Make release image tags truly immutable

deploy/unraid/Dockerfile.all-in-one

@@ -159,7 +159,8 @@ ENV GEOINTEL_BUILD_SHA="${GEOINTEL_BUILD_SHA}" \
 LABEL org.opencontainers.image.title="GeoIntel" \
       org.opencontainers.image.description="GeoIntel workbench for Belgium and the Belgian North Sea" \
       org.opencontainers.image.revision="${GEOINTEL_BUILD_SHA}" \
-      org.opencontainers.image.created="${GEOINTEL_BUILD_TIME}"
+      org.opencontainers.image.created="${GEOINTEL_BUILD_TIME}" \
+      io.geointel.ai.enabled="${GEOINTEL_INSTALL_AI}"
 
 VOLUME ["/var/lib/postgresql/data", "/app/storage"]
 

deploy/unraid/README.md

@@ -81,10 +81,11 @@ password is empty or one of the documented defaults.
 
 The repository deploy scripts run the same flow automatically. They validate
 the Compose reference, preserve the current image as
-`geointel-all-in-one:previous`, build an immutable commit-SHA tag plus `latest`,
-install the DockerMan metadata and start the SHA-tagged image. A failed start,
-live migration smoke or browser/API smoke automatically attempts the previous
-image without changing the configured PostGIS or storage paths.
+`geointel-all-in-one:previous`, build an immutable `<commit-sha>-ai` or
+`<commit-sha>-gis` tag plus `latest`, install the DockerMan metadata and start
+the immutable image. An existing matching tag is reused, never rebuilt. A
+failed start, live migration smoke or browser/API smoke automatically attempts
+the previous image without changing the configured PostGIS or storage paths.
 
 `scripts/deploy_tower.sh` and `scripts/deploy_tower.ps1` source the remote
 `.env` before building the image. That means `GEOINTEL_INSTALL_AI=true` in
@@ -270,7 +271,7 @@ bash deploy/unraid/rollback-dockerman-container.sh
 For an older retained commit, select its immutable tag explicitly:
 
 ```bash
-GEOINTEL_ROLLBACK_IMAGE=geointel-all-in-one:<commit-sha> \
+GEOINTEL_ROLLBACK_IMAGE=geointel-all-in-one:<commit-sha>-ai \
   bash deploy/unraid/rollback-dockerman-container.sh
 ```
 

deploy/unraid/deploy-release.sh

@@ -19,7 +19,12 @@ GEOINTEL_INSTALL_AI="${GEOINTEL_INSTALL_AI:-false}"
 GEOINTEL_BUILD_SHA="$(git rev-parse HEAD)"
 GEOINTEL_BUILD_TIME="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
 GEOINTEL_IMAGE_REPOSITORY="${GEOINTEL_IMAGE_REPOSITORY:-geointel-all-in-one}"
-GEOINTEL_RELEASE_IMAGE="${GEOINTEL_IMAGE_REPOSITORY}:${GEOINTEL_BUILD_SHA}"
+if [ "$GEOINTEL_INSTALL_AI" = "true" ]; then
+  GEOINTEL_RELEASE_VARIANT="ai"
+else
+  GEOINTEL_RELEASE_VARIANT="gis"
+fi
+GEOINTEL_RELEASE_IMAGE="${GEOINTEL_IMAGE_REPOSITORY}:${GEOINTEL_BUILD_SHA}-${GEOINTEL_RELEASE_VARIANT}"
 GEOINTEL_PREVIOUS_IMAGE="${GEOINTEL_IMAGE_REPOSITORY}:previous"
 FRONTEND_URL="${FRONTEND_URL:-http://127.0.0.1:${GEOINTEL_FRONTEND_PORT:-1202}}"
 
@@ -62,25 +67,36 @@ docker compose -f docker-compose.unraid.yml config >/dev/null
 
 current_image_id="$(docker inspect --format '{{.Image}}' geointel 2>/dev/null || true)"
 if [ -n "$current_image_id" ] && docker image inspect "$current_image_id" >/dev/null 2>&1; then
-  current_revision="$(
-    docker image inspect \
-      --format '{{index .Config.Labels "org.opencontainers.image.revision"}}' \
-      "$current_image_id" 2>/dev/null || true
-  )"
-  if [ -n "$current_revision" ] && [ "$current_revision" != "<no value>" ] && [ "$current_revision" != "unknown" ]; then
-    docker tag "$current_image_id" "${GEOINTEL_IMAGE_REPOSITORY}:${current_revision}"
-  fi
   docker tag "$current_image_id" "$GEOINTEL_PREVIOUS_IMAGE"
 fi
 
-docker build \
-  --build-arg GEOINTEL_INSTALL_AI="$GEOINTEL_INSTALL_AI" \
-  --build-arg GEOINTEL_BUILD_SHA="$GEOINTEL_BUILD_SHA" \
-  --build-arg GEOINTEL_BUILD_TIME="$GEOINTEL_BUILD_TIME" \
-  -f deploy/unraid/Dockerfile.all-in-one \
-  -t "$GEOINTEL_RELEASE_IMAGE" \
-  -t "${GEOINTEL_IMAGE_REPOSITORY}:latest" \
-  .
+if docker image inspect "$GEOINTEL_RELEASE_IMAGE" >/dev/null 2>&1; then
+  stored_revision="$(
+    docker image inspect \
+      --format '{{index .Config.Labels "org.opencontainers.image.revision"}}' \
+      "$GEOINTEL_RELEASE_IMAGE"
+  )"
+  stored_ai="$(
+    docker image inspect \
+      --format '{{index .Config.Labels "io.geointel.ai.enabled"}}' \
+      "$GEOINTEL_RELEASE_IMAGE"
+  )"
+  if [ "$stored_revision" != "$GEOINTEL_BUILD_SHA" ] || [ "$stored_ai" != "$GEOINTEL_INSTALL_AI" ]; then
+    echo "Immutable release tag has conflicting metadata: ${GEOINTEL_RELEASE_IMAGE}" >&2
+    exit 2
+  fi
+  echo "Reusing existing immutable image ${GEOINTEL_RELEASE_IMAGE}."
+  docker tag "$GEOINTEL_RELEASE_IMAGE" "${GEOINTEL_IMAGE_REPOSITORY}:latest"
+else
+  docker build \
+    --build-arg GEOINTEL_INSTALL_AI="$GEOINTEL_INSTALL_AI" \
+    --build-arg GEOINTEL_BUILD_SHA="$GEOINTEL_BUILD_SHA" \
+    --build-arg GEOINTEL_BUILD_TIME="$GEOINTEL_BUILD_TIME" \
+    -f deploy/unraid/Dockerfile.all-in-one \
+    -t "$GEOINTEL_RELEASE_IMAGE" \
+    -t "${GEOINTEL_IMAGE_REPOSITORY}:latest" \
+    .
+fi
 
 if ! start_image "$GEOINTEL_RELEASE_IMAGE"; then
   rollback_previous || true