egress-proxies-operator/docs/plans-executions/2026-08-11-1802-bake-commit-version.md

Execution: Bake the git commit into the operator binary and log it at startup

Plan: docs/plans/2026-08-11-1802-bake-commit-version.md

• Step 0 — Save and commit the plan
• Step 1 — internal/version package + tests
• Step 2 — cmd/main.go: --version flag + startup log line
• Step 3 — Makefile GIT_COMMIT + --build-arg wiring
• Step 4 — Dockerfile -ldflags stamp + OCI revision label
• Step 5 — CHANGELOG entry (after the user confirms it works live)

Steps 1–4

Mostly as planned. One deviation worth recording: the plan claimed build/run targets need no changes because Go's automatic VCS stamp covers host builds — that turned out to be only half true. Go skips VCS stamping when the build target is a file argument rather than a package pattern, and the Makefile's build target used go build -o bin/manager cmd/main.go. Verified empirically:

go build -o bin/manager cmd/main.go && ./bin/manager --version   # unknown (no vcs settings)
go build -o bin/manager ./cmd       && ./bin/manager --version   # e4d2a191d0c2-dirty

So build: now uses go build -o bin/manager ./cmd. go run never stamps VCS info regardless of invocation form — make run/run-dev print commit=unknown, which is acceptable for dev loops (the Dockerfile path uses the explicit ldflags stamp and is unaffected; it kept cmd/main.go).

The ldflags path was verified independently:

go build -ldflags "-X gitea.home.hrajfrisbee.cz/kacerr/egress-proxies-operator/internal/version.Commit=deadbeef1234" \
  -o bin/manager-stamped cmd/main.go
./bin/manager-stamped --version   # deadbeef1234

Worth noting: cmd/main.go imports k8s apimachinery as runtime, so the stdlib runtime needed an alias (goruntime "runtime") for goruntime.Version() in the startup line. The --version check happens right after flag.Parse(), before logger and manager setup, so it works without a kubeconfig.

Verification

go vet ./... && go test ./...           # all green, incl. new resolve() table tests
go build -o bin/manager ./cmd && ./bin/manager --version   # e4d2a191d0c2-dirty

The image-level check could not run locally — the Docker daemon was not running. make docker-build IMG=egress-proxies-operator:dev did prove the Makefile side before failing at the daemon: it invoked docker build --build-arg GIT_COMMIT=e4d2a191d0c2-dirty .... Still pending (needs a running daemon):

make docker-build IMG=egress-proxies-operator:dev
docker run --rm egress-proxies-operator:dev --version
docker inspect egress-proxies-operator:dev --format '{{index .Config.Labels "org.opencontainers.image.revision"}}'