[chore] commit id display on version

.gitea/workflows/publish-snapshot.yml

@@ -123,7 +123,10 @@ jobs:
             # `g` prefix keeps the identifier a valid semver one even when the
             # abbreviated sha happens to be all digits.
             version="${base}-main.${{ github.run_number }}.g${short_sha}"
-            (cd "$dir" && npm pkg set "version=${version}")
+            # `buildInfo.commit` is what `nopy --version` annotates itself with.
+            # An unknown top-level key is ignored by npm and package.json is
+            # always in the tarball, so it ships without any `files` change.
+            (cd "$dir" && npm pkg set "version=${version}" "buildInfo.commit=${short_sha}")
           done
 
           # Pass 2: publish.

.gitea/workflows/release.yml

@@ -165,6 +165,20 @@ jobs:
         # Explicit, so the publish steps can skip lifecycle scripts entirely.
         run: pnpm run build
 
+      - name: Stamp the commit into the manifest
+        # What `nopy --version` annotates itself with. The version is untouched:
+        # this only adds a `buildInfo.commit` key, which npm ignores and which
+        # ships regardless of `files` because package.json is always packed.
+        # Before the pack below, so the artefact under test is the one publish
+        # ships. The tree is left dirty, which is why both publish steps pass
+        # --no-git-checks — they already did, for the detached HEAD.
+        env:
+          DIR: ${{ steps.target.outputs.dir }}
+        run: |
+          set -euo pipefail
+          short_sha=$(git rev-parse --short=7 HEAD)
+          (cd "$DIR" && npm pkg set "buildInfo.commit=${short_sha}")
+
       - name: Verify the packed manifests
         # Packages link to each other with `workspace:*`, which npm cannot
         # install. Proves on the tarball that pack rewrote it.