From 389984f6d78adbdbcfd1302fdb720636f8795aed Mon Sep 17 00:00:00 2001
From: Andrew Nesbitt <andrewnez@gmail.com>
Date: Wed, 16 Sep 2026 09:23:41 +0100
Subject: [PATCH] Fall back to embedded build info for version vars

go install does not apply goreleaser's -ldflags -X, so binaries
installed that way reported 'dev'. Read debug.BuildInfo.Main.Version
when the ldflag is unset, in both places goreleaser targets.
---
 internal/cli/root.go | 11 +++++++++++
 sync.go              | 10 ++++++++++
 2 files changed, 21 insertions(+)

diff --git a/internal/cli/root.go b/internal/cli/root.go
index e4b0be0..c0d18c4 100644
--- a/internal/cli/root.go
+++ b/internal/cli/root.go
@@ -1,11 +1,22 @@
 package cli
 
 import (
+	"runtime/debug"
+
 	"github.com/spf13/cobra"
 )
 
 var version = "dev"
 
+func init() {
+	if version != "dev" {
+		return
+	}
+	if bi, ok := debug.ReadBuildInfo(); ok && bi.Main.Version != "" && bi.Main.Version != "(devel)" {
+		version = bi.Main.Version
+	}
+}
+
 func Root() *cobra.Command {
 	root := &cobra.Command{
 		Use:           "pin",
diff --git a/sync.go b/sync.go
index ce5cda3..c3badea 100644
--- a/sync.go
+++ b/sync.go
@@ -11,6 +11,7 @@ import (
 	"os"
 	"path"
 	"path/filepath"
+	"runtime/debug"
 	"slices"
 	"strings"
 
@@ -38,6 +39,15 @@ const (
 // `-X github.com/git-pkgs/pin.ToolVersion=X.Y.Z` ldflag.
 var ToolVersion = "dev"
 
+func init() {
+	if ToolVersion != "dev" {
+		return
+	}
+	if bi, ok := debug.ReadBuildInfo(); ok && bi.Main.Version != "" && bi.Main.Version != "(devel)" {
+		ToolVersion = bi.Main.Version
+	}
+}
+
 // SyncOptions configures pin.Sync / Client.Sync. RegistryURL, Forge,
 // SignatureMode, and VerifyProvenance are honoured by the top-level
 // pin.Sync shim only; pass them via ClientOptions when constructing a