Make release image tags truly immutable

deploy/unraid/deploy-release.sh

@@ -19,7 +19,12 @@ GEOINTEL_INSTALL_AI="${GEOINTEL_INSTALL_AI:-false}"
 GEOINTEL_BUILD_SHA="$(git rev-parse HEAD)"
 GEOINTEL_BUILD_TIME="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
 GEOINTEL_IMAGE_REPOSITORY="${GEOINTEL_IMAGE_REPOSITORY:-geointel-all-in-one}"
-GEOINTEL_RELEASE_IMAGE="${GEOINTEL_IMAGE_REPOSITORY}:${GEOINTEL_BUILD_SHA}"
+if [ "$GEOINTEL_INSTALL_AI" = "true" ]; then
+  GEOINTEL_RELEASE_VARIANT="ai"
+else
+  GEOINTEL_RELEASE_VARIANT="gis"
+fi
+GEOINTEL_RELEASE_IMAGE="${GEOINTEL_IMAGE_REPOSITORY}:${GEOINTEL_BUILD_SHA}-${GEOINTEL_RELEASE_VARIANT}"
 GEOINTEL_PREVIOUS_IMAGE="${GEOINTEL_IMAGE_REPOSITORY}:previous"
 FRONTEND_URL="${FRONTEND_URL:-http://127.0.0.1:${GEOINTEL_FRONTEND_PORT:-1202}}"
 
@@ -62,25 +67,36 @@ docker compose -f docker-compose.unraid.yml config >/dev/null
 
 current_image_id="$(docker inspect --format '{{.Image}}' geointel 2>/dev/null || true)"
 if [ -n "$current_image_id" ] && docker image inspect "$current_image_id" >/dev/null 2>&1; then
-  current_revision="$(
-    docker image inspect \
-      --format '{{index .Config.Labels "org.opencontainers.image.revision"}}' \
-      "$current_image_id" 2>/dev/null || true
-  )"
-  if [ -n "$current_revision" ] && [ "$current_revision" != "<no value>" ] && [ "$current_revision" != "unknown" ]; then
-    docker tag "$current_image_id" "${GEOINTEL_IMAGE_REPOSITORY}:${current_revision}"
-  fi
   docker tag "$current_image_id" "$GEOINTEL_PREVIOUS_IMAGE"
 fi
 
-docker build \
-  --build-arg GEOINTEL_INSTALL_AI="$GEOINTEL_INSTALL_AI" \
-  --build-arg GEOINTEL_BUILD_SHA="$GEOINTEL_BUILD_SHA" \
-  --build-arg GEOINTEL_BUILD_TIME="$GEOINTEL_BUILD_TIME" \
-  -f deploy/unraid/Dockerfile.all-in-one \
-  -t "$GEOINTEL_RELEASE_IMAGE" \
-  -t "${GEOINTEL_IMAGE_REPOSITORY}:latest" \
-  .
+if docker image inspect "$GEOINTEL_RELEASE_IMAGE" >/dev/null 2>&1; then
+  stored_revision="$(
+    docker image inspect \
+      --format '{{index .Config.Labels "org.opencontainers.image.revision"}}' \
+      "$GEOINTEL_RELEASE_IMAGE"
+  )"
+  stored_ai="$(
+    docker image inspect \
+      --format '{{index .Config.Labels "io.geointel.ai.enabled"}}' \
+      "$GEOINTEL_RELEASE_IMAGE"
+  )"
+  if [ "$stored_revision" != "$GEOINTEL_BUILD_SHA" ] || [ "$stored_ai" != "$GEOINTEL_INSTALL_AI" ]; then
+    echo "Immutable release tag has conflicting metadata: ${GEOINTEL_RELEASE_IMAGE}" >&2
+    exit 2
+  fi
+  echo "Reusing existing immutable image ${GEOINTEL_RELEASE_IMAGE}."
+  docker tag "$GEOINTEL_RELEASE_IMAGE" "${GEOINTEL_IMAGE_REPOSITORY}:latest"
+else
+  docker build \
+    --build-arg GEOINTEL_INSTALL_AI="$GEOINTEL_INSTALL_AI" \
+    --build-arg GEOINTEL_BUILD_SHA="$GEOINTEL_BUILD_SHA" \
+    --build-arg GEOINTEL_BUILD_TIME="$GEOINTEL_BUILD_TIME" \
+    -f deploy/unraid/Dockerfile.all-in-one \
+    -t "$GEOINTEL_RELEASE_IMAGE" \
+    -t "${GEOINTEL_IMAGE_REPOSITORY}:latest" \
+    .
+fi
 
 if ! start_image "$GEOINTEL_RELEASE_IMAGE"; then
   rollback_previous || true