I would recommend doing something similar to what you have in mind: placing the SHA1 in an untracked file, generated as part of the build/installation/deployment process. It's obviously easy to do (git rev-parse HEAD > filename
or perhaps git describe [--tags] > filename
), and it avoids doing anything crazy like ending up with a file that's different from what git's tracking.
Your code can then reference this file when it needs the version number, or a build process could incorporate the information into the final product. The latter is actually how git itself gets its version numbers - the build process grabs the version number out of the repo, then builds it into the executable.