ci: deploy the verified local image

Build and test the Next.js application once with persistent BuildKit caches, smoke-test the immutable runtime image, and activate that same image through the shared production Docker daemon with serialized rollback-safe deployment.

scripts/deploy-release.sh

@@ -3,20 +3,32 @@ set -Eeuo pipefail
 
 deploy_root="${1:?deployment root is required}"
 release_id="${2:?release id is required}"
-archive="${3:?release archive is required}"
+image="${3:?runtime image is required}"
+sequence="${4:?deployment sequence is required}"
+incoming_compose="${5:?incoming Compose file is required}"
 
 if [[ "$deploy_root" != /* || "$deploy_root" == "/" ]]; then
   echo "DEPLOY_PATH must be an absolute directory other than /." >&2
   exit 2
 fi
-
 if [[ ! "$release_id" =~ ^[0-9a-f]{7,64}$ ]]; then
   echo "The release id must be a Git commit SHA." >&2
   exit 2
 fi
-
-if [[ ! -f "$archive" ]]; then
-  echo "Release archive not found: $archive" >&2
+if [[ "$image" != "amiirkhl-portfolio:$release_id" ]]; then
+  echo "The runtime image must be tagged with the release id." >&2
+  exit 2
+fi
+if [[ ! "$sequence" =~ ^[1-9][0-9]*$ ]]; then
+  echo "The deployment sequence must be a positive integer." >&2
+  exit 2
+fi
+if [[ ! -f "$incoming_compose" ]]; then
+  echo "Incoming Compose file not found: $incoming_compose" >&2
+  exit 2
+fi
+if ! command -v flock >/dev/null 2>&1; then
+  echo "flock is required to serialize deployments." >&2
   exit 2
 fi
 
@@ -26,7 +38,7 @@ current_link="$deploy_root/current"
 staging_dir="$releases_dir/.incoming-$release_id-$$"
 
 cleanup() {
-  rm -f -- "$archive"
+  rm -f -- "$incoming_compose"
   if [[ -d "$staging_dir" ]]; then
     rm -rf -- "$staging_dir"
   fi
@@ -34,16 +46,12 @@ cleanup() {
 trap cleanup EXIT
 
 mkdir -p -- "$releases_dir"
+exec 9>"$deploy_root/.deploy.lock"
+flock -x 9
 
-if [[ ! -d "$release_dir" ]]; then
-  mkdir -- "$staging_dir"
-  tar -xzf "$archive" -C "$staging_dir"
-  mv -- "$staging_dir" "$release_dir"
-fi
-
-if [[ ! -f "$release_dir/compose.yaml" ]]; then
-  echo "The release does not contain compose.yaml." >&2
-  exit 2
+if ! docker image inspect "$image" >/dev/null 2>&1; then
+  echo "Verified runtime image is missing from the production Docker daemon: $image" >&2
+  exit 1
 fi
 
 previous_release=""
@@ -51,12 +59,41 @@ if [[ -L "$current_link" ]]; then
   previous_release="$(readlink -f -- "$current_link" || true)"
 fi
 
+if [[ -n "$previous_release" && -f "$previous_release/release.env" ]]; then
+  current_sequence="$(sed -n 's/^DEPLOY_SEQUENCE=//p' "$previous_release/release.env")"
+  current_release="$(basename "$previous_release")"
+  if [[ "$current_release" == "$release_id" ]]; then
+    echo "Release is already active: $release_id"
+    exit 0
+  fi
+  if [[ "$current_sequence" =~ ^[1-9][0-9]*$ ]] && (( sequence <= current_sequence )); then
+    echo "Refusing stale deployment sequence $sequence; current sequence is $current_sequence." >&2
+    exit 1
+  fi
+fi
+
+if [[ ! -d "$release_dir" ]]; then
+  mkdir -- "$staging_dir"
+  install -m 600 "$incoming_compose" "$staging_dir/compose.yaml"
+  {
+    printf 'PORTFOLIO_IMAGE=%s\n' "$image"
+    printf 'DEPLOY_SEQUENCE=%s\n' "$sequence"
+  } > "$staging_dir/release.env"
+  mv -- "$staging_dir" "$release_dir"
+fi
+
+if [[ ! -f "$release_dir/compose.yaml" || ! -f "$release_dir/release.env" ]]; then
+  echo "Release metadata is incomplete: $release_dir" >&2
+  exit 2
+fi
+
 compose() {
   local directory="$1"
   shift
   docker compose \
     --project-name portfolio \
     --file "$directory/compose.yaml" \
+    --env-file "$directory/release.env" \
     "$@"
 }
 
