fix(docker): build cozy-stack directly without scripts/build.sh

scripts/build.sh derives the version from git describe / git rev-parse
on the COPY'd working tree, which fails inside the buildx container
(exit 128 with no captured output). Inline `go build` with a build-arg
version string sidesteps the whole bash + git chain.

The workflow passes VERSION_STRING=<tag>-<sha> so the running binary
reports a recognizable version.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: Crash--

.github/workflows/docker-s3-test.yml

@@ -55,5 +55,7 @@ jobs:
           tags: |
             ${{ steps.meta.outputs.image }}:${{ steps.meta.outputs.tag }}
             ${{ steps.meta.outputs.image }}:${{ steps.meta.outputs.sha_tag }}
+          build-args: |
+            VERSION_STRING=${{ steps.meta.outputs.tag }}-${{ github.sha }}
           cache-from: type=gha
           cache-to: type=gha,mode=max

scripts/docker/production/Dockerfile

@@ -14,13 +14,17 @@ RUN go mod download
 
 # Build cozy-stack
 COPY . .
-# scripts/build.sh runs `git describe` / `git rev-parse` to compute the
-# version string. When the working tree is COPY-ed into the container its
-# ownership no longer matches the host user, so recent git versions reject
-# operations on it ("detected dubious ownership"). Mark /app as safe so the
-# build step can read git metadata.
-RUN git config --global --add safe.directory /app \
- && ./scripts/build.sh release ./cozy-stack
+# Build directly instead of going through scripts/build.sh, which runs
+# `git describe` / `git rev-parse` and trips on the COPY'd working tree
+# inside the container. The version string can be overridden at build
+# time via --build-arg VERSION_STRING=...
+ARG VERSION_STRING=docker-build
+RUN BUILD_TIME="$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+ && go build \
+      -ldflags "-X github.com/cozy/cozy-stack/pkg/config.Version=${VERSION_STRING} \
+        -X github.com/cozy/cozy-stack/pkg/config.BuildTime=${BUILD_TIME} \
+        -X github.com/cozy/cozy-stack/pkg/config.BuildMode=production" \
+      -o ./cozy-stack
 
 
 # Multi-stage image: the main image