Add unauthenticated /version endpoint to ambient-api-server

[jeremyeder]

Summary

The ambient-api-server has no version endpoint. The Makefile already injects Version and BuildTime via ldflags, but the target Go variables don't exist yet. No changes to rh-trex-ai are needed.

Proposed Change

Add GET /version as an unauthenticated endpoint returning:

{"version": "<git-sha>", "build_time": "<timestamp>", "api_version": "v1"}

Five files touched:

• pkg/api/api.go — declare Version and BuildTime vars (ldflags targets)
• pkg/middleware/bearer_token.go — add /version to auth bypass
• plugins/proxy/plugin.go — add /version to native paths
• plugins/version/plugin.go — new plugin serving the endpoint via RegisterPreAuthMiddleware
• cmd/ambient-api-server/main.go — import the version plugin

cc @markturansky

[jeremyeder]

Patch

diff --git a/components/ambient-api-server/cmd/ambient-api-server/main.go b/components/ambient-api-server/cmd/ambient-api-server/main.go
index 9af9e021..4beb9752 100755
--- a/components/ambient-api-server/cmd/ambient-api-server/main.go
+++ b/components/ambient-api-server/cmd/ambient-api-server/main.go
@@ -26,6 +26,7 @@ import (
 	_ "github.com/ambient-code/platform/components/ambient-api-server/plugins/scheduledSessions"
 	_ "github.com/ambient-code/platform/components/ambient-api-server/plugins/sessions"
 	_ "github.com/ambient-code/platform/components/ambient-api-server/plugins/users"
+	_ "github.com/ambient-code/platform/components/ambient-api-server/plugins/version"
 )
 
 func main() {
diff --git a/components/ambient-api-server/pkg/api/api.go b/components/ambient-api-server/pkg/api/api.go
index 139b2f2f..e18f4f41 100644
--- a/components/ambient-api-server/pkg/api/api.go
+++ b/components/ambient-api-server/pkg/api/api.go
@@ -4,6 +4,12 @@ import (
 	trexapi "github.com/openshift-online/rh-trex-ai/pkg/api"
 )
 
+// Version and BuildTime are set at build time via ldflags.
+var (
+	Version   = "dev"
+	BuildTime = "unknown"
+)
+
 type Meta = trexapi.Meta
 type EventType = trexapi.EventType
 
diff --git a/components/ambient-api-server/pkg/middleware/bearer_token.go b/components/ambient-api-server/pkg/middleware/bearer_token.go
index d7dc15cf..2700b0ee 100644
--- a/components/ambient-api-server/pkg/middleware/bearer_token.go
+++ b/components/ambient-api-server/pkg/middleware/bearer_token.go
@@ -20,6 +20,7 @@ var httpBypassPaths = map[string]bool{
 	"/healthcheck": true,
 	"/health":      true,
 	"/metrics":     true,
+	"/version":     true,
 }
 
 func init() {
diff --git a/components/ambient-api-server/plugins/proxy/plugin.go b/components/ambient-api-server/plugins/proxy/plugin.go
index b55f94ec..73f6ccb2 100644
--- a/components/ambient-api-server/plugins/proxy/plugin.go
+++ b/components/ambient-api-server/plugins/proxy/plugin.go
@@ -59,6 +59,7 @@ func isNativePath(p string) bool {
 	return strings.HasPrefix(p, "/api/ambient/") ||
 		p == "/api/ambient" ||
 		p == "/metrics" ||
+		p == "/version" ||
 		p == "/favicon.ico"
 }
 

New file: plugins/version/plugin.go

package version

import (
	"encoding/json"
	"net/http"

	"github.com/ambient-code/platform/components/ambient-api-server/pkg/api"
	pkgserver "github.com/openshift-online/rh-trex-ai/pkg/server"
)

func init() {
	pkgserver.RegisterPreAuthMiddleware(func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			if r.URL.Path == "/version" && r.Method == http.MethodGet {
				w.Header().Set("Content-Type", "application/json")
				json.NewEncoder(w).Encode(map[string]string{
					"version":     api.Version,
					"build_time":  api.BuildTime,
					"api_version": "v1",
				})
				return
			}
			next.ServeHTTP(w, r)
		})
	})
}

Builds clean: make binary produces version 0fa9deae-modified with ldflags injection confirmed.

[jeremyeder]

Added git_tag to the version endpoint response in commit 73f8028. The endpoint now returns:

{"version": "<git-sha>", "build_time": "<timestamp>", "api_version": "v1", "git_tag": "<tag>"}

git_tag is injected via ldflags at build time (-X api.GitTag=$(git describe --tags --always)) and the response is pre-marshaled at startup to avoid per-request serialization.

Branch: feat/version-endpoint

[jeremyeder]

@markturansky this spec was created from the POC implementation above.

2026-05-20-001-feat-version-endpoint-plan.md

[jeremyeder]

I rebuilt it using the spec and had it compare the two implementations. So I think our next step could be sending a PR with the spec + implementation.

The differences are minor — the new implementation is essentially the original with the git_tag commit already folded in.
  Here's the summary:

  ┌──────────────────┬──────────────────────────────────────┬───────────────────────────────────────────────────────────┐
  │       Area       │   Original (feat/version-endpoint)   │              New (worktree-version-endpoint)              │
  ├──────────────────┼──────────────────────────────────────┼───────────────────────────────────────────────────────────┤
  │ api.go defaults  │ Version = "dev", BuildTime =         │ Version = "", BuildTime = "" (empty is cleaner — ldflags  │
  │                  │ "unknown"                            │ always populates them)                                    │
  ├──────────────────┼──────────────────────────────────────┼───────────────────────────────────────────────────────────┤
  │ Dockerfile ARG   │ GIT_VERSION=dev, BUILD_TIME=unknown  │ GIT_VERSION=, BUILD_TIME= (empty) + multi-line for        │
  │ defaults         │                                      │ readability                                               │
  ├──────────────────┼──────────────────────────────────────┼───────────────────────────────────────────────────────────┤
  │ plugin.go        │ json.NewEncoder(w).Encode(...) per   │ Pre-marshaled []byte at startup, w.Write(responseBytes) — │
  │ marshaling       │ request                              │  zero allocation per request                              │
  ├──────────────────┼──────────────────────────────────────┼───────────────────────────────────────────────────────────┤
  │ git_tag field    │ Added in a separate commit           │ Included from the start across all files                  │
  │                  │ (73f8028b)                           │                                                           │
  ├──────────────────┼──────────────────────────────────────┼───────────────────────────────────────────────────────────┤
  │ CLI server       │ Server: %s (built: %s) (no tag)      │ Server: %s (tag: %s, built: %s)                           │
  │ output           │                                      │                                                           │
  ├──────────────────┼──────────────────────────────────────┼───────────────────────────────────────────────────────────┤
  │ Package doc      │ Missing on version/cmd.go            │ Present                                                   │
  │ comment          │                                      │                                                           │
  ├──────────────────┼──────────────────────────────────────┼───────────────────────────────────────────────────────────┤
  │ Commit structure │ 2 commits (base + git_tag fix)       │ 1 clean commit with everything                            │
  └──────────────────┴──────────────────────────────────────┴───────────────────────────────────────────────────────────┘

  The new implementation is strictly better: single commit, pre-marshaled response from the start, git_tag included
  everywhere from the beginning, and cleaner defaults (empty strings instead of placeholder values).```