ci: deploy the verified local image

Build and test the Next.js application once with persistent BuildKit caches, smoke-test the immutable runtime image, and activate that same image through the shared production Docker daemon with serialized rollback-safe deployment.

scripts/deploy-release.sh

@@ -3,20 +3,32 @@ set -Eeuo pipefail
 
 deploy_root="${1:?deployment root is required}"
 release_id="${2:?release id is required}"
-archive="${3:?release archive is required}"
+image="${3:?runtime image is required}"
+sequence="${4:?deployment sequence is required}"
+incoming_compose="${5:?incoming Compose file is required}"
 
 if [[ "$deploy_root" != /* || "$deploy_root" == "/" ]]; then
   echo "DEPLOY_PATH must be an absolute directory other than /." >&2
   exit 2
 fi
-
 if [[ ! "$release_id" =~ ^[0-9a-f]{7,64}$ ]]; then
   echo "The release id must be a Git commit SHA." >&2
   exit 2
 fi
-
-if [[ ! -f "$archive" ]]; then
-  echo "Release archive not found: $archive" >&2
+if [[ "$image" != "amiirkhl-portfolio:$release_id" ]]; then
+  echo "The runtime image must be tagged with the release id." >&2
+  exit 2
+fi
+if [[ ! "$sequence" =~ ^[1-9][0-9]*$ ]]; then
+  echo "The deployment sequence must be a positive integer." >&2
+  exit 2
+fi
+if [[ ! -f "$incoming_compose" ]]; then
+  echo "Incoming Compose file not found: $incoming_compose" >&2
+  exit 2
+fi
+if ! command -v flock >/dev/null 2>&1; then
+  echo "flock is required to serialize deployments." >&2
   exit 2
 fi
 
@@ -26,7 +38,7 @@ current_link="$deploy_root/current"
 staging_dir="$releases_dir/.incoming-$release_id-$$"
 
 cleanup() {
-  rm -f -- "$archive"
+  rm -f -- "$incoming_compose"
   if [[ -d "$staging_dir" ]]; then
     rm -rf -- "$staging_dir"
   fi
@@ -34,16 +46,12 @@ cleanup() {
 trap cleanup EXIT
 
 mkdir -p -- "$releases_dir"
+exec 9>"$deploy_root/.deploy.lock"
+flock -x 9
 
-if [[ ! -d "$release_dir" ]]; then
-  mkdir -- "$staging_dir"
-  tar -xzf "$archive" -C "$staging_dir"
-  mv -- "$staging_dir" "$release_dir"
-fi
-
-if [[ ! -f "$release_dir/compose.yaml" ]]; then
-  echo "The release does not contain compose.yaml." >&2
-  exit 2
+if ! docker image inspect "$image" >/dev/null 2>&1; then
+  echo "Verified runtime image is missing from the production Docker daemon: $image" >&2
+  exit 1
 fi
 
 previous_release=""
@@ -51,12 +59,41 @@ if [[ -L "$current_link" ]]; then
   previous_release="$(readlink -f -- "$current_link" || true)"
 fi
 
+if [[ -n "$previous_release" && -f "$previous_release/release.env" ]]; then
+  current_sequence="$(sed -n 's/^DEPLOY_SEQUENCE=//p' "$previous_release/release.env")"
+  current_release="$(basename "$previous_release")"
+  if [[ "$current_release" == "$release_id" ]]; then
+    echo "Release is already active: $release_id"
+    exit 0
+  fi
+  if [[ "$current_sequence" =~ ^[1-9][0-9]*$ ]] && (( sequence <= current_sequence )); then
+    echo "Refusing stale deployment sequence $sequence; current sequence is $current_sequence." >&2
+    exit 1
+  fi
+fi
+
+if [[ ! -d "$release_dir" ]]; then
+  mkdir -- "$staging_dir"
+  install -m 600 "$incoming_compose" "$staging_dir/compose.yaml"
+  {
+    printf 'PORTFOLIO_IMAGE=%s\n' "$image"
+    printf 'DEPLOY_SEQUENCE=%s\n' "$sequence"
+  } > "$staging_dir/release.env"
+  mv -- "$staging_dir" "$release_dir"
+fi
+
+if [[ ! -f "$release_dir/compose.yaml" || ! -f "$release_dir/release.env" ]]; then
+  echo "Release metadata is incomplete: $release_dir" >&2
+  exit 2
+fi
+
 compose() {
   local directory="$1"
   shift
   docker compose \
     --project-name portfolio \
     --file "$directory/compose.yaml" \
+    --env-file "$directory/release.env" \
     "$@"
 }
 
@@ -73,7 +110,7 @@ wait_until_healthy() {
   for _ in {1..30}; do
     status="$(docker inspect --format '{{if .State.Health}}{{.State.Health.Status}}{{else}}{{.State.Status}}{{end}}' "$container_id")"
     case "$status" in
-      healthy|running)
+      healthy)
         return 0
         ;;
       unhealthy|exited|dead)
@@ -88,27 +125,35 @@ wait_until_healthy() {
   return 1
 }
 
-deploy() {
+activate() {
   local directory="$1"
+  local release_image
+
+  release_image="$(sed -n 's/^PORTFOLIO_IMAGE=//p' "$directory/release.env")"
+  if [[ -z "$release_image" ]] || ! docker image inspect "$release_image" >/dev/null 2>&1; then
+    echo "Release image is unavailable: ${release_image:-<unset>}" >&2
+    return 1
+  fi
+
   compose "$directory" config --quiet
-  compose "$directory" up --detach --build --remove-orphans
+  compose "$directory" up --detach --no-build --pull never --remove-orphans
   wait_until_healthy "$directory"
 }
 
-if deploy "$release_dir"; then
+if activate "$release_dir"; then
   new_link="$deploy_root/.current-$release_id-$$"
   ln -s -- "$release_dir" "$new_link"
   mv -Tf -- "$new_link" "$current_link"
-  echo "Deployment succeeded: $release_id"
+  echo "Deployment succeeded: $release_id ($image)"
   exit 0
 fi
 
 echo "Deployment failed; attempting rollback." >&2
-if [[ -n "$previous_release" && -f "$previous_release/compose.yaml" ]]; then
-  deploy "$previous_release"
+if [[ -n "$previous_release" && -f "$previous_release/compose.yaml" && -f "$previous_release/release.env" ]]; then
+  activate "$previous_release"
   echo "Rollback succeeded: $(basename "$previous_release")" >&2
 else
-  echo "No previous release is available to roll back to." >&2
+  echo "No image-based previous release is available for automatic rollback." >&2
 fi
 
 exit 1