feat: add /version endpoint and global Minder-Version header (#6358)

feat: add /version endpoint and global X-Minder-Version header

Signed-off-by: DharunMR <maddharun56@gmail.com>

Author: DharunMR

.github/workflows/image-build.yml

@@ -22,6 +22,7 @@ jobs:
             --image-label=org.opencontainers.image.source=https://github.com/mindersec/minder,org.opencontainers.image.title="Minder",org.opencontainers.image.licenses=Apache-2.0,org.opencontainers.image.vendor=OpenSSF
         env:
           KO_DOCKER_REPO: "ko.local"
+          GOFLAGS: "-ldflags=-X=github.com/mindersec/minder/internal/constants.CLIVersion=${{ github.ref_name }}"
   check-helm:
     name: Build Helm chart
     # TODO: remove the 'image' build once helm build is stable, because ko resolve will build the image
@@ -47,3 +48,4 @@ jobs:
         env:
           KO_DOCKER_REPO: "ko.local"
           KO_PUSH_IMAGE: "false"
+          GOFLAGS: "-ldflags=-X=github.com/mindersec/minder/internal/constants.CLIVersion=${{ github.ref_name }}"

.mk/build.mk

@@ -22,7 +22,7 @@ build-minder-cli: ## build minder cli
 .PHONY: build-minder-server
 build-minder-server: ## build minder-server
 	@echo "Building $(projectname)-server..."
-	@CGO_ENABLED=0 go build -trimpath -tags '$(BUILDTAGS)' -o ./bin/$(projectname)-server ./cmd/server
+	@CGO_ENABLED=0 go build -trimpath -tags '$(BUILDTAGS)' -ldflags "-X github.com/mindersec/minder/internal/constants.CLIVersion=$(shell git describe --abbrev=0 --tags)+ref.$(shell git rev-parse --short HEAD)" -o ./bin/$(projectname)-server ./cmd/server
 
 .PHONY: build-reminder-server
 build-reminder-server: ## build reminder server

.mk/develop.mk

@@ -12,11 +12,11 @@ del(.services.migrate.build) | \
 
 .PHONY: run-cli
 run-cli: ## run the CLI, needs additional arguments
-	@go run -ldflags "-X main.version=$(shell git describe --abbrev=0 --tags)" -tags '$(BUILDTAGS)' ./cmd/cli
+	@go run -ldflags "-X github.com/mindersec/minder/internal/constants.CLIVersion=$(shell git describe --abbrev=0 --tags)+ref.$(shell git rev-parse --short HEAD)" -tags '$(BUILDTAGS)' ./cmd/cli
 
 .PHONY: run-server
 run-server: ## run the app
-	@go run -ldflags "-X main.version=$(shell git describe --abbrev=0 --tags)" -tags '$(BUILDTAGS)' ./cmd/server serve
+	@go run -ldflags "-X github.com/mindersec/minder/internal/constants.CLIVersion=$(shell git describe --abbrev=0 --tags)+ref.$(shell git rev-parse --short HEAD)" -tags '$(BUILDTAGS)' ./cmd/server serve
 
 .PHONY: run-docker-teardown
 run-docker-teardown: ## teardown the docker compose environment
@@ -35,7 +35,7 @@ run-docker: run-docker-teardown ## run the app under docker compose
 	@# podman (at least) doesn't seem to like multi-arch images, and sometimes picks the wrong one (e.g. amd64 on arm64)
 	@# We also need to remove the build: directives to use ko builds
 	@# ko resolve will fill in the image: field in the compose file, but it adds a yaml document separator
-	@yq e $(YQ_BUILD_REPLACE_STRING) docker-compose.yaml | KO_DOCKER_REPO=$(KO_DOCKER_REPO) ko resolve --base-import-paths --platform linux/$(DOCKERARCH) -f - | sed 's/^--*$$//' > .resolved-compose.yaml
+	@yq e $(YQ_BUILD_REPLACE_STRING) docker-compose.yaml | KO_DOCKER_REPO=$(KO_DOCKER_REPO) GOFLAGS="-ldflags=-X=github.com/mindersec/minder/internal/constants.CLIVersion=$(shell git describe --abbrev=0 --tags)+ref.$(shell git rev-parse --short HEAD)" ko resolve --base-import-paths --platform linux/$(DOCKERARCH) -f - | sed 's/^--*$$//' > .resolved-compose.yaml
 	@$(COMPOSE) -f .resolved-compose.yaml up $(COMPOSE_ARGS) $(services)
 	@rm .resolved-compose.yaml*
 

docs/docs/ref/proto.mdx

@@ -5,5 +5,5 @@ package constants
 
 var (
 	// ServerUserAgent is the user agent string for the server
-	ServerUserAgent = "Minder/" + Revision
+	ServerUserAgent = "Minder/" + CLIVersion
 )

internal/constants/useragent.go

@@ -11,6 +11,7 @@ import (
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 
+	"github.com/mindersec/minder/internal/constants"
 	pb "github.com/mindersec/minder/pkg/api/protobuf/go/minder/v1"
 )
 
