fix: resolve the reported SDK version from build info at runtime

The default X-Spoo-Client tag was built from a hand-bumped Version
constant that has said dev since v0.1.0, so every consumer reported
sdk-go/dev. The tag version now comes from the consuming binary's
runtime/debug build info, cached with sync.OnceValue and stripped of
the v prefix to match sdk-ts. Version stays as a manual override, and
in-repo or vendored builds without module info still fall back to dev.

Author: Zingzy

version.go

@@ -1,19 +1,86 @@
 package spoo
 
-import "regexp"
+import (
+	"regexp"
+	"runtime/debug"
+	"strings"
+	"sync"
+)
 
-// Version is the SDK release, updated on each tag.
+// modulePath is the SDK's own module path, looked up in the consuming
+// binary's build info to discover the release version at runtime.
+const modulePath = "github.com/spoo-me/spoo-go"
+
+// Version overrides the version reported in the default X-Spoo-Client
+// tag. It is normally left at its zero state ("dev"): a Go library has
+// no build step, so instead of hand-bumping a constant on every tag,
+// the SDK resolves its release version at runtime from the consuming
+// binary's build info (see resolveVersion). Set Version to any other
+// value to force what the default tag reports.
 var Version = "dev"
 
 var versionRe = regexp.MustCompile(`^[A-Za-z0-9._-]{1,16}$`)
 
+// buildInfoVersion caches the one-time build info scan. The module
+// version cannot change during a process lifetime, so the scan runs
+// once and the result is reused for every client.
+var buildInfoVersion = sync.OnceValue(func() string {
+	info, ok := debug.ReadBuildInfo()
+	if !ok {
+		return ""
+	}
+	return versionFromBuildInfo(info)
+})
+
+// versionFromBuildInfo scans a binary's module dependency list for the
+// SDK and returns its bare semver ("0.5.3"), or "" when the SDK is not
+// present as a dependency (the SDK's own tests, vendored builds
+// stripped of module info).
+func versionFromBuildInfo(info *debug.BuildInfo) string {
+	for _, dep := range info.Deps {
+		if dep.Path != modulePath {
+			continue
+		}
+		v := dep.Version
+		if dep.Replace != nil {
+			v = dep.Replace.Version
+		}
+		return normalizeModuleVersion(v)
+	}
+	return ""
+}
+
+// normalizeModuleVersion converts a Go module version ("v0.5.3") to
+// the bare form the X-Spoo-Client tag carries ("0.5.3", matching what
+// sdk-ts sends). Placeholder versions from local replacements report
+// as absent.
+func normalizeModuleVersion(v string) string {
+	if v == "" || v == "(devel)" {
+		return ""
+	}
+	return strings.TrimPrefix(v, "v")
+}
+
+// resolveVersion picks the version for the default client tag: an
+// explicit Version override wins, then the release version recorded in
+// the consuming binary's build info, then "dev".
+func resolveVersion() string {
+	if Version != "dev" {
+		return Version
+	}
+	if v := buildInfoVersion(); v != "" {
+		return v
+	}
+	return "dev"
+}
+
 // defaultClientTag identifies the SDK (and its version, when
 // well-formed) to the backend so API traffic can be attributed per
 // client. Apps building on the SDK set their own tag with
 // option.WithClientTag.
 func defaultClientTag() string {
-	if versionRe.MatchString(Version) {
-		return "sdk-go/" + Version
+	if v := resolveVersion(); versionRe.MatchString(v) {
+		return "sdk-go/" + v
 	}
 	return "sdk-go"
 }

version_test.go

@@ -0,0 +1,91 @@
+package spoo
+
+import (
+	"runtime/debug"
+	"testing"
+)
+
+func TestVersionFromBuildInfo(t *testing.T) {
+	tests := []struct {
+		name string
+		info *debug.BuildInfo
+		want string
+	}{
+		{
+			name: "module absent",
+			info: &debug.BuildInfo{Deps: []*debug.Module{
+				{Path: "github.com/other/mod", Version: "v1.0.0"},
+			}},
+			want: "",
+		},
+		{
+			name: "no deps",
+			info: &debug.BuildInfo{},
+			want: "",
+		},
+		{
+			name: "module present",
+			info: &debug.BuildInfo{Deps: []*debug.Module{
+				{Path: "github.com/other/mod", Version: "v1.0.0"},
+				{Path: modulePath, Version: "v0.5.3"},
+			}},
+			want: "0.5.3",
+		},
+		{
+			name: "replaced module uses replacement version",
+			info: &debug.BuildInfo{Deps: []*debug.Module{
+				{Path: modulePath, Version: "v0.5.3", Replace: &debug.Module{
+					Path: "github.com/fork/spoo-go", Version: "v0.5.4",
+				}},
+			}},
+			want: "0.5.4",
+		},
+		{
+			name: "local replacement reports absent",
+			info: &debug.BuildInfo{Deps: []*debug.Module{
+				{Path: modulePath, Version: "v0.5.3", Replace: &debug.Module{
+					Path: "../spoo-go", Version: "(devel)",
+				}},
+			}},
+			want: "",
+		},
+	}
+	for _, tt := range tests {
+		if got := versionFromBuildInfo(tt.info); got != tt.want {
+			t.Errorf("%s: versionFromBuildInfo() = %q, want %q", tt.name, got, tt.want)
+		}
+	}
+}
+
+func TestNormalizeModuleVersion(t *testing.T) {
+	for in, want := range map[string]string{
+		"v0.5.3":  "0.5.3",
+		"0.5.3":   "0.5.3",
+		"(devel)": "",
+		"":        "",
+	} {
+		if got := normalizeModuleVersion(in); got != want {
+			t.Errorf("normalizeModuleVersion(%q) = %q, want %q", in, got, want)
+		}
+	}
+}
+
+// TestResolveVersionFallsBackToDev pins the in-repo behavior: the test
+// binary's build info has no spoo-go dependency entry, so resolution
+// falls through to "dev". The real-consumption path (a binary that
+// depends on the SDK reporting the tagged semver) is exercised by
+// downstream consumers such as spoo-cli.
+func TestResolveVersionFallsBackToDev(t *testing.T) {
+	if v := resolveVersion(); v != "dev" {
+		t.Fatalf("resolveVersion() = %q, want dev", v)
+	}
+}
+
+func TestResolveVersionHonorsOverride(t *testing.T) {
+	orig := Version
+	defer func() { Version = orig }()
+	Version = "9.9.9"
+	if v := resolveVersion(); v != "9.9.9" {
+		t.Fatalf("resolveVersion() with override = %q, want 9.9.9", v)
+	}
+}