From ecf6d4f3816cff7be2663dd1fb3df278c1c0524d Mon Sep 17 00:00:00 2001
From: Matthew Kocher <matthew.kocher@broadcom.com>
Date: Fri, 16 Oct 2026 19:03:07 -0700
Subject: [PATCH] Tag release version before go build

Ensure the Go binary embeds the exact semantic release version
(runtime/debug.BuildInfo) rather than an untagged pseudo-version,
so SBOM generators and vulnerability scanners accurately map the release.

ai-assisted=yes
---
 ci/tasks/build.sh | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/ci/tasks/build.sh b/ci/tasks/build.sh
index 395b3f62..bd792f1e 100755
--- a/ci/tasks/build.sh
+++ b/ci/tasks/build.sh
@@ -22,6 +22,10 @@ if [ "${GOOS}" = "windows" ]; then
 fi
 
 pushd "${release_dir}" > /dev/null
+  if [ -d .git ] && command -v git >/dev/null; then
+    git tag -f "v${semver#v}" || true
+  fi
+
   echo -e "\n building artifact using $(go version)..."
   go build -ldflags "-X main.version=${semver}" \
     -o "out/${binname}"                          \