Publish the version the build job computed (#631)

Each job in the `Publish` workflow checks out again and recomputes the
version from git. If a tag is added after the `build` job has run, a
later job publishes a different version from the one `build` computed.
Two ways this happens:
- `createRelease --push` on a release branch tags the commit while its
run is in progress;
- someone reruns a failed publish job after tagging.

Example: a push to `release/v1.3` builds `1.3.1-rc2`, so `build` reports
a prerelease and `publish-maven-central` is skipped. The commit is then
tagged `1.3.1`. A rerun of `publish-github-packages` sees the tag and
publishes **`1.3.1`** to GitHub Packages, while Maven Central never gets
it.

## Changes

- `GitVersion.version()` returns `DBOS_VERSION_OVERRIDE` when it is set,
and otherwise derives the version from git as before.
- `publish-github-packages` and `publish-maven-central` set
`DBOS_VERSION_OVERRIDE` from `needs.build.outputs.version`. They no
longer compute the version, so they check out at the default depth
instead of the full history. `build` still uses the full history.

I checked this in a depth-1 clone: with `DBOS_VERSION_OVERRIDE=1.3.1`,
the build produces `transact-1.3.1.jar` with `Implementation-Version:
1.3.1` and the correct `SCM-Revision`.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Author: devhawk

.github/workflows/publish.yml

@@ -73,11 +73,12 @@ jobs:
     permissions:
       contents: read
       packages: write
+    env:
+      # Publish the version the build job computed, not one recomputed from tags added since.
+      DBOS_VERSION_OVERRIDE: ${{ needs.build.outputs.version }}
     steps:
       - name: Checkout code
         uses: actions/checkout@v6
-        with:
-          fetch-depth: 0 # fetch-depth 0 needed for version calculation
 
       - name: Set up OpenJDK 21
         uses: actions/setup-java@v5
@@ -96,11 +97,12 @@ jobs:
     needs: [build]
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/heads/release/') && needs.build.outputs.prerelease == 'false'
+    env:
+      # Publish the version the build job computed, not one recomputed from tags added since.
+      DBOS_VERSION_OVERRIDE: ${{ needs.build.outputs.version }}
     steps:
       - name: Checkout code
         uses: actions/checkout@v6
-        with:
-          fetch-depth: 0 # fetch-depth 0 needed for version calculation
 
       - name: Set up OpenJDK 21
         uses: actions/setup-java@v5

build-logic/src/main/kotlin/dev/dbos/build/GitVersion.kt

@@ -13,8 +13,14 @@ object GitVersion {
   fun gitHash(root: File): String =
     cachedHash ?: run(root, "git", "rev-parse", "--short", "HEAD").also { cachedHash = it }
 
+  /**
+   * The version from DBOS_VERSION_OVERRIDE when set, else derived from git. CI sets the override so
+   * every publish job uses the version the build job computed, even if a tag was added since.
+   */
   fun version(root: File): String =
-    cachedVersion ?: calcVersion(root).also { cachedVersion = it }
+    cachedVersion
+      ?: (System.getenv("DBOS_VERSION_OVERRIDE")?.takeIf { it.isNotBlank() } ?: calcVersion(root))
+        .also { cachedVersion = it }
 
   private fun gitTag(root: File): String? =
     runCatching { run(root, "git", "describe", "--abbrev=0", "--tags") }.getOrNull()