Fix Server release checks for the LAN-only listener [skip ci]

scripts/server-release.py

@@ -16,6 +16,7 @@ from pathlib import Path
 APP = Path("/srv/pigway/apps/pigway-frame-flow")
 RECOVERY = Path("/srv/pigway/recovery/frame-flow")
 CONTAINER = "pigway-frame-flow"
+ORIGIN = "http://192.0.2.10:81"
 
 
 def run(*args):
@@ -62,11 +63,16 @@ def archive_staging(backup, ctx):
     for tag in [
         "pigway-frame-flow:history-ui-local-base",
         "pigway-frame-flow:final-audit-local-base",
+        "pigway-frame-flow:0.1.9-5d2171b9be3e",
     ]:
         tags = run(
             "docker", "image", "ls", "--format", "{{.Repository}}:{{.Tag}}"
         ).splitlines()
-        if tag in tags and tag not in references:
+        if (
+            tag in tags
+            and tag not in references
+            and not run("docker", "ps", "-aq", "--filter", "ancestor=" + tag)
+        ):
             run("docker", "image", "rm", tag)
             removed.append(tag)
     return {
@@ -76,6 +82,18 @@ def archive_staging(backup, ctx):
     }
 
 
+def wait_ready():
+    for attempt in range(30):
+        try:
+            with urllib.request.urlopen(ORIGIN + "/ready", timeout=4) as r:
+                assert json.load(r)["status"] == "ready"
+            break
+        except Exception:
+            if attempt == 29:
+                raise
+            time.sleep(2)
+
+
 def verify_runtime(commit):
     c = inspect()
     env = dict(s.split("=", 1) for s in c["Config"]["Env"])
@@ -163,18 +181,9 @@ def release(lock):
     try:
         changed = True
         (APP / "compose.json").write_text(json.dumps(compose, indent=2) + "\n")
+        print("Restarting Frame Flow; checking " + ORIGIN + "/ready", flush=True)
         run("systemctl", "restart", "pigway-frame-flow.service")
-        for attempt in range(30):
-            try:
-                with urllib.request.urlopen(
-                    "http://127.0.0.1:81/ready", timeout=4
-                ) as r:
-                    assert json.load(r)["status"] == "ready"
-                break
-            except Exception:
-                if attempt == 29:
-                    raise
-                time.sleep(2)
+        wait_ready()
         current = verify_runtime(commit)
         assert current["Image"] == run(
             "docker", "image", "inspect", "--format", "{{.Id}}", image
@@ -202,9 +211,7 @@ def release(lock):
             "index.html",
             "style.css",
         ]:
-            url = "http://127.0.0.1:81/" + (
-                "" if name == "index.html" else "ui/" + name
-            )
+            url = ORIGIN + "/" + ("" if name == "index.html" else "ui/" + name)
             with urllib.request.urlopen(url, timeout=10) as response:
                 assert (
                     response.read()
@@ -212,6 +219,7 @@ def release(lock):
                 )
         run("systemctl", "is-active", "pigway-frame-flow.service")
     except BaseException:
+        print("Release verification failed; restoring previous Compose", flush=True)
         if changed:
             shutil.copy2(backup / "compose.before.json", APP / "compose.json")
             run("systemctl", "restart", "pigway-frame-flow.service")
@@ -236,6 +244,9 @@ def release(lock):
     owner = ctx.stat()
     os.chown(output, owner.st_uid, owner.st_gid)
     shutil.copy2(output, backup / "release-verification.json")
+    public_receipt = ctx.parent / "frame-release-verification.json"
+    shutil.copy2(output, public_receipt)
+    os.chown(public_receipt, owner.st_uid, owner.st_gid)
     shutil.rmtree(ctx)
     print(json.dumps(receipt, indent=2))