From 50c92dae831a42eba09bd11179ef598f1facd4a1 Mon Sep 17 00:00:00 2001
From: Morgan Roderick <morgan@roderick.dk>
Date: Sun, 19 Jul 2026 14:41:13 +0200
Subject: [PATCH] fix: use HEROKU_RELEASE_VERSION for static asset
 cache-busting

HEROKU_SLUG_COMMIT requires runtime-dyno-metadata but was undocumented.
Switch to HEROKU_RELEASE_VERSION and document the lab feature requirement.
---
 docs/heroku-setup.md         | 18 ++++++++++--------
 src/app/components/layout.js | 10 +++-------
 2 files changed, 13 insertions(+), 15 deletions(-)

diff --git a/docs/heroku-setup.md b/docs/heroku-setup.md
index fcb572c..d9dc1ba 100644
--- a/docs/heroku-setup.md
+++ b/docs/heroku-setup.md
@@ -16,6 +16,7 @@ heroku create codebar-auth-production --region eu
 
 # app.json is NOT read by `heroku create`, so provision everything manually:
 heroku stack:set heroku-26 -a codebar-auth-production
+heroku labs:enable runtime-dyno-metadata -a codebar-auth-production
 heroku addons:create heroku-postgresql:essential-0 --as DATABASE -a codebar-auth-production
 
 # Set required GitHub OAuth credentials
@@ -59,14 +60,15 @@ After deploying, update your GitHub OAuth app settings:
 
 ## Environment Variables
 
-| Variable               | Source           | Description                  |
-| ---------------------- | ---------------- | ---------------------------- |
-| `DATABASE_URL`         | Auto-provisioned | PostgreSQL connection string |
-| `GITHUB_CLIENT_ID`     | Required         | GitHub OAuth client ID       |
-| `GITHUB_CLIENT_SECRET` | Required         | GitHub OAuth client secret   |
-| `BETTER_AUTH_SECRET`   | Auto-generated   | Session encryption key       |
-| `CODEBAR_AUTH_URL`     | Auto-set         | Application base URL         |
-| `PORT`                 | Heroku           | Dyno port                    |
+| Variable                 | Source                | Description                        |
+| ------------------------ | --------------------- | ---------------------------------- |
+| `DATABASE_URL`           | Auto-provisioned      | PostgreSQL connection string       |
+| `GITHUB_CLIENT_ID`       | Required              | GitHub OAuth client ID             |
+| `GITHUB_CLIENT_SECRET`   | Required              | GitHub OAuth client secret         |
+| `BETTER_AUTH_SECRET`     | Auto-generated        | Session encryption key             |
+| `CODEBAR_AUTH_URL`       | Auto-set              | Application base URL               |
+| `PORT`                   | Heroku                | Dyno port                          |
+| `HEROKU_RELEASE_VERSION` | runtime-dyno-metadata | Static asset cache-busting version |
 
 ## Files
 
diff --git a/src/app/components/layout.js b/src/app/components/layout.js
index 63a9769..207018b 100644
--- a/src/app/components/layout.js
+++ b/src/app/components/layout.js
@@ -1,13 +1,9 @@
 import { html } from "hono/html";
 
 // Derive a version stamp for cache-busting static assets.
-// HEROKU_SLUG_COMMIT is the deployed git SHA, set automatically by Heroku.
-// Falls back to SOURCE_VERSION (build-time env), then 'dev' for local.
-const STATIC_VERSION =
-  (process.env.HEROKU_SLUG_COMMIT || process.env.SOURCE_VERSION || "").slice(
-    0,
-    7,
-  ) || "dev";
+// HEROKU_RELEASE_VERSION is set by Heroku when runtime-dyno-metadata is enabled.
+// Falls back to 'dev' for local development.
+const STATIC_VERSION = process.env.HEROKU_RELEASE_VERSION || "dev";
 
 // Base layout component
 export const Layout = ({ title, children }) => html`