feat(version): answer the build commit and time

GET /api/version is public. CI passes GIT_SHA and BUILD_TIME as Docker build args; a local build answers dev.

src/main/java/core_service/configuration/security/SecurityConfig.java

@@ -32,7 +32,8 @@ public class SecurityConfig {
             "/actuator/health",       // Docker health check; details are off
             "/error",
             "/api/stats/public",
-            "/api/public/**"          // Public profiles; PublicProfileController checks the ticket
+            "/api/public/**",         // Public profiles; PublicProfileController checks the ticket
+            "/api/version"            // Build of the running image, shown in the settings
     };
 
     private final OncePerRequestFilter jwtAuthFilter;

src/main/java/core_service/modules/version/api/VersionController.java

@@ -0,0 +1,22 @@
+package core_service.modules.version.api;
+
+import core_service.modules.version.api.dto.VersionDto;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+@RestController
+public class VersionController {
+
+    private final VersionDto version;
+
+    public VersionController(@Value("${app.build.commit}") String commit, @Value("${app.build.time}") String builtAt) {
+        this.version = new VersionDto(commit.isBlank() ? "dev" : commit, builtAt.isBlank() ? null : builtAt);
+    }
+
+    @GetMapping("/api/version")
+    public ResponseEntity<VersionDto> getVersion() {
+        return ResponseEntity.ok(version);
+    }
+}

src/main/java/core_service/modules/version/api/dto/VersionDto.java

@@ -0,0 +1,7 @@
+package core_service.modules.version.api.dto;
+
+/**
+ * @param commit full git hash the image was built from, "dev" outside the CI build
+ * @param builtAt ISO-8601 UTC build time, null outside the CI build
+ */
+public record VersionDto(String commit, String builtAt) {}

src/main/resources/application.yml

@@ -38,6 +38,10 @@ security:
     public-key: ${JWT_PUBLIC_KEY:}
     jwks-url: ${JWT_JWKS_URL:}
 app:
+  build:
+    # Filled from the CI run by the Dockerfile.
+    commit: ${APP_BUILD_COMMIT:dev}
+    time: ${APP_BUILD_TIME:}
   cors:
     allowed-origins: "https://tbp.andreas-dahm.eu"
   steam:

src/test/java/core_service/configuration/security/PublicEndpointsTest.java

@@ -90,4 +90,11 @@ class PublicEndpointsTest {
         mockMvc.perform(get("/api/public/profiles/library")).andExpect(status().isUnauthorized())
                 .andExpect(jsonPath("$.code").value("INVALID_TICKET"));
     }
+
+    @Test
+    void versionIsPublic() throws Exception {
+        mockMvc.perform(get("/api/version"))
+                .andExpect(status().isOk())
+                .andExpect(jsonPath("$.commit").isString());
+    }
 }

src/test/java/core_service/modules/version/api/VersionControllerTest.java

@@ -0,0 +1,24 @@
+package core_service.modules.version.api;
+
+import core_service.modules.version.api.dto.VersionDto;
+import core_service.shared.test.AbstractUnitTest;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+class VersionControllerTest extends AbstractUnitTest {
+
+    @Test
+    void answersTheBuildOfTheImage() {
+        VersionDto version = new VersionController("4ec47f1aa0b1", "2026-09-27T08:05:00Z").getVersion().getBody();
+
+        assertEquals(new VersionDto("4ec47f1aa0b1", "2026-09-27T08:05:00Z"), version);
+    }
+
+    @Test
+    void emptyBuildArgsCountAsLocalBuild() {
+        VersionDto version = new VersionController("", "").getVersion().getBody();
+
+        assertEquals(new VersionDto("dev", null), version);
+    }
+}