Make package publication retries hash-safe

docs/PACKAGE_REGISTRY_RELEASES.md

@@ -43,6 +43,13 @@ the source tag, source commit, filename, size, and SHA-256 in
 same package version, so correction requires a new version rather than artifact
 replacement.
 
+A retry after partial publication is safe. Before upload, the workflow reads the
+native package registry file record and compares its SHA-256 with the artifact
+rebuilt from the protected tag. An exact existing artifact is skipped; a
+same-version artifact with another digest or an unexpected file set fails
+closed. This permits a failed npm publication to resume without weakening
+package immutability or accepting `--skip-existing` blindly.
+
 The npm tarball is always published through an explicit local `./dist/...`
 path. Without that prefix, npm may interpret a relative tarball name as a Git
 package shorthand before it ever contacts the configured registry.

tests/test_module_package_workflows.py

@@ -26,6 +26,10 @@ class ModulePackageWorkflowTests(unittest.TestCase):
         self.assertIn("api/packages/GovOPlaN/pypi", workflow)
         self.assertIn("api/packages/GovOPlaN/npm", workflow)
         self.assertIn('npm publish "./${webui_packages[0]}"', workflow)
+        self.assertIn("Check immutable registry state", workflow)
+        self.assertIn('files[0].get("sha256") != expected_sha256', workflow)
+        self.assertIn('if [[ "$PUBLISH_PYPI" == 1 ]]', workflow)
+        self.assertIn('[[ "$PUBLISH_NPM" == 1 ]]', workflow)
         self.assertIn("GOVOPLAN_PACKAGE_TOKEN", workflow)
         self.assertIn("must resolve to an exact registry version", workflow)
         self.assertIn("git\\\\.add-ideas\\\\.de/(?:GovOPlaN|add-ideas)", workflow)

tools/repo/templates/module-package-release.yml

@@ -163,6 +163,78 @@ jobs:
         with:
           name: module-packages-${{ gitea.ref_name }}
           path: dist/package-artifacts.json
+      - name: Check immutable registry state
+        shell: bash
+        env:
+          PACKAGE_TOKEN: ${{ secrets.GOVOPLAN_PACKAGE_TOKEN }}
+        run: |
+          set -euo pipefail
+          test -n "$PACKAGE_TOKEN"
+          python - <<'PY'
+          import hashlib
+          import json
+          import os
+          from pathlib import Path
+          import tomllib
+          from urllib.error import HTTPError
+          from urllib.parse import quote
+          from urllib.request import Request, urlopen
+
+          api_root = "https://git.add-ideas.de/api/v1/packages/GovOPlaN"
+          token = os.environ["PACKAGE_TOKEN"]
+
+          def should_publish(kind, name, version, path):
+              package_url = "/".join(
+                  (api_root, kind, quote(name, safe=""), quote(version, safe=""), "files")
+              )
+              request = Request(
+                  package_url,
+                  headers={"Accept": "application/json", "Authorization": f"token {token}"},
+              )
+              try:
+                  with urlopen(request, timeout=30) as response:
+                      files = json.load(response)
+              except HTTPError as exc:
+                  if exc.code == 404:
+                      print(f"{kind} package {name}=={version} is not published yet")
+                      return True
+                  raise
+              if not isinstance(files, list) or len(files) != 1:
+                  raise SystemExit(
+                      f"immutable {kind} package {name}=={version} has an unexpected file set"
+                  )
+              expected_sha256 = hashlib.sha256(path.read_bytes()).hexdigest()
+              if files[0].get("sha256") != expected_sha256:
+                  raise SystemExit(
+                      f"immutable {kind} package {name}=={version} already exists with a different SHA-256"
+                  )
+              print(f"verified existing {kind} package {name}=={version} ({expected_sha256})")
+              return False
+
+          project = tomllib.loads(Path("pyproject.toml").read_text(encoding="utf-8"))["project"]
+          wheels = tuple(Path("dist").glob("*.whl"))
+          if len(wheels) != 1:
+              raise SystemExit("release build must contain exactly one wheel")
+          publish_pypi = should_publish(
+              "pypi", str(project["name"]), str(project["version"]), wheels[0]
+          )
+
+          tarballs = tuple(Path("dist").glob("*.tgz"))
+          if len(tarballs) > 1:
+              raise SystemExit("release build must contain at most one npm package")
+          publish_npm = False
+          if tarballs:
+              webui = json.loads(
+                  Path(".package-webui/package.json").read_text(encoding="utf-8")
+              )
+              publish_npm = should_publish(
+                  "npm", str(webui["name"]), str(webui["version"]), tarballs[0]
+              )
+
+          with Path(os.environ["GITEA_ENV"]).open("a", encoding="utf-8") as env_file:
+              env_file.write(f"PUBLISH_PYPI={int(publish_pypi)}\n")
+              env_file.write(f"PUBLISH_NPM={int(publish_npm)}\n")
+          PY
       - name: Publish wheel and WebUI package
         shell: bash
         env:
@@ -172,13 +244,17 @@ jobs:
           set -euo pipefail
           test -n "$PACKAGE_USERNAME"
           test -n "$PACKAGE_TOKEN"
-          TWINE_USERNAME="$PACKAGE_USERNAME" TWINE_PASSWORD="$PACKAGE_TOKEN" \
+          if [[ "$PUBLISH_PYPI" == 1 ]]; then
-            python -m twine upload --non-interactive \
+            TWINE_USERNAME="$PACKAGE_USERNAME" TWINE_PASSWORD="$PACKAGE_TOKEN" \
-              --repository-url https://git.add-ideas.de/api/packages/GovOPlaN/pypi \
+              python -m twine upload --non-interactive \
-              dist/*.whl
+                --repository-url https://git.add-ideas.de/api/packages/GovOPlaN/pypi \
+                dist/*.whl
+          else
+            echo "Exact wheel is already present; skipping immutable retry."
+          fi
           shopt -s nullglob
           webui_packages=(dist/*.tgz)
-          if (( ${#webui_packages[@]} )); then
+          if (( ${#webui_packages[@]} )) && [[ "$PUBLISH_NPM" == 1 ]]; then
             npmrc="$(mktemp)"
             trap 'rm -f "$npmrc"' EXIT
             chmod 600 "$npmrc"
@@ -189,4 +265,6 @@ jobs:
             NPM_CONFIG_USERCONFIG="$npmrc" npm publish "./${webui_packages[0]}" \
               --ignore-scripts --access public \
               --registry https://git.add-ideas.de/api/packages/GovOPlaN/npm/
+          elif (( ${#webui_packages[@]} )); then
+            echo "Exact WebUI package is already present; skipping immutable retry."
           fi