From 9ddab5f1fa050ddc1c2ba4403b815749d0003054 Mon Sep 17 00:00:00 2001
From: Butler Agent <wayfinderak@wayfinderak.com>
Date: Fri, 11 Sep 2026 08:53:23 +0000
Subject: [PATCH] feat(delivery): publish immutable source images and declare
 release

---
 .butler/README.md                   |  5 +++++
 .butler/deployment.json             | 12 ++++++++++++
 .gitea/workflows/build-and-push.yml |  2 ++
 3 files changed, 19 insertions(+)
 create mode 100644 .butler/README.md
 create mode 100644 .butler/deployment.json

diff --git a/.butler/README.md b/.butler/README.md
new file mode 100644
index 0000000..a70684e
--- /dev/null
+++ b/.butler/README.md
@@ -0,0 +1,5 @@
+# Service release contract
+
+Butler resolves this repository's protected source revision to verified immutable images. The platform updates only image references in the existing production Compose file and restarts only the already running application services. It preserves current environment, storage, routes, and provider configuration. It retains previous application images and restores them if readiness fails.
+
+Migration and maintenance images are pinned when declared, but this release operation does not run database migrations or maintenance jobs. A release requiring a schema change needs the corresponding explicit platform migration first. No homelab image-pin commit is required for an ordinary compatible application release.
diff --git a/.butler/deployment.json b/.butler/deployment.json
new file mode 100644
index 0000000..03c6951
--- /dev/null
+++ b/.butler/deployment.json
@@ -0,0 +1,12 @@
+{
+  "version": 1,
+  "deployment": "prepbot-release",
+  "environment": "production",
+  "images": {
+    "prepbot_release_prepbot_image": {
+      "name": "prepbot",
+      "tag": "sha-{revision}"
+    }
+  },
+  "revision_variable": "prepbot_release_revision"
+}
diff --git a/.gitea/workflows/build-and-push.yml b/.gitea/workflows/build-and-push.yml
index 657a811..bba21c2 100644
--- a/.gitea/workflows/build-and-push.yml
+++ b/.gitea/workflows/build-and-push.yml
@@ -60,6 +60,7 @@ jobs:
         run: |
           short_sha="${GITHUB_SHA::7}"
           tags="${REGISTRY}/${IMAGE_NAME}:sha-${short_sha}"
+          tags+=$'\n'"${REGISTRY}/${IMAGE_NAME}:sha-${GITHUB_SHA}"
 
           if [[ "${GITHUB_REF_TYPE}" == "branch" && ("${GITHUB_REF_NAME}" == "master" || "${GITHUB_REF_NAME}" == "main") ]]; then
             tags+=$'\n'"${REGISTRY}/${IMAGE_NAME}:latest"
@@ -84,3 +85,4 @@ jobs:
           push: ${{ github.event_name != 'pull_request' }}
           platforms: linux/amd64,linux/arm64
           tags: ${{ steps.prep.outputs.tags }}
+          labels: org.opencontainers.image.revision=${{ github.sha }}