From d9ae877d2955586deed97cafe1e5005909a57a15 Mon Sep 17 00:00:00 2001
From: Matthew Kocher <matthew.kocher@broadcom.com>
Date: Fri, 16 Oct 2026 19:08:16 -0700
Subject: [PATCH] Tag release version before go build

Ensure the Go binary embeds the exact semantic release version
(runtime/debug.BuildInfo) rather than an untagged pseudo-version,
so SBOM generators and vulnerability scanners accurately map the release.

ai-assisted=yes
---
 ci/tasks/build.sh | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/ci/tasks/build.sh b/ci/tasks/build.sh
index d26f0156..00e97e05 100755
--- a/ci/tasks/build.sh
+++ b/ci/tasks/build.sh
@@ -25,6 +25,10 @@ if [ "${GOOS}" = "windows" ]; then
 fi
 
 pushd "${release_dir}" > /dev/null
+  if [ -d .git ] && command -v git >/dev/null; then
+    git tag -f "v${semver#v}" || true
+  fi
+
   echo -e "\n building artifact with $(go version)..."
   go build -ldflags "-X main.version=${semver}" \
     -o "out/${binname}"                          \