build: stamp the module version from git in the Docker build

.dockerignore

@@ -1,15 +1,21 @@
-# Ignore everything that starts with a dot
-.*
-# Readme files and docs
-README.rst
-README_template.rst
-generate_readme.sh
-docs
-COPYING
-# Build file
-Dockerfile*
-makefile
-nuts-node
-development
+# Only untracked and local files are excluded. Tracked files must stay in the
+# build context: go build runs "git status" to stamp the module version from
+# the checked-out tag, and marks the version "+dirty" when tracked files are
+# missing (see Dockerfile).
+# .claude/commands is tracked; only the local parts are excluded.
+.claude/worktrees
+.claude/settings.local.json
+.idea
+.run
+.DS_Store
+**/.DS_Store
+CLAUDE-*
 data
-e2e-tests
+**/data
+docs/_build
+*.pem
+*.key
+*.db
+nuts
+nuts-node
+nuts.yaml

.github/workflows/build-binaries.yaml

@@ -55,7 +55,7 @@ jobs:
 
       - name: Build
         run: |
-          GOOS=linux GOARCH=${{ matrix.arch }} go build -o nuts-linux-${{ matrix.arch }}  -ldflags="-w -s -X 'github.com/nuts-foundation/nuts-node/v6/core.GitCommit=${GIT_COMMIT}' -X 'github.com/nuts-foundation/nuts-node/v6/core.GitBranch=${GIT_BRANCH}' -X 'github.com/nuts-foundation/nuts-node/v6/core.GitVersion=${GIT_VERSION}'" -o nuts-linux-${{ matrix.arch }}
+          MODULE=$(go list -m) && GOOS=linux GOARCH=${{ matrix.arch }} go build -ldflags="-w -s -X '${MODULE}/core.GitCommit=${GIT_COMMIT}' -X '${MODULE}/core.GitBranch=${GIT_BRANCH}' -X '${MODULE}/core.GitVersion=${GIT_VERSION}'" -o nuts-linux-${{ matrix.arch }}
       - name:  Upload binary
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/build-images.yaml

@@ -29,6 +29,12 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
+          # go build stamps the module version from git. A tag build only needs
+          # the tagged commit. An untagged branch push (the :master image) needs
+          # the history back to the nearest tag, otherwise the stamp becomes
+          # v6.0.0-<time>-<rev>, which sorts below every release and trips image
+          # scanners. Pull request builds are not pushed, so they stay shallow.
+          fetch-depth: ${{ github.event_name == 'push' && github.ref_type == 'branch' && 0 || 1 }}
 
       - name: Set version params
         id: version

Dockerfile

@@ -18,10 +18,18 @@ COPY go.sum .
 RUN go mod download && go mod verify
 
 COPY . .
-RUN GOOS=$TARGETOS GOARCH=$TARGETARCH go build -ldflags="-w -s -X 'github.com/nuts-foundation/nuts-node/v6/core.GitCommit=${GIT_COMMIT}' -X 'github.com/nuts-foundation/nuts-node/v6/core.GitBranch=${GIT_BRANCH}' -X 'github.com/nuts-foundation/nuts-node/v6/core.GitVersion=${GIT_VERSION}'" -o /opt/nuts/nuts
+# git is needed so go build can stamp the module version from the checked-out tag
+# DL3018 (pin apk versions) is ignored: Alpine keeps only the current version
+# of a package in its repositories, so a pinned version breaks the build as soon
+# as the package is updated. The pinned base image tag anchors reproducibility.
+# hadolint ignore=DL3018
+RUN apk add --no-cache git
+RUN MODULE=$(go list -m) && GOOS=$TARGETOS GOARCH=$TARGETARCH go build -ldflags="-w -s -X '${MODULE}/core.GitCommit=${GIT_COMMIT}' -X '${MODULE}/core.GitBranch=${GIT_BRANCH}' -X '${MODULE}/core.GitVersion=${GIT_VERSION}'" -o /opt/nuts/nuts
 
 # alpine
 FROM alpine:3.24.1
+# DL3018 ignored for the same reason as in the builder stage above.
+# hadolint ignore=DL3018
 RUN apk update \
   && apk add --no-cache \
              tzdata \

makefile

@@ -125,15 +125,26 @@ e2e-test:
 	cd e2e-tests && IMAGE_NODE_A=nutsfoundation/nuts-node:e2e IMAGE_NODE_B=nutsfoundation/nuts-node:e2e ./run-tests.sh
 
 OUTPUT ?= "$(shell pwd)/nuts"
-GIT_COMMIT ?= "$(shell git rev-list -1 HEAD)"
-GIT_BRANCH ?= "$(shell git symbolic-ref --short HEAD)"
-GIT_VERSION ?= "$(shell git name-rev --tags --name-only $(shell git rev-parse HEAD))"
+GIT_COMMIT ?= $(shell git rev-list -1 HEAD)
+GIT_BRANCH ?= $(shell git symbolic-ref --short HEAD)
+GIT_VERSION ?= $(shell git name-rev --tags --name-only $(shell git rev-parse HEAD))
+# Module path including the major version suffix (e.g. .../nuts-node/v6).
+MODULE := $(shell go list -m)
 build:
-	go build -tags jwx_es256k -ldflags="-w -s -X 'github.com/nuts-foundation/nuts-node/v6/core.GitCommit=${GIT_COMMIT}' -X 'github.com/nuts-foundation/nuts-node/v6/core.GitBranch=${GIT_BRANCH}' -X 'github.com/nuts-foundation/nuts-node/v6/core.GitVersion=${GIT_VERSION}'" -o ${OUTPUT}
+	go build -tags jwx_es256k -ldflags="-w -s -X '$(MODULE)/core.GitCommit=${GIT_COMMIT}' -X '$(MODULE)/core.GitBranch=${GIT_BRANCH}' -X '$(MODULE)/core.GitVersion=${GIT_VERSION}'" -o ${OUTPUT}
 
 docker:
 	docker build --build-arg GIT_COMMIT=${GIT_COMMIT} --build-arg GIT_BRANCH=${GIT_BRANCH} --build-arg GIT_VERSION=${GIT_VERSION} -t nutsfoundation/nuts-node:master .
 
 docker-dev: docker
 	docker build -t nutsfoundation/nuts-node:dev development/dev-image
 
+
+# Bump the major version in the module path (e.g. /v6 -> /v7). Run once on the
+# commit that starts a new major and commit the result. gomajor rewrites go.mod
+# and every import; the .proto go_package options are rewritten here because
+# gomajor does not touch them. Build files read the path from "go list -m".
+bump-major:
+	go run github.com/icholy/gomajor@v0.15.0 path -next
+	perl -pi -e 's#"github.com/nuts-foundation/nuts-node(/v\d+)?/#"'"$$(go list -m)"'/#' $$(git ls-files '*.proto')
+	go mod tidy