Prepare GeoIntel 1.0.0 release candidate

deploy/unraid/Dockerfile.all-in-one

@@ -164,12 +164,15 @@ RUN chmod +x /usr/local/bin/geointel-all-in-one-start /usr/local/bin/gosu \
 
 ARG GEOINTEL_BUILD_SHA=unknown
 ARG GEOINTEL_BUILD_TIME=unknown
+ARG GEOINTEL_APP_VERSION=1.0.0-rc.1
 
 ENV GEOINTEL_BUILD_SHA="${GEOINTEL_BUILD_SHA}" \
-    GEOINTEL_BUILD_TIME="${GEOINTEL_BUILD_TIME}"
+    GEOINTEL_BUILD_TIME="${GEOINTEL_BUILD_TIME}" \
+    GEOINTEL_APP_VERSION="${GEOINTEL_APP_VERSION}"
 
 LABEL org.opencontainers.image.title="GeoIntel" \
       org.opencontainers.image.description="GeoIntel workbench for Belgium and the Belgian North Sea" \
+      org.opencontainers.image.version="${GEOINTEL_APP_VERSION}" \
       org.opencontainers.image.revision="${GEOINTEL_BUILD_SHA}" \
       org.opencontainers.image.created="${GEOINTEL_BUILD_TIME}" \
       io.geointel.ai.enabled="${GEOINTEL_INSTALL_AI}"

deploy/unraid/README.md

@@ -247,6 +247,11 @@ bash deploy/unraid/run-dockerman-container.sh
 
 ## Release identity, fresh install and rollback
 
+The complete final-release order, including backup/restore, browser journeys,
+SBOM, vulnerability policy, SSH-signed manifest and checksums, is in
+`docs/RELEASE_RUNBOOK.md`. `VERSION` is the canonical semantic version and is
+also written to the image's `org.opencontainers.image.version` label.
+
 Inspect the running immutable revision and retained images:
 
 ```bash

deploy/unraid/deploy-release.sh

@@ -16,6 +16,11 @@ if [ -n "${DEPLOY_GEOINTEL_INSTALL_AI:-}" ]; then
 fi
 
 GEOINTEL_INSTALL_AI="${GEOINTEL_INSTALL_AI:-false}"
+GEOINTEL_APP_VERSION="$(tr -d '[:space:]' < VERSION)"
+if ! [[ "$GEOINTEL_APP_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]; then
+  echo "Invalid semantic version in VERSION: ${GEOINTEL_APP_VERSION}" >&2
+  exit 2
+fi
 GEOINTEL_BUILD_SHA="$(git rev-parse HEAD)"
 GEOINTEL_BUILD_TIME="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
 GEOINTEL_IMAGE_REPOSITORY="${GEOINTEL_IMAGE_REPOSITORY:-geointel-all-in-one}"
@@ -90,7 +95,16 @@ if docker image inspect "$GEOINTEL_RELEASE_IMAGE" >/dev/null 2>&1; then
       --format '{{index .Config.Labels "io.geointel.ai.enabled"}}' \
       "$GEOINTEL_RELEASE_IMAGE"
   )"
-  if [ "$stored_revision" != "$GEOINTEL_BUILD_SHA" ] || [ "$stored_ai" != "$GEOINTEL_INSTALL_AI" ]; then
+  stored_version="$(
+    docker image inspect \
+      --format '{{index .Config.Labels "org.opencontainers.image.version"}}' \
+      "$GEOINTEL_RELEASE_IMAGE"
+  )"
+  if (
+    [ "$stored_revision" != "$GEOINTEL_BUILD_SHA" ] ||
+    [ "$stored_ai" != "$GEOINTEL_INSTALL_AI" ] ||
+    [ "$stored_version" != "$GEOINTEL_APP_VERSION" ]
+  ); then
     echo "Immutable release tag has conflicting metadata: ${GEOINTEL_RELEASE_IMAGE}" >&2
     exit 2
   fi
@@ -101,6 +115,7 @@ else
     --build-arg GEOINTEL_INSTALL_AI="$GEOINTEL_INSTALL_AI" \
     --build-arg GEOINTEL_BUILD_SHA="$GEOINTEL_BUILD_SHA" \
     --build-arg GEOINTEL_BUILD_TIME="$GEOINTEL_BUILD_TIME" \
+    --build-arg GEOINTEL_APP_VERSION="$GEOINTEL_APP_VERSION" \
     -f deploy/unraid/Dockerfile.all-in-one \
     -t "$GEOINTEL_RELEASE_IMAGE" \
     -t "${GEOINTEL_IMAGE_REPOSITORY}:latest" \
@@ -128,5 +143,5 @@ fi
 
 echo "Deployed immutable image ${GEOINTEL_RELEASE_IMAGE}."
 docker image inspect \
-  --format 'revision={{index .Config.Labels "org.opencontainers.image.revision"}} created={{index .Config.Labels "org.opencontainers.image.created"}}' \
+  --format 'version={{index .Config.Labels "org.opencontainers.image.version"}} revision={{index .Config.Labels "org.opencontainers.image.revision"}} created={{index .Config.Labels "org.opencontainers.image.created"}}' \
   "$GEOINTEL_RELEASE_IMAGE"