Make release image tags truly immutable

2026-07-18 02:35:43 +02:00
parent 5699006a5e
commit f7078468db
6 changed files with 55 additions and 25 deletions
@@ -72,6 +72,9 @@
 - Hardened the all-in-one release path with commit-SHA image tags, OCI build
  labels, previous-image preservation, automatic/manual rollback, an isolated
  fresh-install smoke and dependency-cache-safe build metadata.
+- Bound immutable release tags to both commit and dependency profile
+  (`<sha>-ai` or `<sha>-gis`) and reuse matching images instead of rebuilding
+  or overwriting an existing release tag.
 - Made production startup reject known-default PostGIS passwords and apply the
  configured upload limit consistently to nginx and FastAPI.