.forgejo/workflows/dev.yaml

@@ -23,9 +23,11 @@ jobs:
         id: meta
         run: |
           IMAGE="${REGISTRY}/${IMAGE_NAME}"
+          VERSION="$(tr -d '[:space:]' < VERSION)"
           echo "image=${IMAGE}" >> "$GITHUB_OUTPUT"
           echo "sha_tag=${IMAGE}:dev-${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"
           echo "dev_tag=${IMAGE}:dev" >> "$GITHUB_OUTPUT"
+          echo "app_version=${VERSION}-beta" >> "$GITHUB_OUTPUT"
 
       # Platte docker build/push i.p.v. buildx: betrouwbaarder tegen een
       # HTTP-registry. De runner-host moet 10.0.20.22:3000 als
@@ -34,7 +36,8 @@ jobs:
         run: |
           echo "${{ secrets.REGISTRY_TOKEN }}" | docker login "$REGISTRY" -u "${{ secrets.REGISTRY_USER }}" --password-stdin
           docker build \
-            --build-arg APP_VERSION="dev-${GITHUB_SHA::7}" \
+            --build-arg APP_VERSION="${{ steps.meta.outputs.app_version }}" \
+            --build-arg GIT_SHA="${GITHUB_SHA::7}" \
             -t "${{ steps.meta.outputs.sha_tag }}" \
             -t "${{ steps.meta.outputs.dev_tag }}" .
           docker push "${{ steps.meta.outputs.sha_tag }}"

.forgejo/workflows/release.yaml

@@ -35,6 +35,7 @@ jobs:
           echo "${{ secrets.REGISTRY_TOKEN }}" | docker login "$REGISTRY" -u "${{ secrets.REGISTRY_USER }}" --password-stdin
           docker build \
             --build-arg APP_VERSION="${{ steps.meta.outputs.version }}" \
+            --build-arg GIT_SHA="${GITHUB_SHA::7}" \
             -t "${{ steps.meta.outputs.version_tag }}" \
             -t "${{ steps.meta.outputs.latest_tag }}" .
           docker push "${{ steps.meta.outputs.version_tag }}"

Dockerfile

@@ -21,9 +21,11 @@ COPY --chown=app:app src ./src
 COPY --chown=app:app public ./public
 COPY --chown=app:app db ./db
 
-# Versie wordt tijdens de build meegegeven door CI
+# Versie + commit-hash worden tijdens de build meegegeven door CI
 ARG APP_VERSION=dev
 ENV APP_VERSION=$APP_VERSION
+ARG GIT_SHA=
+ENV GIT_SHA=$GIT_SHA
 
 USER app
 EXPOSE 3000

VERSION

@@ -0,0 +1 @@
+0.2.10

public/js/core.js

@@ -1,23 +1,22 @@
 /* teach - kern: versie, i18n, accounts, opslag, geluid */
 "use strict";
-/* version — shown until /api/version resolves (or if the fetch fails, e.g. offline) */
-const VERSION = "0.2.08";
+/* version — shown until /api/version resolves (or if the fetch fails, e.g. offline).
+   Kept in sync by hand with the VERSION file at the repo root on every release. */
+const VERSION = "0.2.10";
 (function(){
   const tag = document.getElementById("verTag");
   tag.textContent = "v"+VERSION;
-  /* the real deployed version always wins once known: dev branch deploys report
-     a dev-<sha> build via /api/version → mark as beta; release builds report the
-     actual release tag (e.g. v1.2.0) → show that instead of the local fallback */
+  /* the real deployed version always wins once known: CI reads the VERSION file
+     and passes it as APP_VERSION ("0.2.10-beta" on dev, the release tag on prod)
+     - never a raw git sha, that's only kept as a hover-title for support/debug */
   fetch("/api/version")
     .then(r=>r.ok ? r.json() : null)
     .then(v=>{
       if(!v || typeof v.version!=="string") return;
-      if(v.version.startsWith("dev")){
-        tag.textContent = v.version+" · beta";
-        tag.classList.add("beta");
-      }else{
-        tag.textContent = v.version;
-      }
+      const text = v.version.startsWith("v") ? v.version : "v"+v.version;
+      tag.textContent = text;
+      tag.classList.toggle("beta", text.includes("beta"));
+      if(v.sha) tag.title = v.sha;
     })
     .catch(()=>{});
 })();

src/api.js

@@ -42,6 +42,7 @@ export default async function api(app) {
   app.get('/version', async () => ({
     name: 'teach',
     version: process.env.APP_VERSION ?? 'dev',
+    sha: process.env.GIT_SHA || undefined,
   }));
 
   // ---- publiek: scholenlijst voor het inlogscherm ----------------------------