[tailscale] runtime/debug: embed Tailscale toolchain git rev

This is another take on #49 (which we stopped using?), and less
intrusive, and also always on.

This puts puts the the Tailscale Go toolchain's git rev in
the binary, accessible as runtime/debug.TailscaleGitRev.

Caller code will have to access it guarded by the "tailscale_go" build
tag.

Updates #49

Signed-off-by: Brad Fitzpatrick <[email protected]>

.github/workflows/build.yml

@@ -41,6 +41,8 @@ jobs:
       uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       with:
         ref: ${{ inputs.ref || github.ref }}
+    - name: set runtime/debug.TailscaleGitRev
+      run: echo ${{ github.sha }} > src/runtime/debug/tailscale-git-rev.txt
     - name: build
       run: cd src && ./make.bash
       env:

src/go/build/deps_test.go

@@ -777,6 +777,12 @@ func TestDependencies(t *testing.T) {
 		}
 		var bad []string
 		for _, imp := range imports {
+			if pkg == "runtime/debug" && imp == "embed" {
+				// Tailscale addition. Permit.
+				// Skipped here rather than in depsRules
+				// to minimize chance of rebase collisions.
+				continue
+			}
 			sawImport[pkg][imp] = true
 			if !policy.HasEdge(pkg, imp) {
 				bad = append(bad, imp)

src/runtime/debug/mod.go

@@ -9,8 +9,13 @@ import (
 	"runtime"
 	"strconv"
 	"strings"
+
+	_ "embed"
 )
 
+//go:embed tailscale-git-rev.txt
+var TailscaleGitRev string
+
 // exported from runtime.
 func modinfo() string
 

src/runtime/debug/tailscale-git-rev.txt

@@ -0,0 +1 @@
+to-be-set-by-github-actions-yml-on-before-make.bash