Harden immutable release deployment

backend/tests/test_sprint31_unraid_template.py

@@ -10,7 +10,7 @@ def test_unraid_template_documents_editable_runtime_settings() -> None:
     template = (ROOT / "deploy" / "unraid" / "geointel-unraid-template.xml").read_text(encoding="utf-8")
 
     assert "<Name>geointel</Name>" in template
-    assert "GeoIntel all-in-one runs the complete GeoIntel Kempen V1 stack in one Docker container" in template
+    assert "Belgium and Belgian North Sea workbench" in template
     assert "<Repository>geointel-all-in-one:latest</Repository>" in template
     assert "<WebUI>http://[IP]:[PORT:80]/</WebUI>" in template
     assert "<Icon>http://192.168.10.150:1202/geointel-icon.png</Icon>" in template
@@ -109,29 +109,35 @@ def test_unraid_all_in_one_runtime_starts_embedded_postgis_backend_and_nginx() -
 def test_tower_deploy_uses_single_container_unraid_compose() -> None:
     powershell = (ROOT / "scripts" / "deploy_tower.ps1").read_text(encoding="utf-8")
     bash = (ROOT / "scripts" / "deploy_tower.sh").read_text(encoding="utf-8")
+    release_script = (ROOT / "deploy" / "unraid" / "deploy-release.sh").read_text(encoding="utf-8")
 
     for script in (powershell, bash):
-        assert "docker compose -f docker-compose.unraid.yml config" in script
-        assert "--build-arg GEOINTEL_INSTALL_AI=" in script
-        assert '--build-arg GEOINTEL_BUILD_SHA="$GEOINTEL_BUILD_SHA"' in script
-        assert '--build-arg GEOINTEL_BUILD_TIME="$GEOINTEL_BUILD_TIME"' in script
-        assert "-f deploy/unraid/Dockerfile.all-in-one" in script
-        assert "-t geointel-all-in-one:latest" in script
-        assert "docker compose -f docker-compose.unraid.yml build geointel" not in script
-        assert "bash deploy/unraid/run-dockerman-container.sh" in script
-        assert "LIVE_SMOKE_CONTAINER=geointel bash scripts/live_migration_smoke.sh" in script
+        assert "bash deploy/unraid/deploy-release.sh" in script
+
+    assert "docker compose -f docker-compose.unraid.yml config" in release_script
+    assert "--build-arg GEOINTEL_INSTALL_AI=" in release_script
+    assert '--build-arg GEOINTEL_BUILD_SHA="$GEOINTEL_BUILD_SHA"' in release_script
+    assert '--build-arg GEOINTEL_BUILD_TIME="$GEOINTEL_BUILD_TIME"' in release_script
+    assert "-f deploy/unraid/Dockerfile.all-in-one" in release_script
+    assert '-t "$GEOINTEL_RELEASE_IMAGE"' in release_script
+    assert '-t "${GEOINTEL_IMAGE_REPOSITORY}:latest"' in release_script
+    assert 'GEOINTEL_IMAGE="$image" bash deploy/unraid/run-dockerman-container.sh' in release_script
+    assert "LIVE_SMOKE_CONTAINER=geointel bash scripts/live_migration_smoke.sh" in release_script
 
 
 def test_tower_deploy_build_uses_remote_env_ai_setting_by_default() -> None:
     powershell = (ROOT / "scripts" / "deploy_tower.ps1").read_text(encoding="utf-8")
     bash = (ROOT / "scripts" / "deploy_tower.sh").read_text(encoding="utf-8")
+    release_script = (ROOT / "deploy" / "unraid" / "deploy-release.sh").read_text(encoding="utf-8")
 
     for script in (powershell, bash):
-        assert "if [ -f .env ]; then" in script
-        assert ". ./.env" in script
         assert "DEPLOY_GEOINTEL_INSTALL_AI" in script
-        assert 'GEOINTEL_INSTALL_AI="${GEOINTEL_INSTALL_AI:-false}"' in script
-        assert 'docker build --build-arg GEOINTEL_INSTALL_AI="$GEOINTEL_INSTALL_AI"' in script
+        assert "bash deploy/unraid/deploy-release.sh" in script
+
+    assert "if [ -f .env ]; then" in release_script
+    assert ". ./.env" in release_script
+    assert 'GEOINTEL_INSTALL_AI="${GEOINTEL_INSTALL_AI:-false}"' in release_script
+    assert "--build-arg GEOINTEL_INSTALL_AI=" in release_script
 
 
 def test_powershell_tower_deploy_streams_remote_script_to_bash() -> None: