build: pin version discovery to v* tags

Nightly builds will move a rolling `nightly` tag across main. A plain
`git describe --tags` returns whichever tag is nearest, so once that tag exists
every build — including a real release build — would report its version as
"nightly" and lose the release lineage entirely.

Restrict discovery to `v*` so the rolling tag is invisible to versioning:

  with a nightly tag ahead of v0.3.1
    git describe --tags                → nightly
    git describe --tags --match 'v*'   → v0.3.1-1-gf940087

Land this before the nightly workflow exists, so no build is ever stamped from
the rolling tag.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

build.sh

@@ -4,7 +4,10 @@ set -euo pipefail
 cd "$(dirname "$0")"
 
 APP=sshkeeper
-VERSION=$(git describe --tags --always --dirty 2>/dev/null || echo "dev")
+# --match 'v*' keeps the rolling `nightly` tag from hijacking the version: a
+# plain `git describe --tags` picks whichever tag is nearest, so a nightly build
+# would otherwise stamp binaries "nightly" instead of v<last release>-N-g<sha>.
+VERSION=$(git describe --tags --match 'v*' --always --dirty 2>/dev/null || echo "dev")
 LDFLAGS="-s -w -X main.version=${VERSION}"
 
 echo "==> Building ${APP} ${VERSION}..."

docs/release.md

@@ -12,8 +12,11 @@ git tag -a v0.2.0 -m "sshkeeper v0.2.0"
 git push origin v0.2.0
 ```
 
-The release script uses `git describe --tags --always --dirty` by default. You
+The release script uses `git describe --tags --match 'v*' --always --dirty` by
-can also pass the version explicitly:
+default. The `--match 'v*'` filter matters: nightly builds move a `nightly` tag
+across `main`, and without the filter `git describe` would pick that tag and
+stamp binaries `nightly` instead of `v<last release>-<n>-g<sha>`. You can also
+pass the version explicitly:
 
 ```bash
 ./release.sh v0.2.0

release.sh

@@ -4,7 +4,8 @@ set -euo pipefail
 cd "$(dirname "$0")"
 
 APP=sshkeeper
-VERSION=${VERSION:-${1:-$(git describe --tags --always --dirty 2>/dev/null || echo "dev")}}
+# --match 'v*' ignores the rolling `nightly` tag; see build.sh for the details.
+VERSION=${VERSION:-${1:-$(git describe --tags --match 'v*' --always --dirty 2>/dev/null || echo "dev")}}
 LDFLAGS="-s -w -X main.version=${VERSION}"
 DIST_DIR="dist"
 SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH:-$(git log -1 --format=%ct 2>/dev/null || date +%s)}