feat: expose build identity for release verification

internal/transport/httpserver/server.go

@@ -7,6 +7,7 @@ import (
 	"net/http"
 	"time"
 
+	"git.yuntuo.hk/k2safe/orbit/internal/buildinfo"
 	"git.yuntuo.hk/k2safe/orbit/internal/observability"
 	"git.yuntuo.hk/k2safe/orbit/pulse/service"
 )
@@ -32,6 +33,13 @@ func New(addr string, ready Checker, tasks ...*service.Service) *http.Server {
 		}
 		write(w, http.StatusOK, map[string]string{"status": "ready", "scope": "database_and_schema"})
 	})
+	mux.HandleFunc("GET /version", func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Cache-Control", "no-store")
+		w.Header().Set("X-Content-Type-Options", "nosniff")
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusOK)
+		_ = json.NewEncoder(w).Encode(buildinfo.Current())
+	})
 	if len(tasks) > 0 && tasks[0] != nil {
 		registerTasks(mux, tasks[0])
 		registerHistory(mux, tasks[0])

internal/transport/httpserver/server_test.go

@@ -22,6 +22,15 @@ func TestHealthSeparatesLivenessAndReadiness(t *testing.T) {
 	}
 }
 
+func TestVersionIsPublicAndBounded(t *testing.T) {
+	server := New("127.0.0.1:0", nil)
+	rr := httptest.NewRecorder()
+	server.Handler.ServeHTTP(rr, httptest.NewRequest(http.MethodGet, "/version", nil))
+	if rr.Code != http.StatusOK || !strings.Contains(rr.Body.String(), `"http_protocol_version":"1"`) || strings.Contains(rr.Body.String(), "ORBIT_MYSQL_DSN") {
+		t.Fatalf("unexpected version response: %d %s", rr.Code, rr.Body.String())
+	}
+}
+
 func TestMetricsListenerIsSeparateAndOptional(t *testing.T) {
 	metrics := observability.NewRegistry()
 	business := New("", nil)