@akash-chowdhury-24/deployhub 2.0.9 → 2.0.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akash-chowdhury-24/deployhub",
-  "version": "2.0.9",
+  "version": "2.0.10",
   "description": "Zero-configuration deployment and artifact manager",
   "type": "module",
   "main": "./src/cli/index.js",

package/src/commands/doctor.js

@@ -450,6 +450,24 @@ async function runDeploymentChecks(config, envName, envConfig) {
       })
     );
 
+    checks.push(
+      await runCheck('Image tag strategy', async () => {
+        if (process.env.DOCKER_IMAGE_TAG) {
+          return {
+            name: 'Image tag strategy',
+            pass: true,
+            message: `DOCKER_IMAGE_TAG='${process.env.DOCKER_IMAGE_TAG}' is set explicitly — deploy will rollout-restart when the full image ref is unchanged; prefer unset for unique tags per build`,
+          };
+        }
+        return {
+          name: 'Image tag strategy',
+          pass: true,
+          message:
+            'DOCKER_IMAGE_TAG unset — deploy will auto-generate a unique tag (git SHA → CI id → timestamp)',
+        };
+      })
+    );
+
     checks.push(
       await runCheck('Container image pullable', async () => {
         const result = await checkImagePullability(config, process.env);

package/src/deployment/deployment-env.js

@@ -96,8 +96,12 @@ export const DEPLOYMENT_ENV_DEFS = {
     },
     {
       key: 'DOCKER_IMAGE_TAG',
-      optionalReason: 'defaults to your project version if unset',
-      comment: ['Image tag to build and deploy.'],
+      optionalReason:
+        'leave unset for a unique tag per build (git SHA → CI run id → timestamp); explicit tags are reused as-is',
+      comment: [
+        'Optional. Leave unset for a unique tag per build (git SHA, CI run id, or timestamp).',
+        'If set explicitly, the same tag is reused — Kubernetes may keep stale pods unless imagePullPolicy is Always or a rollout restart runs.',
+      ],
       example: 'latest',
       when: 'optional',
     },
@@ -324,9 +328,11 @@ export const DEPLOYMENT_ENV_DEFS = {
     },
     {
       key: 'DOCKER_IMAGE_TAG',
-      optionalReason: 'defaults to your project version, then "latest" if unset',
+      optionalReason:
+        'leave unset for a unique tag per build (git SHA → CI run id → timestamp); explicit tags are reused as-is',
       comment: [
-        'Image tag written into generated manifests and used at deploy time.',
+        'Optional image tag. Unset → DeployHub auto-generates a unique tag each build.',
+        'If set, that exact tag is used — reusing it can leave pods on a stale image (IfNotPresent) unless you rely on deploy-time rollout restart or set imagePullPolicy: Always.',
       ],
       example: 'latest',
       when: 'optional',
@@ -572,7 +578,7 @@ function getDefaultFromConfig(key, config, environments) {
     SSH_SSH_PORT: '22',
     KUBE_NAMESPACE: config?.project || 'default',
     DOCKER_IMAGE_NAME: config?.project,
-    DOCKER_IMAGE_TAG: config?.version || 'latest',
+    DOCKER_IMAGE_TAG: '',
     DOCKER_REGISTRY_URL: envEntry.dockerRegistryUrl,
     AWS_REGION: 'us-east-1',
   };

package/src/deployment/providers/kubernetes.js

@@ -6,6 +6,7 @@ import { createLogger } from '../../logger/index.js';
 import { sanitizeK8sName } from '../../utils/kubernetes-manifests.js';
 import { createDockerImageDeployContext } from '../../utils/docker-image-deploy.js';
 import { ensureKubernetesNamespace } from '../../utils/kubernetes-namespace.js';
+import { syncKubernetesDeploymentImage } from '../../utils/kubernetes-deploy-image.js';
 
