Report build version on /healthz via X-Epmon-Version

cmd/epmon/main.go

@@ -116,7 +116,9 @@ func runDefault(args []string, stdout, stderr io.Writer) int {
 
 	root := http.NewServeMux()
 	root.Handle("/metrics", registry.Handler())
-	root.Handle("/", api.New(cfg, st, nil).Handler())
+	apiSrv := api.New(cfg, st, nil)
+	apiSrv.SetVersion(version)
+	root.Handle("/", apiSrv.Handler())
 
 	srv := newHTTPServer(cfg, api.Log(root))
 	// serveErr carries a bind/serve failure back to runDefault so boot can

internal/api/api.go

@@ -49,11 +49,16 @@ var openAPIYAML []byte
 // Server bundles config and storage for the handlers. Storage is the
 // store.Store port — any adapter (SQLite, Postgres, …) plugs in here.
 type Server struct {
-	cfg   *config.Config
-	store store.Store
-	now   func() time.Time
+	cfg     *config.Config
+	store   store.Store
+	now     func() time.Time
+	version string
 }
 
+// SetVersion stamps build identity for the /healthz version header
+// (see SECURITY.md reporting flow). Empty means "omit the header".
+func (s *Server) SetVersion(v string) { s.version = v }
+
 // New builds a Server. now is injectable for tests (nil = time.Now).
 func New(cfg *config.Config, st store.Store, now func() time.Time) *Server {
 	if now == nil {
@@ -169,6 +174,9 @@ func (s *Server) healthz(w http.ResponseWriter, r *http.Request) {
 		writeErr(w, http.StatusServiceUnavailable, "unavailable", "store unreachable")
 		return
 	}
+	if s.version != "" {
+		w.Header().Set("X-Epmon-Version", s.version)
+	}
 	writeJSON(w, http.StatusOK, map[string]bool{"ok": true})
 }
 

internal/api/middleware_test.go

@@ -199,6 +199,28 @@ func TestHealthzBoundedPing(t *testing.T) {
 	}
 }
 
+// TestHealthzVersionHeader asserts the SECURITY.md reporting flow:
+// a stamped server reports its build on /healthz, an unstamped one
+// omits the header entirely.
+func TestHealthzVersionHeader(t *testing.T) {
+	srv, _ := testServer(t)
+	srv.SetVersion("v9.9.9")
+	h := srv.Handler()
+
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, httptest.NewRequest("GET", "/healthz", nil))
+	if got := rec.Header().Get("X-Epmon-Version"); got != "v9.9.9" {
+		t.Errorf("X-Epmon-Version = %q, want v9.9.9", got)
+	}
+
+	plain, _ := testServer(t)
+	rec = httptest.NewRecorder()
+	plain.Handler().ServeHTTP(rec, httptest.NewRequest("GET", "/healthz", nil))
+	if got := rec.Header().Get("X-Epmon-Version"); got != "" {
+		t.Errorf("X-Epmon-Version = %q, want absent when unset", got)
+	}
+}
+
 func TestHealthzReadiness(t *testing.T) {
 	srv, st := testServer(t)
 	h := srv.Handler()