obs: Dockerfile ldflags + smoke-buildinfo target (track 1/8)

Dockerfile

@@ -26,7 +26,14 @@ COPY common/ /common/
 COPY provisioner/go.mod provisioner/go.sum ./
 RUN go mod download
 COPY provisioner/ .
-RUN CGO_ENABLED=0 go build -o /provisioner .
+# Build-time metadata injected via -ldflags into instant.dev/common/buildinfo.
+# Defaults keep the build runnable without --build-arg; CI passes real values.
+ARG GIT_SHA=dev
+ARG BUILD_TIME=unknown
+ARG VERSION=dev
+RUN CGO_ENABLED=0 go build \
+    -ldflags "-X instant.dev/common/buildinfo.GitSHA=${GIT_SHA} -X instant.dev/common/buildinfo.BuildTime=${BUILD_TIME} -X instant.dev/common/buildinfo.Version=${VERSION}" \
+    -o /provisioner .
 
 # debug — alpine-based image that supports `kubectl exec` for one-off
 # debugging. Bundles the most-likely-needed tools so an operator (or

Makefile

@@ -1,4 +1,11 @@
-.PHONY: build test docker-build run
+.PHONY: build test docker-build run smoke-buildinfo
+
+# Build-time metadata injected into instant.dev/common/buildinfo via -ldflags.
+# Override on the make line if needed. GIT_SHA falls back to "dev" when not
+# in a git checkout (e.g. CI tarball builds).
+GIT_SHA    ?= $(shell git rev-parse --short HEAD 2>/dev/null || echo dev)
+BUILD_TIME ?= $(shell date -u +%Y-%m-%dT%H:%M:%SZ)
+VERSION    ?= dev
 
 build:
 	go build ./...
@@ -7,7 +14,26 @@ test:
 	go test ./... -race -count=1
 
 docker-build:
-	docker build -f Dockerfile -t instant-provisioner:local ..
+	docker build -f Dockerfile -t instant-provisioner:local \
+	  --build-arg GIT_SHA=$(GIT_SHA) \
+	  --build-arg BUILD_TIME=$(BUILD_TIME) \
+	  --build-arg VERSION=$(VERSION) \
+	  ..
 
 run:
 	go run .
+
+# Verifies the -ldflags injection wires through to instant.dev/common/buildinfo.
+# Builds the smoke helper with override values and asserts they appear at
+# runtime. CI runs this on every PR to catch a regression where someone
+# breaks the ldflag path.
+smoke-buildinfo:
+	@tmpdir=$$(mktemp -d) && \
+	  go build -ldflags "-X instant.dev/common/buildinfo.GitSHA=smoke-sha -X instant.dev/common/buildinfo.BuildTime=smoke-time -X instant.dev/common/buildinfo.Version=smoke-ver" \
+	    -o $$tmpdir/smoke ./cmd/smoke-buildinfo && \
+	  out=$$($$tmpdir/smoke) && \
+	  echo "$$out" | grep -q "GitSHA=smoke-sha" || (echo "FAIL: $$out" && exit 1) && \
+	  echo "$$out" | grep -q "BuildTime=smoke-time" || (echo "FAIL: $$out" && exit 1) && \
+	  echo "$$out" | grep -q "Version=smoke-ver" || (echo "FAIL: $$out" && exit 1) && \
+	  echo "smoke-buildinfo: OK ($$out)" && \
+	  rm -rf $$tmpdir

cmd/smoke-buildinfo/main.go

@@ -0,0 +1,17 @@
+// Command smoke-buildinfo prints the linked-in buildinfo values to stdout.
+//
+// Used by `make smoke-buildinfo` to verify the -ldflags -X path actually
+// flows through to instant.dev/common/buildinfo at link time. The CI
+// signal is "did the override land?" — not how the values are formatted.
+package main
+
+import (
+	"fmt"
+
+	"instant.dev/common/buildinfo"
+)
+
+func main() {
+	fmt.Printf("GitSHA=%s BuildTime=%s Version=%s\n",
+		buildinfo.GitSHA, buildinfo.BuildTime, buildinfo.Version)
+}