Extract commit hash from git archive and local docker deployment

Signed-off-by: Keshav Priyadarshi <git@keshav.space>

Author: keshav-space

Dockerfile

@@ -28,3 +28,10 @@ COPY setup.cfg setup.py requirements.txt pyproject.toml /app/
 RUN pip install . -c requirements.txt
 
 COPY . /app
+
+# Store commit hash for docker deployment from local checkout.
+RUN if [ -d ".git" ]; then \
+  GIT_COMMIT=$(git rev-parse --short HEAD) && \
+  echo "VULNERABLECODE_GIT_COMMIT=\"$GIT_COMMIT\"" >> /app/vulnerablecode/settings.py; \
+  rm -rf .git; \
+fi

vulnerablecode/__init__.py

@@ -30,11 +30,36 @@ def get_git_describe_from_local_checkout():
         return git.Repo(".").git.describe(tags=True, always=True)
 
 
+def get_git_commit_from_version_file():
+    """
+    Return the git commit from the ".VERSION" file.
+    This will only provide a result when the codebase is an extracted git archive.
+    """
+    version_file = ROOT_DIR / ".VERSION"
+    if not version_file.exists():
+        return
+
+    try:
+        lines = version_file.read_text().splitlines()
+        commit_line = lines[1]
+        if not commit_line.startswith("commit=") or commit_line.startswith("commit=$Format"):
+            return
+        return commit_line.replace("commit=", "")
+    except (UnicodeDecodeError):
+        return
+
+
 def get_short_commit():
     """
-    Return the short commit hash from a Git describe string while removing
-    any leading "g" character if present.
+    Return the short commit hash from the .VERSION file or from `git describe`
+    in a local checkout or docker deployment using a local checkout.
     """
+    from vulnerablecode import settings
+
+    if short_commit := get_git_commit_from_version_file():
+        return short_commit
+    if hasattr(settings, "VULNERABLECODE_GIT_COMMIT"):
+        return settings.VULNERABLECODE_GIT_COMMIT
     if git_describe := get_git_describe_from_local_checkout():
         short_commit = git_describe.split("-")[-1]
         return short_commit.lstrip("g")