feat(gateway): report build_commit in /v1/info (fleet freshness)

The semver Version ("0.1.0-poc") is identical across rebuilds of the same tag,
so it can't tell whether an instance is running the latest image. Stamp the git
short-SHA into the binary at build time and surface it as /v1/info.build_commit,
so the fleet dashboard can flag out-of-date instances.

- api: BuildCommit var (default "dev", set via -ldflags -X) + Info.build_commit.
- Dockerfile: ARG GIT_COMMIT → ldflags -X …/internal/api.BuildCommit.
- gateway-image.yml: pass build-args GIT_COMMIT=${{ github.sha }}.

Verified the ldflags value lands in the binary; api tests pass.

Author: TheTrunk

.github/workflows/gateway-image.yml

@@ -75,6 +75,10 @@ jobs:
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+          # Stamp the git short-SHA into the binary → /v1/info.build_commit, so
+          # the dashboard can tell which image each instance is actually running.
+          build-args: |
+            GIT_COMMIT=${{ github.sha }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
           provenance: false

gateway/Dockerfile

@@ -25,10 +25,13 @@ COPY . .
 # SOURCE_DATE_EPOCH lets CI stamp a deterministic build time.
 ARG SOURCE_DATE_EPOCH=0
 ARG TARGETARCH=amd64
+# GIT_COMMIT is stamped into /v1/info so the fleet dashboard can flag out-of-date
+# instances (the semver tag doesn't change between rebuilds). Defaults to "dev".
+ARG GIT_COMMIT=dev
 RUN GOARCH=${TARGETARCH} go build \
         -trimpath \
         -buildvcs=false \
-        -ldflags "-s -w -buildid=" \
+        -ldflags "-s -w -buildid= -X github.com/runonflux/cumulusvpn-gateway/internal/api.BuildCommit=${GIT_COMMIT}" \
         -o /out/gateway ./cmd/gateway
 
 # ---- runtime stage ----------------------------------------------------------

gateway/internal/api/api.go

@@ -33,6 +33,15 @@ const Version = "0.1.0-poc"
 // MinClientVersion is the oldest client the gateway will happily serve.
 const MinClientVersion = "0.1.0"
 
+// BuildCommit is the git short-SHA of this build, injected at compile time via
+//
+//	-ldflags "-X github.com/runonflux/cumulusvpn-gateway/internal/api.BuildCommit=<sha>"
+//
+// It defaults to "dev" for local builds. Surfaced in /v1/info so the fleet
+// dashboard can flag instances running an out-of-date image (the semver Version
+// string alone can't — it doesn't change between rebuilds of the same tag).
+var BuildCommit = "dev"
+
 // dnsServer is advertised to clients; forwarded like any other flow so client
 // DNS never leaks via the node resolver (POC: run an in-process DoH/DoT
 // resolver and hand out 10.8.0.1 as the DNS instead — docs/03-gateway.md).
@@ -49,6 +58,7 @@ type Info struct {
 	ServerPubKey     string  `json:"server_pubkey"` // WG pubkey (base64)
 	SignPubKey       string  `json:"sign_pubkey"`   // ed25519 verify key (base64)
 	MinClientVersion string  `json:"min_client_version"`
+	BuildCommit      string  `json:"build_commit"` // git short-SHA of the image build
 }
 
 // Server is the control API.
@@ -91,6 +101,7 @@ func New(cfg *config.Config, dev *wg.Device, ent *entitle.Engine, lim *limiter.M
 	s.info.SignPubKey = base64.StdEncoding.EncodeToString(s.signKey.Public().(ed25519.PublicKey))
 	s.info.Version = Version
 	s.info.MinClientVersion = MinClientVersion
+	s.info.BuildCommit = BuildCommit
 	return s
 }