windows: do not build the binaries from a "dirty" checkout, see #10199

The 2.0.0b23 Windows binaries call themselves
"2.0.0b24.dev0+g116435fa4.d20260823": actions/checkout runs Git for
Windows, whose system config sets core.autocrlf=true, so the worktree
gets CRLF line endings. The msys2 git the build steps use does not set
it, thus sees every text file as modified, and setuptools-scm builds a
guessed-next .devN version instead of the version of the tag.

- .gitattributes: store and check out text files with LF everywhere.
  logo.pdf has no NUL byte within the first 8000 bytes, so git would
  auto-detect it as text - it needs an explicit -text.
- ci.yml: also switch core.autocrlf off before checkout, so that
  building an older tag (which has no such .gitattributes) works, too.
- release.yml: refuse to publish a sdist that is not the tag version.

Co-Authored-By: Claude Opus 5 <[email protected]>

.gitattributes

@@ -1,5 +1,14 @@
 borg/_version.py export-subst
 
+# Store text files with LF and check them out with LF everywhere, so that a
+# Windows checkout is not seen as modified by a git with a different
+# core.autocrlf setting - that made setuptools-scm build the Windows binaries
+# from a "dirty" checkout and give them a wrong version, see #10199.
+* text=auto eol=lf
+# git auto-detects binary content by looking for a NUL byte in the first 8000
+# bytes; logo.pdf is small enough to have none, so tell git explicitly.
+*.pdf -text
+
 *.py diff=python
 docs/usage/*.rst.inc merge=ours
 docs/man/* merge=ours

.github/workflows/ci.yml

@@ -724,6 +724,16 @@ jobs:
         shell: msys2 {0}
 
     steps:
+      # actions/checkout runs Git for Windows, whose system config sets
+      # core.autocrlf=true, while the msys2 git the build steps below use does
+      # not: it would see every text file as modified, so setuptools-scm called
+      # the checkout dirty and gave the binaries a guessed-next .devN version
+      # instead of the tag version, see #10199.  .gitattributes takes care of
+      # this as well, this is here so that it also works for older tags.
+      - name: Do not convert line endings on checkout
+        shell: pwsh
+        run: git config --global core.autocrlf false
+
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 0

.github/workflows/release.yml

@@ -83,6 +83,25 @@ jobs:
         twine check dist/*
         ls -l dist/
 
+    - name: Check that the sdist has the version of the tag
+      # If the checkout is modified, setuptools-scm does not use the tag as the
+      # version, but silently guesses the next one and appends .devN, see
+      # #10199. Such a release must not be uploaded to PyPI.
+      env:
+        TAG: ${{ github.ref_name }}
+      run: |
+        set -euxo pipefail
+        python - "$TAG" dist/borgbackup-*.tar.gz <<'EOF'
+        import sys
+        from packaging.utils import parse_sdist_filename
+        from packaging.version import Version
+        tag, sdist = sys.argv[1], sys.argv[2]
+        _, version = parse_sdist_filename(sdist.rpartition("/")[2])
+        if version != Version(tag):
+            raise SystemExit(f"sdist version {version} is not the tag version {tag} - modified checkout?")
+        print(f"sdist version {version} is the tag version.")
+        EOF
+
     - name: Check that the sdist is complete and installable
       # A release that cannot be installed from PyPI is the worst kind of
       # release, and nothing else in CI ever installs borg from a sdist or