 /**
  * @param {import('../../core/config.js').DeployHubConfig} config
@@ -88,22 +89,15 @@ export function createKubernetesProvider(config, envName, env = process.env) {
       env: getKubectlEnv(),
     });
 
-    const imageName = env.DOCKER_IMAGE_NAME;
-    const imageTag = env.DOCKER_IMAGE_TAG || config.version || 'latest';
-    if (imageName && config.project) {
-      await execa(
-        'kubectl',
-        kubectlArgs([
-          'set',
-          'image',
-          `deployment/${deploymentName}`,
-          `${deploymentName}=${imageName}:${imageTag}`,
-        ]),
-        { stdio: 'pipe', env: getKubectlEnv() }
-      ).catch(() => {
-        log.warn('kubectl set image skipped (deployment name may differ from project name)');
-      });
-    }
+    // Always set image to the resolved fullImage (includes registry URL prefix when set).
+    // If the live ref already equals fullImage, rollout restart so a new digest is pulled.
+    await syncKubernetesDeploymentImage({
+      deploymentName,
+      fullImage: imageOps.fullImage,
+      kubectlArgs,
+      getKubectlEnv,
+      log,
+    });
 
     log.success('Kubernetes deployment complete');
   }

package/src/utils/docker-image-deploy.js

@@ -11,6 +11,7 @@ import {
   isFrontendStaticFramework,
   isInterpretedBackendFramework,
   resolveDockerImageRef,
+  EXPLICIT_IMAGE_TAG_WARNING,
 } from './docker-image.js';
 
 /**
@@ -22,13 +23,19 @@ import {
  * @param {{ info: Function, warn: Function, success: Function }} log
  */
 export function createDockerImageDeployContext(config, env = process.env, log) {
-  const { fullImage, latestImage, legacyLatestImage, imageTag } =
+  const { fullImage, latestImage, legacyLatestImage, imageTag, tagSource } =
     resolveDockerImageRef(config, env);
   const registryUrl = env.DOCKER_REGISTRY_URL || '';
   const registryUser = env.DOCKER_REGISTRY_USERNAME || '';
   const registryToken = env.DOCKER_REGISTRY_TOKEN || '';
   const dockerHost = env.DOCKER_HOST || '';
 
+  if (tagSource === 'explicit') {
+    log.warn(EXPLICIT_IMAGE_TAG_WARNING);
+  } else {
+    log.info(`Using auto image tag '${imageTag}' (source: ${tagSource})`);
+  }
+
   function getDockerEnv() {
     /** @type {Record<string, string>} */
     const dockerEnv = { ...process.env };
@@ -324,6 +331,7 @@ export function createDockerImageDeployContext(config, env = process.env, log) {
     fullImage,
     latestImage,
     imageTag,
+    tagSource,
     getDockerEnv,
     hasRegistryCredentials,
     dockerLogin,

package/src/utils/docker-image.js

@@ -2,20 +2,100 @@
  * Shared Docker image naming for pipeline builds and deploy.
  */
 
