build: add reproducible release bundles

cmd/rvbox/main.go

@@ -26,6 +26,9 @@ import (
 	"google.golang.org/protobuf/types/known/timestamppb"
 )
 
+// buildVersion is set by scripts/release for published artifacts.
+var buildVersion = "dev"
+
 func main() {
 	if err := run(os.Args[1:], os.Stdout, os.Stderr); err != nil {
 		fmt.Fprintln(os.Stderr, "rvbox:", err)
@@ -39,6 +42,10 @@ var nativeTestContextFailures map[clientwindows.ExecutionContext]bool
 // --service with an explicit config path; tray/helper modes cannot silently
 // turn an ordinary process invocation into a privileged service.
 func run(args []string, output, diagnostics io.Writer) error {
+	if len(args) == 1 && args[0] == "--version" {
+		_, err := fmt.Fprintln(output, buildVersion)
+		return err
+	}
 	if len(args) == 0 {
 		return errors.New("an internal mode is required (use --help)")
 	}

cmd/rvbox/main_test.go

@@ -23,6 +23,14 @@ func TestClientModeSelectionRequiresExactlyOneMode_HP_WINCLI_01(t *testing.T) {
 	}
 }
 
+func TestClientVersionDoesNotRequireConfiguration_HP_WINCLI_03(t *testing.T) {
+	t.Parallel()
+	var output, diagnostics bytes.Buffer
+	if err := run([]string{"--version"}, &output, &diagnostics); err != nil || output.String() != "dev\n" {
+		t.Fatalf("version = %q, %v", output.String(), err)
+	}
+}
+
 func TestClientHTTPClientAcceptsMatchingSelfSignedLeaf(t *testing.T) {
 	t.Parallel()
 	server := httptest.NewTLSServer(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {