Summary
hack/common-envs.mk lines 86-90 (605030b): when git describe --tags --match 'v*' returns empty, the fallback runs $(shell git remote add upstream https://github.com/cozystack/cozystack.git || true) and $(shell git fetch upstream --tags). Both execute at Makefile PARSE time, so any make invocation that includes this file, in any checkout where tags are absent, mutates the repository (adds a remote) and performs a network fetch before any target runs. make -n, the flag whose contract is "don't execute anything", triggers it too, because $(shell ...) in variable assignment context is evaluated during parsing, not during recipe execution.
Why it matters
The trigger condition, a checkout with no reachable v* tag, is the normal shape of a shallow or filtered clone, which is exactly what CI actions and third-party tooling create. Anything that parses the Makefile in such a checkout (an editor integration, a dry-run in a derived workflow, a unit test spawning make -n without pinning COZYSTACK_VERSION) silently gains a network dependency and leaves a upstream remote behind. A parse-time probe with side effects is also invisible in any audit that reads targets: no recipe mentions it.
Fix shape
Move the fallback out of parse time: either make COZYSTACK_VERSION lazily computed inside the targets that need it, or replace the fetch with a loud failure ("no v* tag reachable; fetch tags or pass COZYSTACK_VERSION=..."), letting the caller decide to go to the network. Callers that intentionally want the probe can keep it behind an explicit target.
Summary
hack/common-envs.mklines 86-90 (605030b): whengit describe --tags --match 'v*'returns empty, the fallback runs$(shell git remote add upstream https://github.com/cozystack/cozystack.git || true)and$(shell git fetch upstream --tags). Both execute at Makefile PARSE time, so any make invocation that includes this file, in any checkout where tags are absent, mutates the repository (adds a remote) and performs a network fetch before any target runs.make -n, the flag whose contract is "don't execute anything", triggers it too, because$(shell ...)in variable assignment context is evaluated during parsing, not during recipe execution.Why it matters
The trigger condition, a checkout with no reachable
v*tag, is the normal shape of a shallow or filtered clone, which is exactly what CI actions and third-party tooling create. Anything that parses the Makefile in such a checkout (an editor integration, a dry-run in a derived workflow, a unit test spawningmake -nwithout pinningCOZYSTACK_VERSION) silently gains a network dependency and leaves aupstreamremote behind. A parse-time probe with side effects is also invisible in any audit that reads targets: no recipe mentions it.Fix shape
Move the fallback out of parse time: either make
COZYSTACK_VERSIONlazily computed inside the targets that need it, or replace the fetch with a loud failure ("no v* tag reachable; fetch tags or pass COZYSTACK_VERSION=..."), letting the caller decide to go to the network. Callers that intentionally want the probe can keep it behind an explicit target.