Derive build version from git tags via VERSION file.

flake.nix reads from VERSION instead of hardcoding; Makefile gains
a version target that syncs VERSION from the latest git tag and
injects it into go build ldflags.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Makefile

@@ -1,4 +1,6 @@
-.PHONY: proto build test lint clean
+VERSION := $(shell git describe --tags --abbrev=0 | sed 's/^v//')
+
+.PHONY: proto build test lint clean version
 
 proto:
 	protoc \
@@ -7,8 +9,11 @@ proto:
 		-I proto \
 		proto/sgard/v1/sgard.proto
 
+version:
+	@echo $(VERSION) > VERSION
+
 build:
-	go build ./...
+	go build -ldflags "-X main.version=$(VERSION)" ./...
 
 test:
 	go test ./...

VERSION

@@ -0,0 +1 @@
+3.1.5

flake.nix

@@ -11,11 +11,14 @@
       let
         pkgs = import nixpkgs { inherit system; };
       in
+      let
+        version = builtins.replaceStrings [ "\n" ] [ "" ] (builtins.readFile ./VERSION);
+      in
       {
         packages = {
           sgard = pkgs.buildGoModule rec {
             pname = "sgard";
-            version = "2.1.0";
+            inherit version;
             src = pkgs.lib.cleanSource ./.;
             subPackages = [ "cmd/sgard" "cmd/sgardd" ];
 
@@ -31,7 +34,7 @@
 
           sgard-fido2 = pkgs.buildGoModule rec {
             pname = "sgard-fido2";
-            version = "2.1.0";
+            inherit version;
             src = pkgs.lib.cleanSource ./.;
             subPackages = [ "cmd/sgard" "cmd/sgardd" ];