From 1a22052385572226dfb1275c5de09f933e00978d Mon Sep 17 00:00:00 2001
From: Chris Zetter <253059100+zetter-rpf@users.noreply.github.com>
Date: Wed, 2 Sep 2026 13:38:57 +0100
Subject: [PATCH] Expose deployed commit sha at /info/release

Previously the only way to find out which commit an environment
was running was the Heroku platform API, which needs credentials
broad enough to change the app. GitHub has some deployment
information, but only for staging as production releases are
promoted.

This change adds a public InfoController with a /info/release route
that renders HEROKU_SLUG_COMMIT as plain text, falling back to
"unknown" when the variable is unset. The editor dashboard will
read it to show the currently deployed version of the API. The
same variable already tags log lines in config/application.rb, so
no new configuration is introduced.

The endpoint is unauthenticated and inherits from
ActionController::API so it does not require a session; the commit
sha is already public in the open source repository.
---
 app/controllers/info_controller.rb    |  7 +++++++
 config/routes.rb                      |  2 ++
 spec/requests/info_controller_spec.rb | 23 +++++++++++++++++++++++
 3 files changed, 32 insertions(+)
 create mode 100644 app/controllers/info_controller.rb
 create mode 100644 spec/requests/info_controller_spec.rb

diff --git a/app/controllers/info_controller.rb b/app/controllers/info_controller.rb
new file mode 100644
index 000000000..01b4a6a82
--- /dev/null
+++ b/app/controllers/info_controller.rb
@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+class InfoController < ActionController::API
+  def release
+    render plain: ENV.fetch('HEROKU_SLUG_COMMIT', 'unknown')
+  end
+end
diff --git a/config/routes.rb b/config/routes.rb
index 264f7765f..56c04b11b 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -27,6 +27,8 @@
     root to: 'projects#index'
   end
 
+  get '/info/release', to: 'info#release'
+
   post '/test/reseed', to: 'test_utilities#reseed'
   post '/test/enable_feature', to: 'test_utilities#enable_feature'
   post '/test/disable_feature', to: 'test_utilities#disable_feature'
diff --git a/spec/requests/info_controller_spec.rb b/spec/requests/info_controller_spec.rb
new file mode 100644
index 000000000..816fc8a06
--- /dev/null
+++ b/spec/requests/info_controller_spec.rb
@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe InfoController do
+  describe 'GET /info/release' do
+    subject(:request) { get '/info/release' }
+
+    it 'returns the deployed commit sha as text' do
+      ClimateControl.modify(HEROKU_SLUG_COMMIT: 'abc123') do
+        request
+        expect(response.body).to eq('abc123')
+      end
+    end
+
+    it 'returns unknown when the sha is unavailable' do
+      ClimateControl.modify(HEROKU_SLUG_COMMIT: nil) do
+        request
+        expect(response.body).to eq('unknown')
+      end
+    end
+  end
+end