make: evaluate the Git SHA only once