huskies: merge 1242 refactor script/release builds project images so they can't drift

script/build-project-images

@@ -4,19 +4,10 @@ set -euo pipefail
 # Build all project images in dependency order:
 #   huskies  →  huskies-project-base  →  huskies-project-<stack> (one per stack fragment)
 #
-# Run this after `script/docker_rebuild` or whenever you add a new stack.
-# Safe to re-run: each step re-tags the image with the latest layers.
-#
-# IMPORTANT (story 1231): this script is NOT part of `script/release`. The
-# huskies-project-* images bake whatever `huskies` binary happened to be built
-# locally the last time this ran — as of this comment that's 0.13.0, several
-# releases behind the current fleet artifact. `project-rebuild` self-heals a
-# sled that comes back on a stale baked binary (it re-upgrades it in place
-# from the gateway's published artifact), but that costs an extra
-# download+restart cycle every time. Run `script/build-project-images` after
-# every `script/release` — ideally as a step in the release flow itself — so
-# freshly rebuilt sleds start on a current binary instead of relying on the
-# self-heal.
+# Called automatically by `script/release` (story 1242) so the huskies-project-*
+# images never drift from the version being published. Also safe to run
+# standalone after `script/docker_rebuild` or whenever you add a new stack —
+# each step re-tags the image with the latest layers.
 
 cd "$(dirname "$0")/.."
 

script/release

@@ -1,16 +1,6 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-# NOTE (story 1231): this script publishes the `huskies` binary artifact
-# (consumed by the `upgrade`/`upgrade all` chat commands) but does NOT
-# rebuild the huskies-project-* Docker images that `project-rebuild` uses.
-# Those images bake whatever binary was locally built the last time
-# `script/build-project-images` ran, so they silently drift stale otherwise
-# (currently baking 0.13.0). Run `script/build-project-images` after this
-# script — or better, fold it into this release flow — so a `project-rebuild`
-# right after a release doesn't need to self-heal a stale sled back up to the
-# version just published here.
-
 # ── Configuration ──────────────────────────────────────────────
 GITEA_URL="https://code.crashlabs.io"
 REPO="crashlabs/huskies"
@@ -97,6 +87,19 @@ cross build --release --target x86_64-unknown-linux-musl
 echo "==> Building Linux arm64 (static musl via cross)..."
 cross build --release --target aarch64-unknown-linux-musl
 
+# ── Build project images ─────────────────────────────────────────
+# Rebuild the huskies-project-* Docker images from this exact source tree
+# (the version-bump commit above already landed, so build.rs's `git
+# rev-parse HEAD` embeds the matching git hash) so they never drift from
+# the binary being published below. A release that can't produce these
+# images fails loudly here, before anything is tagged, pushed, or published.
+echo "==> Building project images..."
+if ! "${SCRIPT_DIR}/script/build-project-images"; then
+  echo "Error: failed to build huskies-project-* images at ${VERSION}."
+  echo "Release aborted — nothing was tagged, pushed, or published."
+  exit 1
+fi
+
 # ── Package ────────────────────────────────────────────────────
 DIST="target/dist"
 rm -rf "$DIST"