build: common-envs.mk mutates the checkout and fetches from the network at Makefile parse time when tags are absent #3643

Summary

hack/common-envs.mk lines 86-90 (605030b): when git describe --tags --match 'v*' returns empty, the fallback runs $(shell git remote add upstream https://github.com/cozystack/cozystack.git || true) and $(shell git fetch upstream --tags). Both execute at Makefile PARSE time, so any make invocation that includes this file, in any checkout where tags are absent, mutates the repository (adds a remote) and performs a network fetch before any target runs. make -n, the flag whose contract is "don't execute anything", triggers it too, because $(shell ...) in variable assignment context is evaluated during parsing, not during recipe execution.

Why it matters

The trigger condition, a checkout with no reachable v* tag, is the normal shape of a shallow or filtered clone, which is exactly what CI actions and third-party tooling create. Anything that parses the Makefile in such a checkout (an editor integration, a dry-run in a derived workflow, a unit test spawning make -n without pinning COZYSTACK_VERSION) silently gains a network dependency and leaves a upstream remote behind. A parse-time probe with side effects is also invisible in any audit that reads targets: no recipe mentions it.

Fix shape

Move the fallback out of parse time: either make COZYSTACK_VERSION lazily computed inside the targets that need it, or replace the fetch with a loud failure ("no v* tag reachable; fetch tags or pass COZYSTACK_VERSION=..."), letting the caller decide to go to the network. Callers that intentionally want the probe can keep it behind an explicit target.