Embed immutable build identity in deployments

backend/tests/test_rc_runtime_observability.py

@@ -32,3 +32,17 @@ def test_runtime_report_is_read_only_by_default_and_requires_confirmation() -> N
     assert "if args.reconcile and args.confirm != RECONCILE_CONFIRMATION" in source
     assert "RuntimeReconciliationService.reconcile(db)" in source
     assert "COPY scripts/runtime_state_report.py /app/scripts/runtime_state_report.py" in dockerfile
+
+
+def test_all_in_one_deploy_embeds_immutable_build_identity() -> None:
+    dockerfile = (ROOT / "deploy" / "unraid" / "Dockerfile.all-in-one").read_text(encoding="utf-8")
+    deploy_powershell = (ROOT / "scripts" / "deploy_tower.ps1").read_text(encoding="utf-8")
+    deploy_shell = (ROOT / "scripts" / "deploy_tower.sh").read_text(encoding="utf-8")
+
+    assert "ARG GEOINTEL_BUILD_SHA=unknown" in dockerfile
+    assert 'GEOINTEL_BUILD_SHA="${GEOINTEL_BUILD_SHA}"' in dockerfile
+    assert 'GEOINTEL_BUILD_TIME="${GEOINTEL_BUILD_TIME}"' in dockerfile
+    for deploy_source in (deploy_powershell, deploy_shell):
+        assert 'GEOINTEL_BUILD_SHA="$(git rev-parse HEAD)"' in deploy_source
+        assert "--build-arg GEOINTEL_BUILD_SHA=" in deploy_source
+        assert "--build-arg GEOINTEL_BUILD_TIME=" in deploy_source

deploy/unraid/Dockerfile.all-in-one

@@ -12,9 +12,13 @@ ARG GEOINTEL_INSTALL_AI=false
 ARG GEOINTEL_TORCH_INDEX_URL=https://download.pytorch.org/whl/cpu
 ARG GEOINTEL_TORCH_VERSION=2.13.0
 ARG GEOINTEL_TORCHVISION_VERSION=0.28.0
+ARG GEOINTEL_BUILD_SHA=unknown
+ARG GEOINTEL_BUILD_TIME=unknown
 
 ENV GEOINTEL_ENV=production \
     GEOINTEL_API_PREFIX=/api/v1 \
+    GEOINTEL_BUILD_SHA="${GEOINTEL_BUILD_SHA}" \
+    GEOINTEL_BUILD_TIME="${GEOINTEL_BUILD_TIME}" \
     GEOINTEL_STORAGE_ROOT=/app/storage \
     STORAGE_ROOT=/app/storage \
     GEOINTEL_ALL_IN_ONE=1 \

scripts/deploy_tower.ps1

@@ -44,9 +44,17 @@ if [ -n "${DEPLOY_GEOINTEL_INSTALL_AI:-}" ]; then
   GEOINTEL_INSTALL_AI="$DEPLOY_GEOINTEL_INSTALL_AI"
 fi
 GEOINTEL_INSTALL_AI="${GEOINTEL_INSTALL_AI:-false}"
+GEOINTEL_BUILD_SHA="$(git rev-parse HEAD)"
+GEOINTEL_BUILD_TIME="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
 
 docker compose -f docker-compose.unraid.yml config >/dev/null
-docker build --build-arg GEOINTEL_INSTALL_AI="$GEOINTEL_INSTALL_AI" -f deploy/unraid/Dockerfile.all-in-one -t geointel-all-in-one:latest .
+docker build \
+  --build-arg GEOINTEL_INSTALL_AI="$GEOINTEL_INSTALL_AI" \
+  --build-arg GEOINTEL_BUILD_SHA="$GEOINTEL_BUILD_SHA" \
+  --build-arg GEOINTEL_BUILD_TIME="$GEOINTEL_BUILD_TIME" \
+  -f deploy/unraid/Dockerfile.all-in-one \
+  -t geointel-all-in-one:latest \
+  .
 bash deploy/unraid/run-dockerman-container.sh
 
 wait_for_geointel_health() {

scripts/deploy_tower.sh

@@ -46,9 +46,17 @@ if [ -n "${DEPLOY_GEOINTEL_INSTALL_AI:-}" ]; then
   GEOINTEL_INSTALL_AI="$DEPLOY_GEOINTEL_INSTALL_AI"
 fi
 GEOINTEL_INSTALL_AI="${GEOINTEL_INSTALL_AI:-false}"
+GEOINTEL_BUILD_SHA="$(git rev-parse HEAD)"
+GEOINTEL_BUILD_TIME="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
 
 docker compose -f docker-compose.unraid.yml config >/dev/null
-docker build --build-arg GEOINTEL_INSTALL_AI="$GEOINTEL_INSTALL_AI" -f deploy/unraid/Dockerfile.all-in-one -t geointel-all-in-one:latest .
+docker build \
+  --build-arg GEOINTEL_INSTALL_AI="$GEOINTEL_INSTALL_AI" \
+  --build-arg GEOINTEL_BUILD_SHA="$GEOINTEL_BUILD_SHA" \
+  --build-arg GEOINTEL_BUILD_TIME="$GEOINTEL_BUILD_TIME" \
+  -f deploy/unraid/Dockerfile.all-in-one \
+  -t geointel-all-in-one:latest \
+  .
 bash deploy/unraid/run-dockerman-container.sh
 
 wait_for_geointel_health() {