL 0)
+        message(FATAL_ERROR "${label}: the resolver answered anyway")
+    endif()
+endfunction()
+
 function(assert_equal actual expected label)
     if(NOT "${actual}" STREQUAL "${expected}")
         message(FATAL_ERROR "${label}: expected '${expected}', got '${actual}'")
@@ -107,4 +117,27 @@ assert_equal("${CORELET_VERSION}" "0.0.0" "Git-less fallback")
 assert_equal("${CORELET_VERSION_DEBIAN}" "0.0.0" "Git-less Debian fallback")
 assert_equal("${CORELET_VERSION_BUILD}" "0" "Git-less bundle build")
 
-file(REMOVE_RECURSE "${repo}" "${plain}" "${manifest}")
+# git init and nothing committed: a repository with no identity to report yet,
+# which is not the same as one that cannot be read.
+set(unborn "${TEST_ROOT}/version-test-unborn")
+file(MAKE_DIRECTORY "${unborn}")
+execute_process(COMMAND git init -q WORKING_DIRECTORY "${unborn}"
+                OUTPUT_QUIET ERROR_VARIABLE error RESULT_VARIABLE status)
+if(NOT status EQUAL 0)
+    message(FATAL_ERROR "git init failed in ${unborn}: ${error}")
+endif()
+resolve("${unborn}" "${manifest}")
+include("${manifest}")
+assert_equal("${CORELET_VERSION}" "0.0.0" "unborn HEAD fallback")
+
+# A .git Git refuses to read has to fail the build rather than resolve to
+# 0.0.0. v0.1.0 shipped debs stamped 0.0.0 underneath a changelog that said
+# 0.1.0 because a container job hit precisely this -- a checkout owned by
+# another user -- and got an answer instead of an error. Ownership needs two
+# users to reproduce; a gitdir pointing nowhere is the same refusal.
+set(broken "${TEST_ROOT}/version-test-broken")
+file(MAKE_DIRECTORY "${broken}")
+file(WRITE "${broken}/.git" "gitdir: ${TEST_ROOT}/nowhere\n")
+resolve_failure("${broken}" "${manifest}" "unreadable checkout")
+
+file(REMOVE_RECURSE "${repo}" "${plain}" "${unborn}" "${broken}" "${manifest}")