From cc9ee73a5fa479b85dda2ef4005b03eac922a1ae Mon Sep 17 00:00:00 2001
From: Ein Anderssono <einand@3gdev.com>
Date: Fri, 16 Oct 2026 07:35:54 +0200
Subject: [PATCH] Publish static service version as JSON

---
 .gitea/workflows/publish.yaml | 5 +++--
 AGENTS.md                     | 1 +
 Dockerfile                    | 1 +
 README.md                     | 1 +
 nginx/default.conf            | 7 +++++++
 scripts/check-static.sh       | 2 ++
 6 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/.gitea/workflows/publish.yaml b/.gitea/workflows/publish.yaml
index f2bd29d..45607f9 100644
--- a/.gitea/workflows/publish.yaml
+++ b/.gitea/workflows/publish.yaml
@@ -40,6 +40,7 @@ jobs:
           test -s public/static/piper-wasm-v1/voices/sv/sv_SE/lisa/medium/sv_SE-lisa-medium.onnx
           test -s public/static/piper-wasm-v1/voices/sv/sv_SE/nst/medium/sv_SE-nst-medium.onnx
           test -s public/static/piper-wasm-v1/voices/ATTRIBUTION.txt
+          grep -q 'version.json' Dockerfile
 
       - name: Ensure Helm is available
         shell: bash
@@ -141,11 +142,11 @@ jobs:
 
           ready=false
           for attempt in $(seq 1 120); do
-            deployed="$(curl -fsS https://ai-spel.k3s.k0.nu/static/version.txt 2>/dev/null || true)"
+            deployed="$(curl -fsS https://ai-spel.k3s.k0.nu/static/version.json 2>/dev/null | python3 -c 'import json,sys; print(json.load(sys.stdin)["version"])' 2>/dev/null || true)"
             if [[ "$deployed" == "$version" ]]; then ready=true; break; fi
             sleep 5
           done
-          [[ "$ready" == true ]] || { echo "Static service did not report version $version"; exit 1; }
+          [[ "$ready" == true ]] || { echo "Static service did not report version $version in version.json"; exit 1; }
           for path in \
             /static/piper-wasm-v1/onnx/ort-wasm-simd-threaded.mjs \
             /static/piper-wasm-v1/onnx/ort-wasm-simd-threaded.wasm \
diff --git a/AGENTS.md b/AGENTS.md
index 1ad6076..6871a9e 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -7,4 +7,5 @@
 - Git release commit/tag, image, Helm chart, and manifest use the same version.
 - Use Harbor project `ai-spel`, Argo CD project `ai-spel`, and Kubernetes namespace `ai-spel`.
 - `/static/piper-wasm-v1/` is immutable and cached for one year. Incompatible asset updates require a new path and coordinated frontend change.
+- Publish `/static/version.json` with `version` generated from `VERSION` in the same image as the Helm appVersion; keep it uncached and verify its value after rollout. The frontend footer displays this release independently from frontend and API versions.
 - No secrets or runtime network access.
diff --git a/Dockerfile b/Dockerfile
index 1094f02..cfdbd0e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -6,6 +6,7 @@ COPY nginx/default.conf /etc/nginx/conf.d/default.conf
 COPY public/static/ /usr/share/nginx/html/static/
 USER root
 RUN printf '%s\n' "$STATIC_VERSION" > /usr/share/nginx/html/static/version.txt && \
+    printf '{"version":"%s"}\n' "$STATIC_VERSION" > /usr/share/nginx/html/static/version.json && \
     chmod -R a+rX /usr/share/nginx/html/static
 USER 101
 EXPOSE 8080
diff --git a/README.md b/README.md
index 5f97ddb..239c397 100644
--- a/README.md
+++ b/README.md
@@ -12,6 +12,7 @@ Assets under `/static/piper-wasm-v1/` are served with `Cache-Control: public, ma
 - `/static/piper-wasm-v1/onnx/` — ONNX Runtime WASM and ES module loader.
 - `/static/piper-wasm-v1/piper/` — Piper phonemizer WASM and data.
 - `/static/version.txt` — active deployment version, without long-lived caching.
+- `/static/version.json` — active deployment version as `{"version":"<semver>"}`, generated from the same `VERSION` value used by the image and Helm chart and checked after deployment.
 
 The frontend worker remains bundled with the frontend; it fetches these large assets from same-origin static URLs. The browser does not request models from an external host.
 
diff --git a/nginx/default.conf b/nginx/default.conf
index 4edfd21..f554b1d 100644
--- a/nginx/default.conf
+++ b/nginx/default.conf
@@ -14,6 +14,13 @@ server {
         try_files $uri =404;
     }
 
+    location = /static/version.json {
+        default_type application/json;
+        add_header Cache-Control "no-store, no-cache, must-revalidate, max-age=0" always;
+        add_header Cross-Origin-Resource-Policy "same-origin" always;
+        try_files $uri =404;
+    }
+
     location ^~ /static/ {
         types {
             application/wasm wasm;
diff --git a/scripts/check-static.sh b/scripts/check-static.sh
index 4611067..9d9593d 100755
--- a/scripts/check-static.sh
+++ b/scripts/check-static.sh
@@ -10,5 +10,7 @@ grep -q 'max-age=31536000, immutable' nginx/default.conf
 grep -q 'application/javascript js mjs;' nginx/default.conf
 grep -q 'application/wasm wasm;' nginx/default.conf
 grep -Fq 'try_files $uri =404;' nginx/default.conf
+grep -q 'version.json' Dockerfile
+grep -q 'location = /static/version.json' nginx/default.conf
 node --test tests/*.test.cjs
 echo 'Static asset source checks passed.'