Repository navigation
feat(api): /version endpoint exposing git SHA + build time for deploy verification #900
Description
Add a public GET /version endpoint returning the deployed build's version, git commit SHA, and build timestamp.
Why
Deploy-lag (an environment still serving a stale build) is currently hard to diagnose. With this endpoint an operator can curl https://<env>/version and compare git_sha to the branch HEAD to confirm what commit is actually running.
Scope
- Stamp the short git SHA into the binary via a new
main.GitSHAldflag (threaded through DockerGIT_COMMITbuild-arg and the Makefile). - Public (AuthPublic)
GET /versionreturning{version, git_sha, build_time}— no account IDs, ARNs, or secrets (not an info leak like sec(api): GET /api/info (unauthenticated) leaks Secrets Manager ARN including AWS account ID and region #437/sec(api): move APIKeySecretURL + DeploymentAWSAccountID out of unauthenticated /api/info (re-scope of #527) #633). - Register on the api router, the middleware public allowlist, and the container HTTP mux (root path, DB-independent).
Activity
cristim commentedon Jul 27, 2026
Verification sweep against
main(101f099fb) on 2026-07-27 finds this already resolved.The public GET /version endpoint now returns version, git_sha and build_time.
Evidence: commit 74148ec (#901).
Recommending close.
cristim commentedon Sep 2, 2026
Verified resolved at 3c0f8ac: a public GET /version endpoint returns version, git_sha and build_time, is registered on the API router, the middleware public allowlist and the container HTTP mux, and the git SHA is stamped via the main.GitSHA ldflag in the Makefile. Evidence: internal/api/router.go:369, internal/server/http.go:38, Makefile:23 (#901). Residual axes checked: Lambda router path, container mux path, SPA static fallback exclusion (internal/server/static.go:253); none found. Closing as completed; reopen if the behaviour recurs.