Harden immutable release deployment

scripts/deploy_tower.ps1

@@ -34,59 +34,9 @@ git reset --hard "origin/$REMOTE_BRANCH"
 git branch -M "$REMOTE_BRANCH"
 chmod +x scripts/*.sh backend/docker_start.sh deploy/unraid/*.sh || true
 
-if [ -f .env ]; then
-  set -a
-  . ./.env
-  set +a
-fi
-
-if [ -n "${DEPLOY_GEOINTEL_INSTALL_AI:-}" ]; then
-  GEOINTEL_INSTALL_AI="$DEPLOY_GEOINTEL_INSTALL_AI"
-fi
-GEOINTEL_INSTALL_AI="${GEOINTEL_INSTALL_AI:-false}"
-GEOINTEL_BUILD_SHA="$(git rev-parse HEAD)"
-GEOINTEL_BUILD_TIME="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
-
-docker compose -f docker-compose.unraid.yml config >/dev/null
-docker build --build-arg GEOINTEL_INSTALL_AI="$GEOINTEL_INSTALL_AI" \
-  --build-arg GEOINTEL_BUILD_SHA="$GEOINTEL_BUILD_SHA" \
-  --build-arg GEOINTEL_BUILD_TIME="$GEOINTEL_BUILD_TIME" \
-  -f deploy/unraid/Dockerfile.all-in-one \
-  -t geointel-all-in-one:latest \
-  .
-bash deploy/unraid/run-dockerman-container.sh
-
-wait_for_geointel_health() {
-  local status=''
-  for attempt in $(seq 1 90); do
-    status="$(docker inspect --format '{{if .State.Health}}{{.State.Health.Status}}{{else}}{{.State.Status}}{{end}}' geointel 2>/dev/null || true)"
-    if [ "$status" = 'healthy' ]; then
-      echo "GeoIntel container is healthy after attempt $attempt."
-      return 0
-    fi
-    if [ "$status" = 'unhealthy' ] || [ "$status" = 'exited' ] || [ "$status" = 'dead' ]; then
-      echo "GeoIntel container entered terminal state: $status" >&2
-      docker logs --tail 120 geointel >&2 || true
-      return 1
-    fi
-    sleep 2
-  done
-  echo "GeoIntel container did not become healthy (last state: ${status:-missing})." >&2
-  docker logs --tail 120 geointel >&2 || true
-  return 1
-}
-
-# Container startup owns the migration. Waiting here prevents the validation
-# smoke from racing a concurrent `alembic upgrade head` against the same DB.
-wait_for_geointel_health
-
-if [ -x scripts/live_migration_smoke.sh ]; then
-  LIVE_SMOKE_CONTAINER=geointel bash scripts/live_migration_smoke.sh
-fi
-
-if [ -x scripts/verify_browser_runtime.sh ]; then
-  bash scripts/verify_browser_runtime.sh "$FRONTEND_URL"
-fi
+FRONTEND_URL="$FRONTEND_URL" \
+DEPLOY_GEOINTEL_INSTALL_AI="${DEPLOY_GEOINTEL_INSTALL_AI:-}" \
+bash deploy/unraid/deploy-release.sh
 '@
 
 $utf8NoBom = [System.Text.UTF8Encoding]::new($false)

scripts/deploy_tower.sh

@@ -35,58 +35,7 @@ git fetch origin "$REMOTE_BRANCH"
 git checkout -B "$REMOTE_BRANCH" "origin/$REMOTE_BRANCH"
 chmod +x scripts/*.sh backend/docker_start.sh deploy/unraid/*.sh || true
 
-if [ -f .env ]; then
-  set -a
-  # shellcheck disable=SC1091
-  . ./.env
-  set +a
-fi
-
-if [ -n "${DEPLOY_GEOINTEL_INSTALL_AI:-}" ]; then
-  GEOINTEL_INSTALL_AI="$DEPLOY_GEOINTEL_INSTALL_AI"
-fi
-GEOINTEL_INSTALL_AI="${GEOINTEL_INSTALL_AI:-false}"
-GEOINTEL_BUILD_SHA="$(git rev-parse HEAD)"
-GEOINTEL_BUILD_TIME="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
-
-docker compose -f docker-compose.unraid.yml config >/dev/null
-docker build --build-arg GEOINTEL_INSTALL_AI="$GEOINTEL_INSTALL_AI" \
-  --build-arg GEOINTEL_BUILD_SHA="$GEOINTEL_BUILD_SHA" \
-  --build-arg GEOINTEL_BUILD_TIME="$GEOINTEL_BUILD_TIME" \
-  -f deploy/unraid/Dockerfile.all-in-one \
-  -t geointel-all-in-one:latest \
-  .
-bash deploy/unraid/run-dockerman-container.sh
-
-wait_for_geointel_health() {
-  local status=''
-  for attempt in $(seq 1 90); do
-    status="$(docker inspect --format '{{if .State.Health}}{{.State.Health.Status}}{{else}}{{.State.Status}}{{end}}' geointel 2>/dev/null || true)"
-    if [[ "$status" == 'healthy' ]]; then
-      echo "GeoIntel container is healthy after attempt $attempt."
-      return 0
-    fi
-    if [[ "$status" == 'unhealthy' || "$status" == 'exited' || "$status" == 'dead' ]]; then
-      echo "GeoIntel container entered terminal state: $status" >&2
-      docker logs --tail 120 geointel >&2 || true
-      return 1
-    fi
-    sleep 2
-  done
-  echo "GeoIntel container did not become healthy (last state: ${status:-missing})." >&2
-  docker logs --tail 120 geointel >&2 || true
-  return 1
-}
-
-# Container startup owns the migration. Waiting here prevents the validation
-# smoke from racing a concurrent `alembic upgrade head` against the same DB.
-wait_for_geointel_health
-
-if [[ -x scripts/live_migration_smoke.sh ]]; then
-  LIVE_SMOKE_CONTAINER=geointel bash scripts/live_migration_smoke.sh
-fi
-
-if [[ -x scripts/verify_browser_runtime.sh ]]; then
-  bash scripts/verify_browser_runtime.sh "$FRONTEND_URL"
-fi
+FRONTEND_URL="$FRONTEND_URL" \
+DEPLOY_GEOINTEL_INSTALL_AI="${DEPLOY_GEOINTEL_INSTALL_AI:-}" \
+bash deploy/unraid/deploy-release.sh
 REMOTE_SCRIPT

