feat: export SOURCE_DATE_EPOCH for build commands

[leodido]

Description

Export SOURCE_DATE_EPOCH environment variable for all build commands to enable reproducible builds without requiring .git directory.

Fixes https://linear.app/ona-team/issue/CLC-2097/improve-builds-determinism

Problem

Build commands that want deterministic timestamps currently need to call git directly:

COMMIT_TIME=$(git show -s --format=%cI ${__git_commit})

This fails in CI environments with:

• Shallow clones (git clone --depth=1)
• Incomplete .git history
• No .git directory at all

Solution

Export SOURCE_DATE_EPOCH environment variable for all build commands.

Build commands can now use:

BUILD_TIME=$SOURCE_DATE_EPOCH

Why This Makes Sense

Leeway computes a deterministic timestamp once (from git commit or external SOURCE_DATE_EPOCH if set), then exports it for build commands to use. This creates a one-way flow:

Scenario 1: Git Available (Normal Case)

Leeway: Gets timestamp from git commit (e.g., 1705329600)
Leeway: Exports SOURCE_DATE_EPOCH=1705329600
Build commands: Use $SOURCE_DATE_EPOCH (no git needed!)

Scenario 2: No Git, External SOURCE_DATE_EPOCH Set

CI: Sets SOURCE_DATE_EPOCH=1700000000
Leeway: Reads it (no git available)
Leeway: Exports SOURCE_DATE_EPOCH=1700000000 (pass-through)
Build commands: Use $SOURCE_DATE_EPOCH

Scenario 3: No Git, No SOURCE_DATE_EPOCH

Leeway: No git, no external SOURCE_DATE_EPOCH
Leeway: Fails fast (prevents cache pollution)

The flow is: External Environment → Leeway → Build Commands (one-way, not circular).

The Benefit

Before this change:

buildCommand:
  - sh
  - -c
  - |
    # Build command needs git
    COMMIT_TIME=$(git show -s --format=%cI ${__git_commit})
    go build -ldflags "-X main.BuildTime=$COMMIT_TIME"
    # Fails if .git is incomplete or missing!

After this change:

buildCommand:
  - sh
  - -c
  - |
    # SOURCE_DATE_EPOCH is automatically set by leeway
    go build -ldflags "-X main.BuildTime=$SOURCE_DATE_EPOCH" -o app
    # Works even without .git directory!

Benefits

• ✅ Works without .git directory (CI-friendly)
• ✅ Standard approach (reproducible-builds.org)
• ✅ Consistent with Docker builds (already uses SOURCE_DATE_EPOCH)
• ✅ Same timestamp used for tar archives, Docker images, and build commands
• ✅ Enables gitpod-next PR #11833 to work correctly

Implementation

Uses existing getDeterministicMtime() function which:

1. Tries SOURCE_DATE_EPOCH env var first (if set externally)
2. Falls back to git commit timestamp
3. Returns a deterministic Unix timestamp

This timestamp is now exported to the environment for all build commands.

Testing

# Create test package:
packages:
  - name: test
    type: generic
    config:
      commands:
        - ["sh", "-c", "echo SOURCE_DATE_EPOCH=$SOURCE_DATE_EPOCH"]

# Build:
leeway build :test

# Expected: SOURCE_DATE_EPOCH=1705329600 (or similar)

Documentation

README.md has been updated with:

• Description of the SOURCE_DATE_EPOCH environment variable
• Example usage in BUILD.yaml
• Benefits for CI environments
• Link to https://reproducible-builds.org

---

Co-authored-by: Ona no-reply@ona.com

[geropl]

LGTM ✔️