Publish static service version as JSON

.gitea/workflows/publish.yaml

@@ -40,6 +40,7 @@ jobs:
           test -s public/static/piper-wasm-v1/voices/sv/sv_SE/lisa/medium/sv_SE-lisa-medium.onnx
           test -s public/static/piper-wasm-v1/voices/sv/sv_SE/nst/medium/sv_SE-nst-medium.onnx
           test -s public/static/piper-wasm-v1/voices/ATTRIBUTION.txt
+          grep -q 'version.json' Dockerfile
 
       - name: Ensure Helm is available
         shell: bash
@@ -141,11 +142,11 @@ jobs:
 
           ready=false
           for attempt in $(seq 1 120); do
-            deployed="$(curl -fsS https://ai-spel.k3s.k0.nu/static/version.txt 2>/dev/null || true)"
+            deployed="$(curl -fsS https://ai-spel.k3s.k0.nu/static/version.json 2>/dev/null | python3 -c 'import json,sys; print(json.load(sys.stdin)["version"])' 2>/dev/null || true)"
             if [[ "$deployed" == "$version" ]]; then ready=true; break; fi
             sleep 5
           done
-          [[ "$ready" == true ]] || { echo "Static service did not report version $version"; exit 1; }
+          [[ "$ready" == true ]] || { echo "Static service did not report version $version in version.json"; exit 1; }
           for path in \
             /static/piper-wasm-v1/onnx/ort-wasm-simd-threaded.mjs \
             /static/piper-wasm-v1/onnx/ort-wasm-simd-threaded.wasm \

AGENTS.md

@@ -7,4 +7,5 @@
 - Git release commit/tag, image, Helm chart, and manifest use the same version.
 - Use Harbor project `ai-spel`, Argo CD project `ai-spel`, and Kubernetes namespace `ai-spel`.
 - `/static/piper-wasm-v1/` is immutable and cached for one year. Incompatible asset updates require a new path and coordinated frontend change.
+- Publish `/static/version.json` with `version` generated from `VERSION` in the same image as the Helm appVersion; keep it uncached and verify its value after rollout. The frontend footer displays this release independently from frontend and API versions.
 - No secrets or runtime network access.

Dockerfile

@@ -6,6 +6,7 @@ COPY nginx/default.conf /etc/nginx/conf.d/default.conf
 COPY public/static/ /usr/share/nginx/html/static/
 USER root
 RUN printf '%s\n' "$STATIC_VERSION" > /usr/share/nginx/html/static/version.txt && \
+    printf '{"version":"%s"}\n' "$STATIC_VERSION" > /usr/share/nginx/html/static/version.json && \
     chmod -R a+rX /usr/share/nginx/html/static
 USER 101
 EXPOSE 8080

README.md

@@ -12,6 +12,7 @@ Assets under `/static/piper-wasm-v1/` are served with `Cache-Control: public, ma
 - `/static/piper-wasm-v1/onnx/` — ONNX Runtime WASM and ES module loader.
 - `/static/piper-wasm-v1/piper/` — Piper phonemizer WASM and data.
 - `/static/version.txt` — active deployment version, without long-lived caching.
+- `/static/version.json` — active deployment version as `{"version":"<semver>"}`, generated from the same `VERSION` value used by the image and Helm chart and checked after deployment.
 
 The frontend worker remains bundled with the frontend; it fetches these large assets from same-origin static URLs. The browser does not request models from an external host.
 

nginx/default.conf

@@ -14,6 +14,13 @@ server {
         try_files $uri =404;
     }
 
+    location = /static/version.json {
+        default_type application/json;
+        add_header Cache-Control "no-store, no-cache, must-revalidate, max-age=0" always;
+        add_header Cross-Origin-Resource-Policy "same-origin" always;
+        try_files $uri =404;
+    }
+
     location ^~ /static/ {
         types {
             application/wasm wasm;

scripts/check-static.sh

@@ -10,5 +10,7 @@ grep -q 'max-age=31536000, immutable' nginx/default.conf
 grep -q 'application/javascript js mjs;' nginx/default.conf
 grep -q 'application/wasm wasm;' nginx/default.conf
 grep -Fq 'try_files $uri =404;' nginx/default.conf
+grep -q 'version.json' Dockerfile
+grep -q 'location = /static/version.json' nginx/default.conf
 node --test tests/*.test.cjs
 echo 'Static asset source checks passed.'