Add tag display in build details: fetch tags for commit SHA, show in build detail overlay

Author: alexhraber

README.md

@@ -247,16 +247,76 @@ internal/
 - **Log fetching**: `?content=true` with raw text fallback + `Accept: text/plain`; script steps only
 - **Step types handled**: `script` (logs), `waiter` (hidden), `trigger`/`deploy` (metadata only)
 
-## CI Pipeline
+## Dynamic Build Details (Tertiary Validation)
 
-The project uses Buildkite for its own CI (`.buildkite/pipeline.yml`):
+builddeck enriches build details and artifacts with data from dedicated pipeline steps — not from Buildkite itself. These are **tertiary validations**: Buildkite doesn't validate them; our dedicated steps do.
 
-1. **Lint & test** — `golangci-lint`, `go vet`, `go test`, `gosec`, `govulncheck`
-2. **Build** — `go build ./cmd/builddeck`
-3. **Checksum** — downloads binary, runs `sha256sum`, uploads `builddeck.sha256`
-4. **Release** — on tag push: builds multi-arch, creates GitHub Release, uploads binaries
+### Git Tag from Tag Step
 
-Pipeline reads from default branch — changes must be on `main` before PR builds pass.
+The **Tag step** (`:bookmark: Tag`) in the pipeline:
+1. Runs after all validation passes
+2. Analyzes conventional commits since last tag
+3. Creates/pushes semver tag (e.g., `v0.1.1`)
+3. builddeck queries Buildkite API for tags on the build's commit SHA
+4. Displays the tag in build details under the commit hash
+
+This is **not** Buildkite-managed — it's our step creating the tag, our TUI discovering it.
+
+### Artifact Checksum from Checksum Step
+
+The **Checksum step** (`:lock: Checksum`) in the pipeline:
+1. Downloads the binary artifact
+2. Runs `sha256sum` → produces `builddeck.sha256`
+3. Uploads `.sha256` as companion artifact
+4. builddeck detects `.sha256` artifacts, fetches them, parses the hash
+5. Displays checksum inline next to matching artifact
+
+This is **tertiary validation** — Buildkite doesn't compute or verify checksums; our dedicated step and TUI do.
+
+### Contract for Pipeline Authors
+
+To enable these features, add these steps to your pipeline:
+
+```yaml
+steps:
+  # ... your validation steps ...
+
+  - label: ":bookmark: Tag"
+    key: tag
+    depends_on:
+      - test
+      - lint
+      # ... all validation steps ...
+    command: |
+      # Auto-tag based on conventional commits
+      VERSION=$(determine_version_from_commits)
+      git tag -a "$VERSION" -m "Release $VERSION"
+      git push origin "$VERSION"
+
+  - label: ":golang: Build and Release"
+    key: build
+    depends_on: tag
+    command: |
+      # Build binary
+      # Query GitHub for tag on this commit SHA
+      VERSION=$(gh api repos/:owner/:repo/git/refs/tags --jq '.[] | select(.object.sha == "'$BUILDKITE_COMMIT'") | .ref' | sed 's|refs/tags/||')
+      go build -ldflags="-X main.version=$VERSION" ...
+
+  - label: ":lock: Checksum"
+    key: checksum
+    depends_on: build
+    command: |
+      buildkite-agent artifact download builddeck /tmp/
+      sha256sum /tmp/builddeck | tee builddeck.sha256
+      buildkite-agent artifact upload builddeck.sha256
+```
+
+The **Tag** step runs after all validation (fan-in), creates the tag.
+The **Checksum** step runs after build, creates `.sha256` companion artifact.
+
+builddeck automatically:
+- Queries tags for each build's commit SHA → shows in build details
+- Detects `.sha256` companion artifacts → shows checksum on artifacts
 
 ## Planned Next Features
 

internal/buildkite/client.go

@@ -419,3 +419,22 @@ func ParseAgentQueue(agent Agent) string {
 	}
 	return "default"
 }
+
+// GetTagsForCommit fetches tags pointing to a specific commit SHA
+func (c *Client) GetTagsForCommit(ctx context.Context, orgSlug, pipelineSlug, commitSHA string) ([]Tag, error) {
+	path := fmt.Sprintf("/organizations/%s/pipelines/%s/builds/%s/tags", orgSlug, pipelineSlug, commitSHA)
+	resp, err := c.get(ctx, path, nil)
+	if err != nil {
+		return nil, fmt.Errorf("getting tags for commit %s: %w", commitSHA, err)
+	}
+	var tags []Tag
+	if err := json.Unmarshal(resp.Body, &tags); err != nil {
+		return nil, fmt.Errorf("decoding tags for commit %s: %w", commitSHA, err)
+	}
+	return tags, nil
+}
+
+// ListTagsForCommit fetches tags for a commit (alias for GetTagsForCommit)
+func (c *Client) ListTagsForCommit(ctx context.Context, orgSlug, pipelineSlug, commitSHA string) ([]Tag, error) {
+	return c.GetTagsForCommit(ctx, orgSlug, pipelineSlug, commitSHA)
+}

internal/buildkite/types.go

@@ -108,3 +108,8 @@ type EmojiEntry struct {
 	Name string `json:"name"`
 	URL  string `json:"url"`
 }
+
+type Tag struct {
+	Name   string `json:"name"`
+	Commit string `json:"commit"`
+}

internal/tui/model.go

@@ -275,7 +275,15 @@ func loadBuildsCmd(client *buildkite.Client, orgSlug, pipelineSlug string) tea.C
 func loadBuildDetailCmd(client *buildkite.Client, orgSlug, pipelineSlug string, buildID string, buildNumber int) tea.Cmd {
 	return func() tea.Msg {
 		build, err := client.GetBuild(context.Background(), orgSlug, pipelineSlug, buildNumber)
-		return buildDetailMsg{buildID: buildID, build: build, err: err}
+		if err != nil {
+			return buildDetailMsg{buildID: buildID, build: build, err: err}
+		}
+		// Fetch tags for this build's commit
+		tags, _ := client.ListTagsForCommit(context.Background(), orgSlug, pipelineSlug, build.Commit)
+		if len(tags) > 0 {
+			build.Tag = tags[0].Name // Use first (most recent) tag
+		}
+		return buildDetailMsg{buildID: buildID, build: build, err: nil}
 	}
 }
 

internal/tui/views.go

@@ -1125,6 +1125,9 @@ func (m Model) statsOverlay(base string) string {
 			b.WriteString(fmt.Sprintf("  State:    %s\n", bd.State))
 			b.WriteString(fmt.Sprintf("  Branch:   %s\n", bd.Branch))
 			b.WriteString(fmt.Sprintf("  Commit:   %s\n", shortSHA(bd.Commit)))
+			if bd.Tag != "" {
+				b.WriteString(fmt.Sprintf("  Tag:      %s\n", bd.Tag))
+			}
 			msg := renderEmoji(strings.SplitN(bd.Message, "\n", 2)[0])
 			b.WriteString(fmt.Sprintf("  Message:  %s\n", msg))
 			if bd.Creator != nil {