fix(main): forward release ldflags into internal/version; dev --frozen-lockfile

Addresses two copilot review follow-ups from #561:

1. release-time ldflags now land in real package-level variables.
   The go-app template sets '-X main.version=<tag>' and
   '-X main.build=<commit>' — but this repo reads build metadata
   from github.com/netresearch/ldap-manager/internal/version
   (Version / CommitHash / BuildTimestamp), so the ldflags were a
   silent no-op and tagged releases still reported 'dev'.

   Add 'var version, build string' to cmd/ldap-manager/main.go, alias
   the internal/version import to 'internalversion' to avoid
   shadowing, and forward the build-injected values into
   internalversion.Version / CommitHash at init() time. The existing
   FormatVersion() / 'version --json' subcommand now reflect the
   actual release info. Switch all 'version.' uses in main.go to
   'internalversion.' to match the alias.

2. Dockerfile dev stage: add --frozen-lockfile to 'bun install' for
   reproducibility parity with the release matrix's
   'bun install --frozen-lockfile'.

Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>

Author: CybotTM

Dockerfile

@@ -42,7 +42,7 @@ COPY go.mod go.sum package.json bun.lock ./
 RUN --mount=type=cache,target=/go/pkg/mod,sharing=locked \
     --mount=type=cache,target=/root/.bun/install/cache,sharing=locked \
     go mod download && \
-    bun install
+    bun install --frozen-lockfile
 
 CMD ["sh"]
 

cmd/ldap-manager/main.go

@@ -16,7 +16,7 @@ import (
 	"github.com/rs/zerolog/log"
 
 	"github.com/netresearch/ldap-manager/internal/options"
-	"github.com/netresearch/ldap-manager/internal/version"
+	internalversion "github.com/netresearch/ldap-manager/internal/version"
 	"github.com/netresearch/ldap-manager/internal/web"
 )
 
@@ -26,6 +26,25 @@ const (
 	defaultPort        = "3000"
 )
 
+// Build-injected version metadata. Populated by release.yml's ldflags
+// (`-X main.version=<tag>`, `-X main.build=<commit-sha>`); forwarded
+// into internal/version at init() so FormatVersion() / the `version`
+// subcommand report the release info without requiring each repo to
+// invent its own ldflag target-path convention.
+var (
+	version = ""
+	build   = ""
+)
+
+func init() {
+	if version != "" {
+		internalversion.Version = version
+	}
+	if build != "" {
+		internalversion.CommitHash = build
+	}
+}
+
 func main() {
 	port := os.Getenv("PORT")
 	if port == "" {
@@ -38,16 +57,16 @@ func main() {
 		case "version", "--version":
 			if len(os.Args) == 3 && os.Args[2] == "--json" {
 				info := map[string]string{
-					"version":   version.Version,
-					"commit":    version.CommitHash,
-					"buildTime": version.BuildTimestamp,
+					"version":   internalversion.Version,
+					"commit":    internalversion.CommitHash,
+					"buildTime": internalversion.BuildTimestamp,
 				}
 				enc := json.NewEncoder(os.Stdout)
 				enc.SetIndent("", "  ")
 				_ = enc.Encode(info)
 				os.Exit(0)
 			}
-			fmt.Println(version.FormatVersion())
+			fmt.Println(internalversion.FormatVersion())
 			os.Exit(0)
 		case "--health-check":
 			os.Exit(runHealthCheck(port))
@@ -56,7 +75,7 @@ func main() {
 
 	log.Logger = log.Output(zerolog.ConsoleWriter{Out: os.Stderr})
 
-	log.Info().Msgf("LDAP Manager %s starting...", version.FormatVersion())
+	log.Info().Msgf("LDAP Manager %s starting...", internalversion.FormatVersion())
 
 	opts, err := options.Parse()
 	if err != nil {