mkwheels: pin version for gh source builds; add --env

GitHub source tarballs have no .git, so dynamic-versioning projects
(NetExec uses poetry-dynamic-versioning) fail VCS detection during the
wheel build. gh mode now exports POETRY_DYNAMIC_VERSIONING_BYPASS and
SETUPTOOLS_SCM_PRETEND_VERSION set to --ver (harmless when unused), and
a repeatable --env KEY=VAL passes through any other build env (it also
overrides the auto-set vars).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2 files changed, 22 insertions, 2 deletions

diff --git a/README.md b/README.md
index 530a85c..71d2b10 100644
--- a/README.md
+++ b/README.md
@@ -33,9 +33,16 @@ dependency tree (PyPI deps and any `git+` deps) into wheels.
 - `--name PKG` — output name; defaults to the repo basename, lowercased.
 - `--tag TAG` — git tag to fetch; a leading `v` is stripped for naming, and the
   real ref is resolved by trying `<tag>` then `v<tag>`. Defaults to `--ver`.
+- `--env KEY=VAL` — extra env var for the source build (repeatable).
 - Epoch auto-derived from the GitHub release `published_at` (the repo must
   publish a GitHub Release for the tag).
 
+Because the source tarball has no `.git`, projects using dynamic versioning
+would fail VCS detection at build time. `gh` mode therefore sets
+`POETRY_DYNAMIC_VERSIONING_BYPASS` and `SETUPTOOLS_SCM_PRETEND_VERSION` to
+`--ver` automatically (harmless when unused); `--env` overrides them and adds
+anything else the build needs.
+
 Outputs `<name>-wheels-<ver>.tar.gz` and `requirements.txt` (pinned + hashed).
 Prints the md5sum and the resolved epoch. The `requirements.txt` is an audit
 record of the resolved versions, not the install input: the SlackBuild installs
diff --git a/mkwheels b/mkwheels
index 2808462..dfbbba9 100755
--- a/mkwheels
+++ b/mkwheels
@@ -39,6 +39,9 @@ Flags:
                     Defaults to the normalized --ver.
   --epoch N         SOURCE_DATE_EPOCH for the tarball mtime. Overrides the
                     auto-derived value.
+  --env KEY=VAL     Extra env var for the gh-mode source build (repeatable).
+                    gh mode already sets POETRY_DYNAMIC_VERSIONING_BYPASS and
+                    SETUPTOOLS_SCM_PRETEND_VERSION to --ver; --env overrides.
 
   OUTPUT            env var: output directory (default: current dir).
 
@@ -57,7 +60,7 @@ case "$mode" in
     *) usage >&2; exit 2 ;;
 esac
 
-name=""; ver=""; repo=""; tag=""; epoch=""
+name=""; ver=""; repo=""; tag=""; epoch=""; env_overrides=()
 while [ $# -gt 0 ]; do
     case "$1" in
         --name)  name=${2:-}; shift 2 ;;
@@ -65,6 +68,7 @@ while [ $# -gt 0 ]; do
         --repo)  repo=${2:-}; shift 2 ;;
         --tag)   tag=${2:-}; shift 2 ;;
         --epoch) epoch=${2:-}; shift 2 ;;
+        --env)   env_overrides+=("${2:-}"); shift 2 ;;
         -h|--help) usage; exit 0 ;;
         *) usage >&2; exit 2 ;;
     esac
@@ -145,6 +149,15 @@ else
     # wheel` builds the project and all its deps into the wheels dir.
     pip_action=wheel
     pip_spec="$src_dir"
+
+    # Source tarballs have no .git, so projects using dynamic versioning fail
+    # VCS detection. Pin the version for the two common tools (harmless when
+    # unused). Explicit --env wins (appended last).
+    build_env=(
+        "POETRY_DYNAMIC_VERSIONING_BYPASS=$ver"
+        "SETUPTOOLS_SCM_PRETEND_VERSION=$ver"
+        ${env_overrides[@]+"${env_overrides[@]}"}
+    )
 fi
 
 export SOURCE_DATE_EPOCH="$epoch"
@@ -164,7 +177,7 @@ python3 -m venv "$work/venv"
 if [ "$pip_action" = download ]; then
     "$work/venv/bin/pip" download "$pip_spec" --dest "$wheels"
 else
-    "$work/venv/bin/pip" wheel "$pip_spec" --wheel-dir "$wheels"
+    env "${build_env[@]}" "$work/venv/bin/pip" wheel "$pip_spec" --wheel-dir "$wheels"
 fi
 
 # Emit a pinned, hashed requirements.txt from the downloaded files. Each