# Execution: Bake the git commit into the operator binary and log it at startup

Plan: `docs/plans/2026-08-11-1802-bake-commit-version.md`

- [x] Step 0 — Save and commit the plan
- [x] Step 1 — `internal/version` package + tests
- [x] Step 2 — `cmd/main.go`: `--version` flag + startup log line
- [x] Step 3 — Makefile `GIT_COMMIT` + `--build-arg` wiring
- [x] Step 4 — Dockerfile `-ldflags` stamp + OCI revision label
- [ ] Step 5 — CHANGELOG entry (after the user confirms it works live)

## Steps 1–4

Mostly as planned. One deviation worth recording: the plan claimed
`build`/`run` targets need no changes because Go's automatic VCS stamp covers
host builds — that turned out to be only half true. Go skips VCS stamping
when the build target is a *file argument* rather than a package pattern, and
the Makefile's `build` target used `go build -o bin/manager cmd/main.go`.
Verified empirically:

```bash
go build -o bin/manager cmd/main.go && ./bin/manager --version   # unknown (no vcs settings)
go build -o bin/manager ./cmd       && ./bin/manager --version   # e4d2a191d0c2-dirty
```

So `build:` now uses `go build -o bin/manager ./cmd`. `go run` never stamps
VCS info regardless of invocation form — `make run`/`run-dev` print
`commit=unknown`, which is acceptable for dev loops (the Dockerfile path uses
the explicit ldflags stamp and is unaffected; it kept `cmd/main.go`).

The ldflags path was verified independently:

```bash
go build -ldflags "-X gitea.home.hrajfrisbee.cz/kacerr/egress-proxies-operator/internal/version.Commit=deadbeef1234" \
  -o bin/manager-stamped cmd/main.go
./bin/manager-stamped --version   # deadbeef1234
```

Worth noting: `cmd/main.go` imports k8s apimachinery as `runtime`, so the
stdlib runtime needed an alias (`goruntime "runtime"`) for
`goruntime.Version()` in the startup line. The `--version` check happens
right after `flag.Parse()`, before logger and manager setup, so it works
without a kubeconfig.

## Verification

```bash
go vet ./... && go test ./...           # all green, incl. new resolve() table tests
go build -o bin/manager ./cmd && ./bin/manager --version   # e4d2a191d0c2-dirty
```

The image-level check initially failed (Docker daemon not running); after
the daemon was started it passed in full:

```bash
make docker-build IMG=egress-proxies-operator:dev
docker run --rm egress-proxies-operator:dev --version
# ae434a7167ec-dirty  (matches git rev-parse --short=12 HEAD + untracked files)
docker inspect egress-proxies-operator:dev --format '{{index .Config.Labels "org.opencontainers.image.revision"}}'
# ae434a7167ec-dirty
```