+import { execFileSync } from 'child_process';
+
+/** @typedef {'explicit'|'git'|'ci'|'timestamp'} ImageTagSource */
+
+export const EXPLICIT_IMAGE_TAG_WARNING =
+  'DOCKER_IMAGE_TAG is set — reusing the same tag across deploys can leave Kubernetes pods on a stale image (imagePullPolicy defaults to IfNotPresent) unless imagePullPolicy is Always or a rollout restart runs.';
+
+/**
+ * High-resolution timestamp for image tags only (artifact versioning keeps getDateVersion()).
+ * Minute prefix matches getDateVersion(); seconds+ms avoid collisions in fast rebuild loops.
+ * @param {Date} [now]
+ * @returns {string}
+ */
+export function highResImageTagFallback(now = new Date()) {
+  const y = now.getFullYear();
+  const m = String(now.getMonth() + 1).padStart(2, '0');
+  const d = String(now.getDate()).padStart(2, '0');
+  const h = String(now.getHours()).padStart(2, '0');
+  const min = String(now.getMinutes()).padStart(2, '0');
+  const sec = String(now.getSeconds()).padStart(2, '0');
+  const ms = String(now.getMilliseconds()).padStart(3, '0');
+  return `${y}.${m}.${d}.${h}${min}-${sec}${ms}`;
+}
+
+/**
+ * @returns {string|null}
+ */
+function defaultGetGitShortSha() {
+  try {
+    const sha = execFileSync('git', ['rev-parse', '--short', 'HEAD'], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+    }).trim();
+    return sha || null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Resolve image tag when DOCKER_IMAGE_TAG is unset: git SHA → CI id → high-res timestamp.
+ * Does not use config.version (static package versions would prevent redeploys).
+ *
+ * @param {Record<string, string|undefined>} [env]
+ * @param {{
+ *   getGitShortSha?: () => string|null,
+ *   now?: () => Date,
+ * }} [options]
+ * @returns {{ imageTag: string, tagSource: ImageTagSource }}
+ */
+export function resolveImageTag(env = process.env, options = {}) {
+  const explicit = env.DOCKER_IMAGE_TAG;
+  if (explicit) {
+    return { imageTag: explicit, tagSource: 'explicit' };
+  }
+
+  const getGitShortSha = options.getGitShortSha || defaultGetGitShortSha;
+  const gitSha = getGitShortSha();
+  if (gitSha) {
+    return { imageTag: gitSha, tagSource: 'git' };
+  }
+
+  const ciTag =
+    (env.GITHUB_SHA && String(env.GITHUB_SHA).slice(0, 7)) ||
+    env.GITHUB_RUN_ID ||
+    env.CI_COMMIT_SHORT_SHA ||
+    env.CI_PIPELINE_ID;
+  if (ciTag) {
+    return { imageTag: String(ciTag), tagSource: 'ci' };
+  }
+
+  const now = options.now ? options.now() : new Date();
+  return { imageTag: highResImageTagFallback(now), tagSource: 'timestamp' };
+}
+
 /**
  * @param {import('../core/config.js').DeployHubConfig} config
  * @param {Record<string, string|undefined>} [env]
+ * @param {{
+ *   getGitShortSha?: () => string|null,
+ *   now?: () => Date,
+ * }} [options]
  * @returns {{
  *   imageName: string,
  *   imageTag: string,
  *   fullImage: string,
  *   latestImage: string,
  *   legacyLatestImage: string,
+ *   tagSource: ImageTagSource,
  * }}
  */
-export function resolveDockerImageRef(config, env = process.env) {
+export function resolveDockerImageRef(config, env = process.env, options = {}) {
   const imageName = env.DOCKER_IMAGE_NAME || config.project;
-  const imageTag = env.DOCKER_IMAGE_TAG || config.version || 'latest';
+  const { imageTag, tagSource } = resolveImageTag(env, options);
   const registryUrl = env.DOCKER_REGISTRY_URL || '';
 
   const repository =
@@ -29,6 +109,7 @@ export function resolveDockerImageRef(config, env = process.env) {
     fullImage: `${repository}:${imageTag}`,
     latestImage: `${repository}:latest`,
     legacyLatestImage: `${config.project}:latest`,
+    tagSource,
   };
 }
 
