fix(web): take git SHA from Coolify's runtime SOURCE_COMMIT

The .git-COPY approach from a35e6c9 never actually deployed: BuildKit
rejected `COPY .git /tmp/.git` with "failed to calculate checks"
because Coolify's build context doesn't include .git, so deploy 86
failed and the stale 0144cb2 image kept serving "build dev" in the
footer.

Coolify v4 already injects SOURCE_COMMIT into the container env at
runtime by default (build-time only on opt-in, since it busts the
build cache by definition). Map SOURCE_COMMIT → GIT_COMMIT in
docker-compose, drop the build-time SHA stamping (and the repo-root
build context that only existed to reach .git), and shrink
_read_git_commit to a one-liner getenv.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -1,16 +1,15 @@
 services:
   web:
-    build:
+    build: ./web
-      # Context is the repo root so the Dockerfile can read .git for the
-      # SHA stamp — Coolify doesn't expose the commit as an env var.
-      context: .
-      dockerfile: web/Dockerfile
     container_name: lazyflat-web
     restart: unless-stopped
     depends_on:
       apply:
         condition: service_started
     environment:
+      # Coolify injects SOURCE_COMMIT at runtime on every deploy; settings.py
+      # reads GIT_COMMIT and renders it in the footer.
+      - GIT_COMMIT=${SOURCE_COMMIT:-dev}
       - AUTH_USERNAME=${AUTH_USERNAME}
       - AUTH_PASSWORD_HASH=${AUTH_PASSWORD_HASH}
       - SESSION_SECRET=${SESSION_SECRET}

web/Dockerfile

@@ -4,29 +4,11 @@ ENV PYTHONUNBUFFERED=1
 WORKDIR /app
 
 # Deps first so a code-only change doesn't bust the pip-install cache.
-COPY web/requirements.txt .
+COPY requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt
 
 # App code.
-COPY web/ .
+COPY . .
-
-# Stamp with the git SHA read from the build context's .git dir. Kept last so
-# only this thin layer invalidates per commit. Coolify doesn't expose the SHA
-# as an env/build-arg, but it does leave .git intact in the checkout — so we
-# parse HEAD ourselves. Build context must be the repo root for .git to be
-# visible (see docker-compose.yml).
-COPY .git /tmp/.git
-RUN set -eu; \
-    HEAD=$(cat /tmp/.git/HEAD 2>/dev/null || echo ""); \
-    case "$HEAD" in \
-      "ref: "*) REF=$(printf '%s' "$HEAD" | awk '{print $2}'); \
-                SHA=$(cat "/tmp/.git/$REF" 2>/dev/null || \
-                      awk -v r="$REF" '$2==r {print $1}' /tmp/.git/packed-refs 2>/dev/null || \
-                      echo "");; \
-      *) SHA="$HEAD";; \
-    esac; \
-    printf '%s\n' "${SHA:-dev}" > /git_commit; \
-    rm -rf /tmp/.git
 
 EXPOSE 8000
 

web/settings.py

@@ -61,19 +61,7 @@ ANTHROPIC_API_KEY: str = getenv("ANTHROPIC_API_KEY", "")
 ANTHROPIC_MODEL: str = getenv("ANTHROPIC_MODEL", "claude-haiku-4-5-20251001")
 
 # --- Build info --------------------------------------------------------------
-# The Dockerfile writes /git_commit at build time by parsing the repo's .git
+# Coolify injects SOURCE_COMMIT into the container's runtime env on every
-# dir (Coolify doesn't expose the SHA as an env var). Env GIT_COMMIT overrides
+# deploy; docker-compose.yml maps it to GIT_COMMIT. Rendered in the site
-# the file so local dev can fake a value. Rendered in the site footer so the
+# footer so the running commit is visible at a glance.
-# running commit is visible at a glance.
+GIT_COMMIT: str = getenv("GIT_COMMIT", "").strip() or "dev"
-def _read_git_commit() -> str:
-    env_val = getenv("GIT_COMMIT", "").strip()
-    if env_val:
-        return env_val
-    try:
-        with open("/git_commit") as _f:
-            return _f.read().strip() or "dev"
-    except OSError:
-        return "dev"
-
-
-GIT_COMMIT: str = _read_git_commit()