From 6e8f99ea4b7fd1bc7896a04caf7b4717baf490da Mon Sep 17 00:00:00 2001
From: JSONbored <49853598+JSONbored@users.noreply.github.com>
Date: Mon, 6 Jul 2026 21:27:16 -0700
Subject: [PATCH] fix(selfhost): stop deploy-selfhost-image.sh silently losing
 to a build: override

The script's generated temp override only set `image:` for the target
service. When an operator's own docker-compose.override.yml also
defines a `build:` block for that same service (a sanctioned self-host
customization, e.g. a local INSTALL_AI_CLIS install), `docker compose
up --no-build` still preferred the pre-existing project-scoped build
artifact over the newly pulled image -- silently. The script reported
success, the container recreated and passed health checks, but was
still running the old locally-built image.

Reproduced live during an orb-v0.3.0 deploy: the pulled image sat on
disk, healthy, unused, while the container kept running a stale build
missing a since-added migration.

Add `build: !reset null` to the generated override so the pulled image
always wins regardless of what base/override compose files define.
Confirmed harmless when no build: block exists at all.
---
 scripts/deploy-selfhost-image.sh        | 6 ++++++
 test/unit/selfhost-image-deploy.test.ts | 5 ++++-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/scripts/deploy-selfhost-image.sh b/scripts/deploy-selfhost-image.sh
index 5a17f57990..1149375889 100755
--- a/scripts/deploy-selfhost-image.sh
+++ b/scripts/deploy-selfhost-image.sh
@@ -97,6 +97,12 @@ cat >"$override_file" <<YAML
 services:
   $SERVICE:
     image: "$IMAGE"
+    # An operator's own docker-compose.override.yml may define a \`build:\` block for this service (e.g. a
+    # local INSTALL_AI_CLIS customization) -- when BOTH build and image are present, \`up --no-build\` still
+    # prefers a pre-existing project-scoped build artifact over the pulled image, silently ignoring it. Reset
+    # unsets any build config from every earlier -f file so the pulled image always wins. Harmless no-op when
+    # no build: block exists at all.
+    build: !reset null
 YAML
 
 mapfile -t compose_args < <(compose_file_args)
diff --git a/test/unit/selfhost-image-deploy.test.ts b/test/unit/selfhost-image-deploy.test.ts
index 11f6076c4d..1d53db8ac9 100644
--- a/test/unit/selfhost-image-deploy.test.ts
+++ b/test/unit/selfhost-image-deploy.test.ts
@@ -49,7 +49,7 @@ if [ "$1" = "compose" ]; then
         prev="$arg"
       done
       if [ -n "$last_file" ]; then
-        grep 'image:' "$last_file" >> "$DOCKER_IMAGES"
+        cat "$last_file" >> "$DOCKER_IMAGES"
       fi
       exit 0
       ;;
@@ -153,6 +153,9 @@ describe("self-host image deploy script", () => {
       expect(result.status, result.stderr).toBe(0);
       expect(readFileSync(harness.envPath, "utf8")).toContain(`GITTENSORY_IMAGE=${expected}`);
       expect(harness.readImages()).toContain(`image: "${expected}"`);
+      // REGRESSION: without this reset, an operator's own docker-compose.override.yml build: block for this
+      // service silently wins over the pulled image at `up --no-build` time (found deploying live).
+      expect(harness.readImages()).toContain("build: !reset null");
       expect(harness.readCalls()).toContain("up -d --no-build --no-deps gittensory");
       expect(harness.readCalls()).not.toContain(" build ");
     } finally {