From d3b5308097c1b0e963a8bd8d9d84fe06ba5db250 Mon Sep 17 00:00:00 2001
From: Ein Anderssono <einand@3gdev.com>
Date: Fri, 16 Oct 2026 07:36:01 +0200
Subject: [PATCH] Show static service version in frontend footer

---
 AGENTS.md                 | 1 +
 README.md                 | 2 ++
 index.html                | 7 ++++++-
 scripts/check-frontend.sh | 2 ++
 4 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/AGENTS.md b/AGENTS.md
index aaba0d5..14d7590 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -3,6 +3,7 @@
 - This repository owns only the static, accessible web client and its container/chart packaging.
 - Rust remains the sole authority for game state. The frontend calls the backend through same-origin `/api/...` and `/version` paths.
 - Keep frontend and backend behind `ai-spel.k3s.k0.nu` so session cookies remain same-origin.
+- The public footer displays frontend, static-service, and API versions; load static-service version from uncached `/static/version.json`.
 - `VERSION` is the only release-version source in this repository. Use `scripts/bump-version.py`; do not manually edit chart versions.
 - Changes are written locally and built, checked, published, and exercised by Gitea Actions on the existing `large` runner and Kubernetes. Never run apps, tests, containers, images, or binaries locally. Do not create or register runners.
 - Never commit secrets, generated credentials, kubeconfigs, or environment files.
diff --git a/README.md b/README.md
index 9f3ca37..f583816 100644
--- a/README.md
+++ b/README.md
@@ -26,6 +26,8 @@ On iPhone and iPad, Safari requires a user gesture to unlock Web Audio. The fron
 
 The browser and API stay on the same public origin, `https://ai-spel.k3s.k0.nu`. The ingress routes `/` to this frontend service and routes `/api`, `/version`, and `/health` to the Rust service. That keeps the current server-side session cookie same-origin and avoids browser CORS configuration.
 
+The public footer displays the frontend, static-service, and API versions. It fetches `/static/version.json` without caching; the static service creates that file from its sole `VERSION` source during the same image build used for the matching Helm chart and release tag.
+
 ## Release flow
 
 `VERSION` is the only version source for this repository. Gitea Actions on the existing `large` runner runs the static checks, Helm lint/template, publishes a commit image, bumps the patch version through `scripts/bump-version.py`, creates the matching release commit and Git tag, and publishes the release image, Helm chart, and rendered frontend manifest to Harbor. Argo CD tracks the newest published frontend chart. The image and chart releases use the same version as the commit and tag.
diff --git a/index.html b/index.html
index aa81bd2..49e5dd6 100644
--- a/index.html
+++ b/index.html
@@ -71,7 +71,7 @@
       <div id="admin-content" aria-live="polite" aria-busy="false"></div>
     </section>
   </main>
-  <footer id="version-footer">Frontend <span id="frontend-version">__FRONTEND_VERSION__</span> · API <span id="api-version">hämtar version…</span></footer>
+  <footer id="version-footer">Frontend <span id="frontend-version">__FRONTEND_VERSION__</span> · Statik <span id="static-version">hämtar version…</span> · API <span id="api-version">hämtar version…</span></footer>
   <script src="/piper-runtime.js?v=__FRONTEND_VERSION__"></script>
   <script src="/voice.js?v=__FRONTEND_VERSION__"></script>
   <script>
@@ -863,6 +863,11 @@
     }).catch(() => {
       document.querySelector('#api-version').textContent = 'otillgänglig';
     });
+    request('/static/version.json', {cache: 'no-store'}).then(({version}) => {
+      document.querySelector('#static-version').textContent = version;
+    }).catch(() => {
+      document.querySelector('#static-version').textContent = 'otillgänglig';
+    });
     request('/api/me').then(() => location.pathname === '/admin' ? openAdmin() : openGame()).catch(showAuth);
   </script>
 </body>
diff --git a/scripts/check-frontend.sh b/scripts/check-frontend.sh
index f34955a..6df01a2 100755
--- a/scripts/check-frontend.sh
+++ b/scripts/check-frontend.sh
@@ -12,6 +12,8 @@ grep -q 'add_header Cross-Origin-Embedder-Policy "require-corp" always;' nginx/d
 grep -q 'add_header Cross-Origin-Resource-Policy "same-origin" always;' nginx/default.conf
 grep -q 'application/javascript js mjs;' nginx/default.conf
 grep -q "request('/version')" index.html
+grep -q 'id="static-version">hämtar version…' index.html
+grep -q "request('/static/version.json', {cache: 'no-store'})" index.html
 grep -Fq "credentials: 'same-origin'" index.html
 grep -q 'id="dialogue" aria-label="Dialoghistorik" role="log" aria-live="polite"' index.html
 grep -q 'id="message" name="message"' index.html