fix(config): make BuildInfo.isDev() invariant under release-pipeline substitution

[bpamiri]

Summary

Every snapshot since #2352 has been silently reporting itself as 0.0.0-dev in the debug bar, wheels info output, and anywhere application.wheels.version flows. Surfaced by a fresh-VM tutorial run on 4.0.0-SNAPSHOT+1644 where the user expected Wheels 4.0.0-SNAPSHOT+1644 in the debug bar but saw Wheels 0.0.0-dev.

Root cause

tools/build/scripts/prepare-core.sh does a global sed s/@build.version@/<version>/g over BuildInfo.cfc at artifact-construction time. Before this fix, isDev() compared variables.info.version to the literal "@build.version@" string:

public boolean function isDev() {
    return variables.info.version == "@build.version@";  // literal sentinel
}

The sed pass rewrote the sentinel-literal too, turning the comparison into:

return variables.info.version == "4.0.0-SNAPSHOT+1644";  // post-substitution

…which is always true on every released build, since variables.info.version was substituted to the same value. Then version() does isDev() ? "0.0.0-dev" : variables.info.version → always returns "0.0.0-dev".

This is a textbook self-substituting sentinel: the in-source value used for "this hasn't been rewritten yet" detection looks identical to the value being rewritten.

Fix

Replace the literal-equality check with the structural prefix/suffix check that $blankIfPlaceholder() already uses in the same file:

public boolean function isDev() {
    var v = variables.info.version;
    return left(v, 7) == "@build." && right(v, 1) == "@";
}

The matcher never embeds the full sentinel string @build.version@, so it's invariant under any single-token substitution.

Regression guard

Adds a structural test in buildInfoSpec.cfc that reads the source and asserts the literal @build.version@ appears exactly once (only in the variables.info.version field). A second occurrence anywhere — comments, comparison logic — is rewritten by the release pipeline and re-introduces the bug. This test would have caught the issue when #2352 first introduced BuildInfo.cfc.

The pre-existing tests run against the source (placeholder still literal), where the buggy isDev() happens to return the right answer; only post-substitution artifacts trigger the bug, which is why this slipped through.

Verification

Verified end-to-end on a fresh-VM blog app running brew-installed 4.0.0-SNAPSHOT+1644:

	Before fix	After fix
application.wheels.buildInfo.isDev()	true	false
application.wheels.buildInfo.version()	"0.0.0-dev"	"4.0.0-SNAPSHOT+1644"
Debug bar	Wheels 0.0.0-dev	Wheels 4.0.0-SNAPSHOT+1644

Reproduced by sed-substituting the fixed source locally (sed 's/@build\.version@/4.0.0-SNAPSHOT+1644/g'), scp'ing the result to the VM's blog/vendor/wheels/BuildInfo.cfc, restarting the server, and inspecting the rendered debug bar — exactly the artifact shape the release pipeline produces.

Unit-level verification via direct CFM probe:

== Structural test ==
@build.version@ literal occurrences in source: 1 (expected: 1)

== Behavioral test (concrete version) ==
isDev() with version=4.0.0-SNAPSHOT+9999: false (expected: false)
version() returns: 4.0.0-SNAPSHOT+9999 (expected: 4.0.0-SNAPSHOT+9999)

== Behavioral test (placeholder, dev checkout) ==
isDev() with no override: true (expected: true)
version() returns: 0.0.0-dev (expected: 0.0.0-dev)

Test plan

• CI buildInfoSpec passes (existing 7 tests + 1 new structural-guard test = 8 total)
• After merge + next snapshot release, wheels info reports the concrete build version
• After merge + next snapshot release, debug bar shows the concrete build version
• After merge + next snapshot release, BuildInfo.cfc in wheels-core-<v>.zip artifact still has exactly one @build.version@ literal pre-substitution and zero post-substitution

Related

• feat(config): introduce BuildInfo.cfc as the runtime version source #2352 (introduced BuildInfo.cfc and the substitution block in prepare-core.sh — the same PR introduced both halves of the bug)
• fix(cli): close 0.0.0-dev version display gap on installed Wheels apps #2348 (closed an earlier 0.0.0-dev display gap on installed apps; this is a regression of that fix that landed silently when the version source moved from box.json to BuildInfo.cfc)