Embed immutable build identity in deployments

2026-07-18 00:59:12 +02:00
parent d8dc66c558
commit 49b38c829d
4 changed files with 36 additions and 2 deletions
@@ -32,3 +32,17 @@ def test_runtime_report_is_read_only_by_default_and_requires_confirmation() -> N
    assert "if args.reconcile and args.confirm != RECONCILE_CONFIRMATION" in source
    assert "RuntimeReconciliationService.reconcile(db)" in source
    assert "COPY scripts/runtime_state_report.py /app/scripts/runtime_state_report.py" in dockerfile
+
+
+def test_all_in_one_deploy_embeds_immutable_build_identity() -> None:
+    dockerfile = (ROOT / "deploy" / "unraid" / "Dockerfile.all-in-one").read_text(encoding="utf-8")
+    deploy_powershell = (ROOT / "scripts" / "deploy_tower.ps1").read_text(encoding="utf-8")
+    deploy_shell = (ROOT / "scripts" / "deploy_tower.sh").read_text(encoding="utf-8")
+
+    assert "ARG GEOINTEL_BUILD_SHA=unknown" in dockerfile
+    assert 'GEOINTEL_BUILD_SHA="${GEOINTEL_BUILD_SHA}"' in dockerfile
+    assert 'GEOINTEL_BUILD_TIME="${GEOINTEL_BUILD_TIME}"' in dockerfile
+    for deploy_source in (deploy_powershell, deploy_shell):
+        assert 'GEOINTEL_BUILD_SHA="$(git rev-parse HEAD)"' in deploy_source
+        assert "--build-arg GEOINTEL_BUILD_SHA=" in deploy_source
+        assert "--build-arg GEOINTEL_BUILD_TIME=" in deploy_source