fix(selfhost): stop deploy-selfhost-image.sh silently losing to a build: override

[JSONbored]

Summary

• scripts/deploy-selfhost-image.sh's generated temp compose override only set image: for the target service. When an operator's own docker-compose.override.yml also defines a build: block for that same service (a sanctioned self-host customization -- e.g. the documented local INSTALL_AI_CLIS install pattern), docker compose up --no-build --no-deps still preferred the pre-existing project-scoped build artifact over the freshly pulled image, silently. The script reports success, the container recreates and passes health checks, but keeps running the stale locally-built image.
• Reproduced live while deploying orb-v0.3.0: docker compose pull correctly fetched the new image (confirmed present via docker images), the script reported gittensory is healthy, but docker inspect's Image field showed the container was still running the old local build -- missing a since-added migration and reporting a stale GITTENSORY_VERSION.
• Fix: add build: !reset null to the generated override so the pulled image: always wins regardless of what the base/override compose files define. Verified locally with real docker compose config against both a no-build:-block case (no-op, confirmed harmless) and a merged-build:-across-two-files case (matches the VPS scenario, confirmed the reset works).

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed. — small, self-contained shell-script fix with a direct regression test; no src/** surface touched.

Validation

• git diff --check
• npm run typecheck
• npm run test:ci (full local gate, green -- 540 test files / 10,762 tests passed, 2 files / 7 tests skipped)
• npm audit --audit-level=moderate (0 vulnerabilities)
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries -- extended test/unit/selfhost-image-deploy.test.ts's fake-docker harness to capture the full generated override content (previously only grepped the image: line) and added a regression assertion that build: !reset null is present in every image-precedence scenario.
• No src/** files touched, so codecov/patch is not applicable to this PR.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. — N/A.
• API/OpenAPI/MCP behavior is updated and tested where needed. — no API/OpenAPI/MCP surface touched.
• UI changes use live API data or real empty/error/loading states. — N/A, no UI changes.
• Visible UI changes include a UI Evidence section. — N/A, no UI changes.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs. — N/A, no changelog-worthy public surface change (the existing self-hosting-operations docs already reference this script generically).

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-07 05:20:24 UTC}

2 files · 1 AI reviewer · 2 blockers · readiness 93/100 · CI green · clean

⏸️ Suggested Action - Manual Review

• No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.
• Maintainer requires a linked issue — Link the relevant issue (for example Closes #123) before opening the PR.

Review summary
This PR adds `build: !reset null` to the generated compose override in scripts/deploy-selfhost-image.sh so the pulled `image:` always wins over any `build:` block an operator's own docker-compose.override.yml defines for the same service, fixing a real, reproduced-in-production silent-stale-image bug. The test change from `grep 'image:'` to `cat` on the mocked pull-file capture is necessary and correct since the new assertion checks for a separate `build: !reset null` line that the old grep would have filtered out. The fix is narrow, uses a documented Compose YAML merge directive (`!reset`) appropriately, and is backed by a real regression test plus a code comment explaining the failure mode.

Nits — 4 non-blocking

• The inline comment block in scripts/deploy-selfhost-image.sh:99-103 is fairly long for a heredoc; consider trimming to the one or two sentences that explain the `!reset` mechanism, with full narrative left to the PR/commit message.
• The test only verifies the override file contains the literal string `build: !reset null` (test/unit/selfhost-image-deploy.test.ts:156-158); it does not exercise the described 'merged-build-across-two-files' scenario end-to-end via real `docker compose config`, so the regression coverage relies on the mocked pull step rather than actual Compose merge semantics.
• Consider adding a comment near the `!reset` line pointing to Docker Compose's own docs on the `!reset` tag for readers unfamiliar with this less-common YAML merge directive.
• If not already covered elsewhere, a follow-up integration test invoking real `docker compose config` (as described in the PR's manual validation) would give stronger assurance than the current shell-mock-based test.

Concerns raised — review before merging

• No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.
• Maintainer requires a linked issue — Link the relevant issue (for example Closes #123) before opening the PR.

Signal	Result	Evidence
Code review	❌ 2 blockers	1 reviewer
Linked issue	⚠️ Missing	No linked issue or no-issue rationale found.
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (no linked issue context).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 51 registered-repo PR(s), 43 merged, 343 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 51 PR(s), 343 issue(s).
Gate result	❌ Blocking	Repo-configured hard blocker found.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 51 PR(s), 343 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.
• Explain no-issue PR.
• Link the issue being solved, or explicitly explain why this is a no-issue PR.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.57%. Comparing base (bfe55f6) to head (6e8f99e).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3884   +/-   ##
=======================================
  Coverage   93.57%   93.57%           
=======================================
  Files         340      340           
  Lines       33516    33516           
  Branches    12262    12262           
=======================================
  Hits        31364    31364           
  Misses       1528     1528           
  Partials      624      624           

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.