@@ -170,6 +251,9 @@ export function describeInterpretedBackendGap(framework) {
 
 export default {
   resolveDockerImageRef,
+  resolveImageTag,
+  highResImageTagFallback,
+  EXPLICIT_IMAGE_TAG_WARNING,
   generateFrontendRuntimeDockerfile,
   generateSpringRuntimeDockerfile,
   generateGoRuntimeDockerfile,

package/src/utils/kubernetes-deploy-image.js

@@ -0,0 +1,111 @@
+import { execa } from 'execa';
+
+/**
+ * After kubectl apply, set the Deployment container image to fullImage and
+ * rollout-restart only when the live image ref is already identical (same
+ * registry + name + tag), so a new digest under a reused tag still redeploys.
+ *
+ * @param {{
+ *   deploymentName: string,
+ *   fullImage: string,
+ *   kubectlArgs: (args: string[]) => string[],
+ *   getKubectlEnv: () => NodeJS.ProcessEnv,
+ *   log: { info: Function, warn: Function, success?: Function },
+ *   execaFn?: typeof execa,
+ * }} options
+ * @returns {Promise<{ beforeImage: string, setImage: boolean, restarted: boolean }>}
+ */
+export async function syncKubernetesDeploymentImage(options) {
+  const {
+    deploymentName,
+    fullImage,
+    kubectlArgs,
+    getKubectlEnv,
+    log,
+    execaFn = execa,
+  } = options;
+
+  const beforeImage = await readDeploymentContainerImage({
+    deploymentName,
+    kubectlArgs,
+    getKubectlEnv,
+    execaFn,
+  });
+
+  let setImage = false;
+  try {
+    await execaFn(
+      'kubectl',
+      kubectlArgs([
+        'set',
+        'image',
+        `deployment/${deploymentName}`,
+        `${deploymentName}=${fullImage}`,
+      ]),
+      { stdio: 'pipe', env: getKubectlEnv() }
+    );
+    setImage = true;
+  } catch {
+    log.warn('kubectl set image skipped (deployment name may differ from project name)');
+  }
+
+  // Compare full image refs (registry + name + tag), not tag alone.
+  if (beforeImage === fullImage) {
+    log.info(
+      `Image ref unchanged (${fullImage}) — running rollout restart so pods pick up a new digest`
+    );
+    await execaFn(
+      'kubectl',
+      kubectlArgs(['rollout', 'restart', `deployment/${deploymentName}`]),
+      { stdio: 'inherit', env: getKubectlEnv() }
+    );
+    return { beforeImage, setImage, restarted: true };
+  }
+
+  return { beforeImage, setImage, restarted: false };
+}
+
+/**
+ * @param {{
+ *   deploymentName: string,
+ *   kubectlArgs: (args: string[]) => string[],
+ *   getKubectlEnv: () => NodeJS.ProcessEnv,
+ *   execaFn: typeof execa,
+ * }} options
+ * @returns {Promise<string>}
+ */
+async function readDeploymentContainerImage(options) {
+  const { deploymentName, kubectlArgs, getKubectlEnv, execaFn } = options;
+
+  const jsonpath = `{.spec.template.spec.containers[?(@.name=="${deploymentName}")].image}`;
+  try {
+    const { stdout } = await execaFn(
+      'kubectl',
+      kubectlArgs(['get', 'deployment', deploymentName, '-o', `jsonpath=${jsonpath}`]),
+      { stdio: 'pipe', env: getKubectlEnv() }
+    );
+    const trimmed = String(stdout || '').trim();
+    if (trimmed) return trimmed;
+  } catch {
+    // fall through to containers[0]
+  }
+
+  try {
+    const { stdout } = await execaFn(
+      'kubectl',
+      kubectlArgs([
+        'get',
+        'deployment',
+        deploymentName,
+        '-o',
+        'jsonpath={.spec.template.spec.containers[0].image}',
+      ]),
+      { stdio: 'pipe', env: getKubectlEnv() }
+    );
+    return String(stdout || '').trim();
+  } catch {
+    return '';
+  }
+}
+
+export default { syncKubernetesDeploymentImage };

package/src/utils/kubernetes-manifests.js

@@ -83,6 +83,7 @@ spec:
     spec:
 ${pullSecretBlock}      containers:
       - name: ${name}
+        # Image tag is overwritten at deploy time (kubectl set image uses the resolved build tag)
         image: ${image}
         ports:
         - containerPort: ${port}