fix: use git short sha as version metadata for unreleased builds

[ToreMerkely]

Non-released builds reported a user agent of "Kosli/dev+unreleased".
Use the git short sha instead so dev builds identify their commit,
e.g. "Kosli/dev+2c570769". Tagged releases are unaffected.

Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com

[claude]

Claude finished @ToreMerkely's task in 1m 39s —— View job

---

PR Review: Use git short sha as version metadata for unreleased builds

• Run static analysis (build, vet, mod tidy)
• Review the Makefile changes
• Check how version metadata is used downstream
• Post review summary

---

Static Analysis

All three checks pass cleanly: go build ./..., go vet ./..., go mod tidy — no issues.

Review

Summary: This is a clean, minimal two-line change in the Makefile. The default VERSION_METADATA switches from the string literal unreleased to $(GIT_SHA) (the short commit hash from git rev-parse --short HEAD on line 13). Tagged releases still clear the metadata to empty, so the release path is unaffected.

Result: The User-Agent header (set in internal/requests/requests.go:136) changes from Kosli/dev+unreleased to Kosli/dev+2c570769 for dev builds — much more useful for debugging.

No issues found. Specifically:

• Correctness: GIT_SHA is already defined on line 13 (git rev-parse --short HEAD) and used nowhere else in the Makefile, so there's no risk of side effects. The ifneq ($(GIT_TAG),) guard on line 35 still clears metadata for tagged builds — releases remain Kosli/vX.Y.Z with no metadata suffix.
• Edge cases: If git rev-parse --short HEAD fails (e.g. building outside a git repo), GIT_SHA would be empty, producing Kosli/dev+ via GetVersion(). This is the same risk the existing GIT_COMMIT variable on line 12 already has, so it's a known trade-off, not a regression. Worth noting but not worth blocking.
• Tests: The existing version_test.go tests cover the metadata logic generically (empty vs non-empty metadata strings), so they remain valid regardless of whether the metadata value is unreleased, a SHA, or anything else.
• Comment update: The comment on line 34 was updated to match the new behavior — good attention to detail.

What's good about this PR

• Surgically scoped: two lines changed, one clear purpose.
• The commit message and PR description are well-written — they explain the why (dev builds should identify their commit) and the what (short SHA replaces "unreleased").
• Doesn't touch Go code, so zero risk of type errors or runtime regressions.

Verdict: LGTM 👍