Synchronize public module directory publication

tests/test_release_module_directory.py

@@ -1,7 +1,9 @@
 from __future__ import annotations
 
+import json
 from pathlib import Path
 import sys
+import tempfile
 import unittest
 from unittest import mock
 
@@ -14,6 +16,7 @@ if str(RELEASE_TOOLS_ROOT) not in sys.path:
 from govoplan_release.module_directory import (  # noqa: E402
     module_directory_payloads,
     safe_path_part,
+    write_module_directory,
 )
 
 
@@ -77,6 +80,78 @@ class ReleaseModuleDirectoryTests(unittest.TestCase):
                 catalog_payload={}, keyring_payload={}, channel="../stable"
             )
 
+    def test_prune_removes_stale_json_but_keeps_unrelated_assets(self) -> None:
+        catalog = {
+            "generated_at": "2026-08-06T12:00:00Z",
+            "sequence": 8,
+            "modules": [
+                {
+                    "module_id": "files",
+                    "name": "Files",
+                    "version": "1.2.3",
+                    "python_package": "govoplan-files",
+                    "source": {
+                        "repository": "govoplan-files",
+                        "tag": "v1.2.3",
+                        "commit": "a" * 40,
+                    },
+                    "artifact_integrity": {
+                        "python": {"sha256": "b" * 64},
+                    },
+                }
+            ],
+        }
+        with tempfile.TemporaryDirectory() as value:
+            output_root = Path(value)
+            stale = output_root / "modules" / "legacy" / "0.1.0" / "manifest.json"
+            stale.parent.mkdir(parents=True)
+            stale.write_text("{}\n", encoding="utf-8")
+            unrelated = output_root / "modules" / "README.txt"
+            unrelated.write_text("keep\n", encoding="utf-8")
+
+            written = write_module_directory(
+                catalog_payload=catalog,
+                keyring_payload={},
+                output_root=output_root,
+                channel="stable",
+                prune=True,
+            )
+
+            self.assertFalse(stale.exists())
+            self.assertTrue(unrelated.exists())
+            self.assertEqual(3, len(written))
+            manifest = json.loads(
+                (output_root / "modules" / "files" / "1.2.3" / "manifest.json").read_text()
+            )
+            self.assertEqual("govoplan-files", manifest["module"]["repo"])
+            self.assertEqual("v1.2.3", manifest["module"]["python_tag"])
+            self.assertEqual("b" * 64, manifest["module"]["artifact_integrity"]["python"]["sha256"])
+
+    def test_writer_refuses_nested_symlink_targets(self) -> None:
+        catalog = {
+            "modules": [{"module_id": "files", "version": "1.2.3"}],
+        }
+        with tempfile.TemporaryDirectory() as value:
+            root = Path(value)
+            output_root = root / "public"
+            external = root / "external"
+            (output_root / "modules").mkdir(parents=True)
+            external.mkdir()
+            (output_root / "modules" / "files").symlink_to(
+                external,
+                target_is_directory=True,
+            )
+
+            with self.assertRaisesRegex(ValueError, "symlinks"):
+                write_module_directory(
+                    catalog_payload=catalog,
+                    keyring_payload={},
+                    output_root=output_root,
+                    channel="stable",
+                )
+
+            self.assertEqual([], list(external.iterdir()))
+
 
 if __name__ == "__main__":
     unittest.main()