@@ -73,7 +110,7 @@ wait_until_healthy() {
   for _ in {1..30}; do
     status="$(docker inspect --format '{{if .State.Health}}{{.State.Health.Status}}{{else}}{{.State.Status}}{{end}}' "$container_id")"
     case "$status" in
-      healthy|running)
+      healthy)
         return 0
         ;;
       unhealthy|exited|dead)
@@ -88,27 +125,35 @@ wait_until_healthy() {
   return 1
 }
 
-deploy() {
+activate() {
   local directory="$1"
+  local release_image
+
+  release_image="$(sed -n 's/^PORTFOLIO_IMAGE=//p' "$directory/release.env")"
+  if [[ -z "$release_image" ]] || ! docker image inspect "$release_image" >/dev/null 2>&1; then
+    echo "Release image is unavailable: ${release_image:-<unset>}" >&2
+    return 1
+  fi
+
   compose "$directory" config --quiet
-  compose "$directory" up --detach --build --remove-orphans
+  compose "$directory" up --detach --no-build --pull never --remove-orphans
   wait_until_healthy "$directory"
 }
 
-if deploy "$release_dir"; then
+if activate "$release_dir"; then
   new_link="$deploy_root/.current-$release_id-$$"
   ln -s -- "$release_dir" "$new_link"
   mv -Tf -- "$new_link" "$current_link"
-  echo "Deployment succeeded: $release_id"
+  echo "Deployment succeeded: $release_id ($image)"
   exit 0
 fi
 
 echo "Deployment failed; attempting rollback." >&2
-if [[ -n "$previous_release" && -f "$previous_release/compose.yaml" ]]; then
-  deploy "$previous_release"
+if [[ -n "$previous_release" && -f "$previous_release/compose.yaml" && -f "$previous_release/release.env" ]]; then
+  activate "$previous_release"
   echo "Rollback succeeded: $(basename "$previous_release")" >&2
 else
-  echo "No previous release is available to roll back to." >&2
+  echo "No image-based previous release is available for automatic rollback." >&2
 fi
 
 exit 1

scripts/smoke-container.sh

@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+image="${1:?runtime image is required}"
+container_name="portfolio-smoke-${GITEA_RUN_ID:-$$}"
+
+cleanup() {
+  docker rm --force "$container_name" >/dev/null 2>&1 || true
+}
+trap cleanup EXIT
+
+cleanup
+docker run --detach --name "$container_name" "$image" >/dev/null
+
+for _ in {1..30}; do
+  status="$(docker inspect --format '{{if .State.Health}}{{.State.Health.Status}}{{else}}{{.State.Status}}{{end}}' "$container_name")"
+  case "$status" in
+    healthy)
+      break
+      ;;
+    unhealthy|exited|dead)
+      docker logs "$container_name" >&2
+      exit 1
+      ;;
+  esac
+  sleep 2
+done
+
+if [[ "$(docker inspect --format '{{.State.Health.Status}}' "$container_name")" != "healthy" ]]; then
+  docker logs "$container_name" >&2
+  echo "Runtime image did not become healthy within 60 seconds." >&2
+  exit 1
+fi
+
+docker exec -i "$container_name" node <<'NODE'
+const origin = 'http://127.0.0.1:3000';
+
+async function expectOk(path, options) {
+  const response = await fetch(`${origin}${path}`, options);
+  if (!response.ok) throw new Error(`${path} returned ${response.status}`);
+  return response;
+}
+
+const english = await expectOk('/');
+await expectOk('/fa');
+await expectOk('/projects/interanet-solutions');
+await expectOk('/fa/projects/interanet-solutions');
+
+const html = await english.text();
+const staticAsset = html.match(/(?:src|href)="(\/_next\/static\/[^"?#]+)/)?.[1];
+if (!staticAsset) throw new Error('No built static asset was found in the home page.');
+await expectOk(staticAsset);
+
+const optimized = await expectOk(
+  '/_next/image?url=%2Fimages%2Favatar.png&w=256&q=75',
+  { headers: { Accept: 'image/webp' } },
+);
+const contentType = optimized.headers.get('content-type') ?? '';
+if (!/^image\/(?:webp|png)$/.test(contentType)) {
+  throw new Error(`Unexpected optimized image type: ${contentType}`);
+}
+if ((await optimized.arrayBuffer()).byteLength === 0) {
+  throw new Error('Optimized image response was empty.');
+}
+NODE