From 1b9b971c6ee2e2b4a3cbbe28ed1c14392eba4af5 Mon Sep 17 00:00:00 2001 From: Inferencebot Date: Tue, 27 Oct 2026 22:03:32 +0000 Subject: [PATCH] =?UTF-8?q?release.sh:=20`release`=20deployed=20the=20OLD?= =?UTF-8?q?=20image=20=E2=80=94=20pin=20the=20built=20tag,=20then=20deploy?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The release chain read the tag back from CloudronManifest.json BEFORE pinning it, so t was always the previous tag: release built the new image, then deployed the old one and printed success — the exact silent no-op this script exists to prevent. Its usage text promises build -> pin -> deploy -> verify; it did build -> deploy. cmd_build now exports the tag it built and release pins THAT, then deploys and verifies. Not exercised end-to-end yet (the theme deploy that found this bug was run as separate build/pin/deploy steps and passed all checks); the edit is syntax-checked only. --- release.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/release.sh b/release.sh index f85d68c..186f6c6 100755 --- a/release.sh +++ b/release.sh @@ -54,6 +54,7 @@ cmd_build() { # BuildKit does the work (no docker on the caller). What is required is a # registry login for this user on this host — env token or builder config. local tag="${TAG:-$(date -u +%Y%m%d)-$(git rev-parse --short HEAD)}" + OVERLAY_LAST_TAG="$tag" # for the `release` chain: pin THIS, not the manifest's stale tag [ -z "$(git status --porcelain)" ] || die "working tree is dirty — commit first, the tag carries the git sha" local logged_in=0 @@ -186,6 +187,6 @@ case "${1:-}" in deploy) shift; cmd_deploy "$@" ;; verify) shift; cmd_verify "$@" ;; volume) shift; cmd_volume "$@" ;; - release) shift; cmd_build "$@"; t=$(manifest_tag); cmd_deploy ;; + release) shift; cmd_build "$@"; cmd_pin "$OVERLAY_LAST_TAG"; cmd_deploy; cmd_verify ;; *) sed -n '2,30p' "$0" | sed 's/^# \{0,1\}//' ; exit 1 ;; esac