From b73cac5beb26695db9a327f8bda06cff3836dc25 Mon Sep 17 00:00:00 2001
From: Oleksii Dolhov <oleksii.dolhov@gmail.com>
Date: Thu, 28 May 2026 14:59:48 +0300
Subject: [PATCH] fix(deploy): populate build provenance on dev (#958)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two independent bugs caused `GET /api/version` (and the NavBar Build
Info dialog) to return `unknown` for every git/build field on the dev
deployment:

1. `docker-compose.prod.yml` backend service had no `build.args` block,
   so the Dockerfile's `GIT_COMMIT` / `GIT_BRANCH` / `BUILD_DATE` etc.
   ARGs never received values during compose builds. Base
   `docker-compose.yml` carries the block, but the dev workflow builds
   with `-f docker-compose.prod.yml` only, not chained with base.

2. `.github/workflows/deploy-dev.yml` didn't compute and pass the git
   provenance env vars before invoking `docker compose build`.
   `scripts/deploy/start.sh` does this for local runs; the workflow
   was missing the equivalent block.

Fix:
- Add `args:` block to prod compose backend service mirroring base.
- In the workflow, compute git vars from the dev VM's checkout and
  pass them inline on the `sudo docker compose build` invocation.
  Inline `sudo VAR=val …` is used rather than `sudo -E` because the
  default Ubuntu sudoers does not preserve `GIT_*` through `env_reset`.

After deploy, dev's Build Info dialog will render the real commit and
build timestamp instead of `unknown`.

Related to #958

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .github/workflows/deploy-dev.yml | 20 +++++++++++++++++++-
 docker-compose.prod.yml          | 10 ++++++++++
 2 files changed, 29 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/deploy-dev.yml b/.github/workflows/deploy-dev.yml
index bf825d624..4dd29b6dc 100644
--- a/.github/workflows/deploy-dev.yml
+++ b/.github/workflows/deploy-dev.yml
@@ -88,7 +88,25 @@ jobs:
             COMPOSE_FILES="-f docker-compose.prod.yml -f docker-compose.prod.enterprise.yml"
 
             echo "=== Build ==="
-            sudo docker compose ${COMPOSE_FILES} build --no-cache backend frontend mcp-server scheduler
+            # Build-time provenance (#926 / #958). docker-compose.prod.yml
+            # backend.build.args reads these env vars; absent them, the
+            # Dockerfile defaults to "unknown" and Build Info in the UI
+            # shows a wall of unknown values. Mirrors scripts/deploy/start.sh.
+            # Inline VAR=val form bypasses sudo's default env_reset — `sudo -E`
+            # would depend on env_keep being permissive in sudoers, which it
+            # is not by default on Ubuntu.
+            GIT_COMMIT=$(git rev-parse HEAD)
+            GIT_COMMIT_SUBJECT=$(git log -1 --pretty=%s)
+            GIT_COMMIT_TIMESTAMP=$(git log -1 --pretty=%cI)
+            GIT_BRANCH=$(git rev-parse --abbrev-ref HEAD)
+            BUILD_DATE=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+            sudo \
+              GIT_COMMIT="${GIT_COMMIT}" \
+              GIT_COMMIT_SUBJECT="${GIT_COMMIT_SUBJECT}" \
+              GIT_COMMIT_TIMESTAMP="${GIT_COMMIT_TIMESTAMP}" \
+              GIT_BRANCH="${GIT_BRANCH}" \
+              BUILD_DATE="${BUILD_DATE}" \
+              docker compose ${COMPOSE_FILES} build --no-cache backend frontend mcp-server scheduler
 
             echo "=== Restart ==="
             sudo docker compose ${COMPOSE_FILES} up -d backend frontend mcp-server scheduler
diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index f3af09c8c..8cba0e286 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -15,6 +15,16 @@ services:
     build:
       context: .
       dockerfile: docker/backend/Dockerfile
+      # Build-time provenance (#926 / #958). Forwarded to Dockerfile ARGs
+      # → ENV vars → `GET /api/version` payload. The deploy-dev workflow
+      # exports these from the checked-out repo before `docker compose
+      # build`; absent that, the Dockerfile defaults to "unknown".
+      args:
+        GIT_COMMIT: ${GIT_COMMIT:-unknown}
+        GIT_COMMIT_SUBJECT: ${GIT_COMMIT_SUBJECT:-unknown}
+        GIT_COMMIT_TIMESTAMP: ${GIT_COMMIT_TIMESTAMP:-unknown}
+        GIT_BRANCH: ${GIT_BRANCH:-unknown}
+        BUILD_DATE: ${BUILD_DATE:-unknown}
     container_name: trinity-backend
     restart: unless-stopped
     ports: