Show static service version in frontend footer

AGENTS.md

@@ -3,6 +3,7 @@
 - This repository owns only the static, accessible web client and its container/chart packaging.
 - Rust remains the sole authority for game state. The frontend calls the backend through same-origin `/api/...` and `/version` paths.
 - Keep frontend and backend behind `ai-spel.k3s.k0.nu` so session cookies remain same-origin.
+- The public footer displays frontend, static-service, and API versions; load static-service version from uncached `/static/version.json`.
 - `VERSION` is the only release-version source in this repository. Use `scripts/bump-version.py`; do not manually edit chart versions.
 - Changes are written locally and built, checked, published, and exercised by Gitea Actions on the existing `large` runner and Kubernetes. Never run apps, tests, containers, images, or binaries locally. Do not create or register runners.
 - Never commit secrets, generated credentials, kubeconfigs, or environment files.

README.md

@@ -26,6 +26,8 @@ On iPhone and iPad, Safari requires a user gesture to unlock Web Audio. The fron
 
 The browser and API stay on the same public origin, `https://ai-spel.k3s.k0.nu`. The ingress routes `/` to this frontend service and routes `/api`, `/version`, and `/health` to the Rust service. That keeps the current server-side session cookie same-origin and avoids browser CORS configuration.
 
+The public footer displays the frontend, static-service, and API versions. It fetches `/static/version.json` without caching; the static service creates that file from its sole `VERSION` source during the same image build used for the matching Helm chart and release tag.
+
 ## Release flow
 
 `VERSION` is the only version source for this repository. Gitea Actions on the existing `large` runner runs the static checks, Helm lint/template, publishes a commit image, bumps the patch version through `scripts/bump-version.py`, creates the matching release commit and Git tag, and publishes the release image, Helm chart, and rendered frontend manifest to Harbor. Argo CD tracks the newest published frontend chart. The image and chart releases use the same version as the commit and tag.

index.html

@@ -71,7 +71,7 @@
       <div id="admin-content" aria-live="polite" aria-busy="false"></div>
     </section>
   </main>
-  <footer id="version-footer">Frontend <span id="frontend-version">__FRONTEND_VERSION__</span> · API <span id="api-version">hämtar version…</span></footer>
+  <footer id="version-footer">Frontend <span id="frontend-version">__FRONTEND_VERSION__</span> · Statik <span id="static-version">hämtar version…</span> · API <span id="api-version">hämtar version…</span></footer>
   <script src="/piper-runtime.js?v=__FRONTEND_VERSION__"></script>
   <script src="/voice.js?v=__FRONTEND_VERSION__"></script>
   <script>
@@ -863,6 +863,11 @@
     }).catch(() => {
       document.querySelector('#api-version').textContent = 'otillgänglig';
     });
+    request('/static/version.json', {cache: 'no-store'}).then(({version}) => {
+      document.querySelector('#static-version').textContent = version;
+    }).catch(() => {
+      document.querySelector('#static-version').textContent = 'otillgänglig';
+    });
     request('/api/me').then(() => location.pathname === '/admin' ? openAdmin() : openGame()).catch(showAuth);
   </script>
 </body>

scripts/check-frontend.sh

@@ -12,6 +12,8 @@ grep -q 'add_header Cross-Origin-Embedder-Policy "require-corp" always;' nginx/d
 grep -q 'add_header Cross-Origin-Resource-Policy "same-origin" always;' nginx/default.conf
 grep -q 'application/javascript js mjs;' nginx/default.conf
 grep -q "request('/version')" index.html
+grep -q 'id="static-version">hämtar version…' index.html
+grep -q "request('/static/version.json', {cache: 'no-store'})" index.html
 grep -Fq "credentials: 'same-origin'" index.html
 grep -q 'id="dialogue" aria-label="Dialoghistorik" role="log" aria-live="polite"' index.html
 grep -q 'id="message" name="message"' index.html