@@ -25,3 +26,11 @@ func (s *Server) CheckHealth(ctx context.Context, _ *pb.CheckHealthRequest) (*pb
 	}
 	return &pb.CheckHealthResponse{Status: "OK"}, nil
 }
+
+// GetVersion returns the build and version info of the Minder server
+func (*Server) GetVersion(_ context.Context, _ *pb.GetVersionRequest) (*pb.GetVersionResponse, error) {
+	return &pb.GetVersionResponse{
+		Version: constants.CLIVersion,
+		Commit:  constants.Revision,
+	}, nil
+}

internal/controlplane/handlers.go

@@ -35,6 +35,7 @@ import (
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/metadata"
 	"google.golang.org/grpc/reflection"
 	"google.golang.org/grpc/status"
 
@@ -43,6 +44,7 @@ import (
 	"github.com/mindersec/minder/internal/auth"
 	"github.com/mindersec/minder/internal/auth/jwt"
 	"github.com/mindersec/minder/internal/authz"
+	"github.com/mindersec/minder/internal/constants"
 	"github.com/mindersec/minder/internal/controlplane/metrics"
 	"github.com/mindersec/minder/internal/crypto"
 	datasourcessvc "github.com/mindersec/minder/internal/datasources/service"
@@ -218,8 +220,7 @@ func initMetrics(r sdkmetric.Reader) *sdkmetric.MeterProvider {
 	res := resource.NewWithAttributes(
 		semconv.SchemaURL,
 		semconv.ServiceName("minder"),
-		// TODO: Make this auto-generated
-		semconv.ServiceVersion("v0.1.0"),
+		semconv.ServiceVersion(constants.CLIVersion),
 	)
 	// By default/spec (?!), otel includes net.sock.peer.{addr,port}.
 	// See https://github.com/open-telemetry/opentelemetry-go-contrib/issues/3071
@@ -268,6 +269,7 @@ func (s *Server) StartGRPCServer(ctx context.Context) error {
 		s.TokenValidationInterceptor,
 		EntityContextProjectInterceptor,
 		ProjectAuthorizationInterceptor,
+		VersionHeaderInterceptor(),
 		recovery.UnaryServerInterceptor(recovery.WithRecoveryHandlerContext(recoveryHandler)),
 	}
 
@@ -545,3 +547,12 @@ func withMaxSizeMiddleware(h http.Handler) http.Handler {
 		h.ServeHTTP(w, r)
 	})
 }
+
+// VersionHeaderInterceptor injects the Minder version into the HTTP response headers
+func VersionHeaderInterceptor() grpc.UnaryServerInterceptor {
+	return func(ctx context.Context, req interface{}, _ *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error) {
+		// SetHeader tells gRPC-Gateway to add this to the HTTP response
+		_ = grpc.SetHeader(ctx, metadata.Pairs("minder-version", constants.ServerUserAgent))
+		return handler(ctx, req)
+	}
+}

internal/controlplane/server.go

@@ -28,6 +28,7 @@ import (
 	"github.com/mindersec/minder/internal/auth"
 	mockjwt "github.com/mindersec/minder/internal/auth/jwt/mock"
 	mockauthz "github.com/mindersec/minder/internal/authz/mock"
+	"github.com/mindersec/minder/internal/constants"
 	"github.com/mindersec/minder/internal/controlplane/metrics"
 	"github.com/mindersec/minder/internal/crypto"
 	mock_service "github.com/mindersec/minder/internal/entities/properties/service/mock"
@@ -220,3 +221,30 @@ func httpDoWithRetry(client *http.Client, createRequest func() (*http.Request, e
 
 	return resp, err
 }
+
+func TestGetVersion(t *testing.T) {
+	t.Parallel()
+
+	server := &Server{}
+
+	resp, err := server.GetVersion(context.Background(), &pb.GetVersionRequest{})
+
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+	require.Equal(t, constants.CLIVersion, resp.Version)
+	require.Equal(t, constants.Revision, resp.Commit)
+}
+
+func TestVersionHeaderInterceptor(t *testing.T) {
+	t.Parallel()
+
+	interceptor := VersionHeaderInterceptor()
+
+	handler := func(_ context.Context, _ interface{}) (interface{}, error) {
+		return "success", nil
+	}
+
+	_, err := interceptor(context.Background(), nil, &grpc.UnaryServerInfo{}, handler)
+
+	require.NoError(t, err)
+}