From e0a25415a1761f2660dabe72796285e620443ea3 Mon Sep 17 00:00:00 2001
From: Frank <frank@dankware>
Date: Sat, 22 Aug 2026 04:14:43 -0700
Subject: [PATCH] deploy.sh: rebuild local images when their Containerfile hash
 changes

buildah can serve a stale COPY --from layer (cache keyed on stage
name), so a Containerfile edit silently produced an unchanged image.
The image now carries a cfhash label; a mismatch forces a --no-cache
rebuild.
---
 scripts/deploy.sh | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/scripts/deploy.sh b/scripts/deploy.sh
index e44e154..e3e0f46 100755
--- a/scripts/deploy.sh
+++ b/scripts/deploy.sh
@@ -144,9 +144,14 @@ if [ '${COMPOSE_UP[$TARGET]}' = '1' ]; then
   for dir in caddy loki alloy; do
     img=franksdank/\$dir
     [ \"\$dir\" = caddy ] && img=franksdank/caddy-porkbun
-    if ! podman image exists \$img:latest; then
-      echo \"  \$img image missing; building it...\"
-      podman build -t \$img:latest -f dankclaw/\$dir/Containerfile .
+    # Rebuild when the Containerfile changed. buildah's layer cache can
+    # serve a stale COPY --from layer (keyed on stage name), so a rebuild
+    # always runs with --no-cache.
+    cfhash=\$(sha256sum dankclaw/\$dir/Containerfile | cut -d' ' -f1)
+    oldhash=\$(podman image inspect \$img:latest --format '{{index .Config.Labels "cfhash"}}' 2>/dev/null || echo none)
+    if [ \"\$oldhash\" != \"\$cfhash\" ]; then
+      echo \"  \$img image missing or stale; building it...\"
+      podman build --no-cache --label cfhash=\$cfhash -t \$img:latest -f dankclaw/\$dir/Containerfile .
     fi
   done
   podman-compose -f '${COMPOSE[$TARGET]}' up -d