scripts/run_readiness_check.sh

@@ -106,6 +106,12 @@ ${PYTHON_BIN} -m compileall backend/app
 (cd frontend && npm run typecheck)
 (cd frontend && npm run build)
 bash -n scripts/live_migration_smoke.sh
+bash -n scripts/deploy_tower.sh
+bash -n scripts/verify_release_fresh_install.sh
+bash -n deploy/unraid/all-in-one-start.sh
+bash -n deploy/unraid/run-dockerman-container.sh
+bash -n deploy/unraid/deploy-release.sh
+bash -n deploy/unraid/rollback-dockerman-container.sh
 bash -n scripts/verify_browser_runtime.sh
 bash -n scripts/verify_demo_export_workflow.sh
 bash -n scripts/verify_demo_raster_workflow.sh

scripts/verify_release_fresh_install.sh

@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+IMAGE="${1:-geointel-all-in-one:latest}"
+NAME="geointel-fresh-smoke-$(date +%s)-$$"
+ROOT="$(mktemp -d "${TMPDIR:-/tmp}/geointel-fresh-smoke.XXXXXX")"
+PASSWORD="fresh-smoke-$(cat /proc/sys/kernel/random/uuid)"
+
+cleanup() {
+  docker rm -f "$NAME" >/dev/null 2>&1 || true
+  case "$ROOT" in
+    "${TMPDIR:-/tmp}"/geointel-fresh-smoke.*)
+      rm -rf -- "$ROOT"
+      ;;
+    *)
+      echo "Refusing to remove unexpected smoke path: ${ROOT}" >&2
+      ;;
+  esac
+}
+trap cleanup EXIT
+
+docker image inspect "$IMAGE" >/dev/null
+mkdir -p "$ROOT/postgres-data" "$ROOT/storage" "$ROOT/models"
+
+docker run -d \
+  --name "$NAME" \
+  -p 127.0.0.1::80 \
+  -e GEOINTEL_POSTGRES_DB=geointel_fresh_smoke \
+  -e GEOINTEL_POSTGRES_USER=geointel_fresh_smoke \
+  -e GEOINTEL_POSTGRES_PASSWORD="$PASSWORD" \
+  -e GEOINTEL_MAX_UPLOAD_MB=500 \
+  -e OLLAMA_ENABLED=false \
+  -v "$ROOT/postgres-data:/var/lib/postgresql/data" \
+  -v "$ROOT/storage:/app/storage" \
+  -v "$ROOT/models:/app/models" \
+  "$IMAGE" >/dev/null
+
+for attempt in $(seq 1 90); do
+  status="$(docker inspect --format '{{if .State.Health}}{{.State.Health.Status}}{{else}}{{.State.Status}}{{end}}' "$NAME" 2>/dev/null || true)"
+  if [ "$status" = "healthy" ]; then
+    break
+  fi
+  if [ "$status" = "unhealthy" ] || [ "$status" = "exited" ] || [ "$status" = "dead" ]; then
+    docker logs --tail 120 "$NAME" >&2 || true
+    exit 1
+  fi
+  sleep 2
+done
+
+if [ "${status:-}" != "healthy" ]; then
+  echo "Fresh-install container did not become healthy." >&2
+  docker logs --tail 120 "$NAME" >&2 || true
+  exit 1
+fi
+
+host_port="$(docker port "$NAME" 80/tcp | awk -F: 'NR == 1 {print $NF}')"
+curl -fsS "http://127.0.0.1:${host_port}/health/ready" >/dev/null
+curl -fsS "http://127.0.0.1:${host_port}/api/v1/system/capabilities" >/dev/null
+docker exec "$NAME" python -m alembic heads
+
+echo "Fresh install passed for ${IMAGE} on isolated storage ${ROOT}."