build(git-remote-entire): stamp commit into per-commit builds

[toothbrush]

https://entire.io/gh/entireio/cli/trails/1518

Why

Every per-commit git-remote-entire build (runner sandboxes, Buildkite entire-core-auth plugin) reports git-remote-entire/0.0.0 as its User-Agent, so prod traffic from those helpers cannot be attributed to a commit (~40k spans/week in Datadog with that exact UA).

Cause: .goreleaser.nonprod.yaml left versioninfo.Version unstamped, expecting build info to supply the commit. But versioninfo.resolve takes info.Main.Version when ldflags leave it at dev, and Go's build info reports the VCS tag on HEAD, which is the workflow's throwaway v0.0.0.

What

• Stamp versioninfo.Version=0.0.0+{{.ShortCommit}} in .goreleaser.nonprod.yaml. The +sha suffix is semver build metadata, stays a single token (it also rides in the git agent= capability), and versioncheck.isDevBuild already treats +metadata as a dev build.
• Fix the now-wrong comments in the goreleaser config and the publish workflow.

Build config only: no new runtime knobs or env vars in the helper, no change to artifact names or bucket layout, and tagged releases (.goreleaser.yaml) are untouched. No Go code change: the explicit stamp makes resolve() return early, so build info is never consulted.

Verification

Local build with the same ldflags shape:

$ go build -ldflags "-X ...versioninfo.Version=0.0.0+abc1234 -X ...versioninfo.Commit=abc1234" ./cmd/git-remote-entire
$ ./gre --version
git-remote-entire 0.0.0+abc1234

Control build without the Version stamp picks up whatever tag is on HEAD (the bug):

git-remote-entire 0.11.5-nightly.202610080629.ee0ec53d1+dirty

• goreleaser check -f .goreleaser.nonprod.yaml: validated.
• go test ./cmd/entire/cli/versioninfo/... ./cmd/git-remote-entire/...: ok; go vet clean.
• isDevBuild("0.0.0+abc1234") == true, isOutdated("0.0.0+abc1234", "0.11.3") == false.

After merge: the next publish-git-remote-entire run should produce a helper whose --version is 0.0.0+<sha>, and new Datadog spans from re-pinned consumers should carry git-remote-entire/0.0.0+<sha>.

🤖 Generated with Claude Code

---

Note

Low Risk
Build-time ldflags and workflow comments only; no runtime code or release pipeline changes beyond version string attribution.

Overview
Per-commit git-remote-entire builds from .goreleaser.nonprod.yaml now set versioninfo.Version via ldflags to 0.0.0+{{.ShortCommit}} instead of leaving Version unstamped, so User-Agent and --version identify the commit instead of the workflow’s throwaway v0.0.0 tag.

Comments in publish-git-remote-entire and the nonprod GoReleaser config were updated to match that behavior. Tagged release config and artifact layout are unchanged.

^{Reviewed by Cursor Bugbot for commit 4ad477d. Configure here.}

[Copilot]

🟢 Approval recommended

The narrowly scoped build change matches existing version handling and has no identified blocking issues.

0 open findings

What changed in this PR

Makes per-commit git-remote-entire builds identifiable by commit in version output and HTTP User-Agent, without changing tagged releases or artifact layout.

Changes:

• Stamps versioninfo.Version as 0.0.0+{{.ShortCommit}}.
• Updates configuration and workflow comments to explain the explicit stamp.

File	Description
.goreleaser.nonprod.yaml	Adds the commit-bearing version stamp and explanatory comments.
.github/​workflows/​publish-git-remote-entire.yml	Updates comments describing the throwaway tag and version stamp.

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.