Fix standalone setup.cmake version resolution to avoid invalid vX.Y.Z checkout

[Copilot]

Quick-start usage of downloaded setup.cmake (curl ... && cmake -P setup.cmake) could not resolve a local git tag, emitted X.Y.Z, and generated CPMAddPackage("gh:stlab/cpp-library@X.Y.Z"), which fails at checkout. This change makes standalone setup resolve a valid ref instead of producing an unusable placeholder.

• Version resolution in setup.cmake

  • Keep current behavior when local git tags exist (git describe --tags --abbrev=0).
  • Add standalone fallback: query remote tags from stlab/cpp-library, extract semver tags, and select the latest version.
  • Add a bounded network lookup (TIMEOUT 10) to avoid hanging on restricted networks.
  • Replace placeholder fallback from X.Y.Z to main as a safe last resort.

• Regression coverage for quick-start path

  • Add tests/setup/test_setup_version_resolution.cmake to exercise the standalone-script flow.
  • Assert generated project CMakeLists:
    • does not contain @X.Y.Z
    • contains @<semver> or @main

• CI integration

  • Run the new setup-version regression test in the unit test job.

# Generated by standalone setup flow (now guaranteed valid)
CPMAddPackage("gh:stlab/cpp-library@5.2.0")
# ...or fallback:
CPMAddPackage("gh:stlab/cpp-library@main")

---

Note

Medium Risk
Moderate risk because it changes version/ref selection logic in setup.cmake and introduces a network-dependent fallback (git ls-remote, timeout 10s) that could behave differently across environments.

Overview
Fixes standalone setup.cmake generation so it no longer emits an unusable CPMAddPackage("...@X.Y.Z") placeholder when no local git tags are available.

setup.cmake now resolves the cpp-library ref by preferring local git describe, otherwise querying remote tags and selecting the latest semver (excluding prerelease tag substrings), and finally falling back to #main; it also switches CPM usage to @<semver> for releases and #<ref> for branches/commits. Adds a new tests/setup/test_setup_version_resolution.cmake regression test and runs it in CI.

^{Reviewed by Cursor Bugbot for commit a2b55bb. Bugbot is set up for automated code reviews on this repo. Configure here.}

[sean-parent]

LGTM

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit dcab025. Configure here.}