publisher: refresh release assets before mutation

packaging/arch/publish-edge.sh

@@ -115,29 +115,39 @@ else
   log "publishing into existing $EDGE_TAG release $REL_ID"
 fi
 
-ASSETS_JSON=$(api "$API/repos/$ARCHIVE_REPO/releases/$REL_ID/assets")
-
-asset_id() {
-  printf '%s' "$ASSETS_JSON" | python3 -c "
+# Query live state every time. The same arch=any package is visited once per
+# architecture, so a snapshot taken before the loop becomes false as soon as
+# the first architecture deletes or uploads it. Return every matching id as a
+# repair for duplicate same-name assets left by older runs.
+asset_ids() {
+  api "$API/repos/$ARCHIVE_REPO/releases/$REL_ID/assets" | python3 -c "
 import json,sys
 name = sys.argv[1]
 for a in json.load(sys.stdin):
     if a['name'] == name:
-        print(a['id']); break
+        print(a['id'])
 " "$1"
 }
 
+asset_exists() {
+  [ -n "$(asset_ids "$1")" ]
+}
+
 delete_asset() {
-  local name="$1" id
-  id=$(asset_id "$name")
-  [ -n "$id" ] || return 0
-  curl -sf -X DELETE -H "$AUTH" \
-    "$API/repos/$ARCHIVE_REPO/releases/$REL_ID/assets/$id" -o /dev/null
+  local name="$1" ids id
+  ids=$(asset_ids "$name")
+  [ -n "$ids" ] || return 0
+  while IFS= read -r id; do
+    [ -n "$id" ] || continue
+    curl -sf -X DELETE -H "$AUTH" \
+      "$API/repos/$ARCHIVE_REPO/releases/$REL_ID/assets/$id" -o /dev/null
+  done <<< "$ids"
   log "deleted stale asset $name"
 }
 
 # Gitea happily stores two assets with the same name, which would leave pacman
-# fetching whichever the API returned first. Always delete before uploading.
+# fetching whichever the API returned first. Delete every live match before
+# uploading.
 upload_asset() {
   local path="$1" name
   name="$(basename "$path")"
@@ -230,7 +240,7 @@ for ARCH_DIR in "$REPO_DIR"/*/; do
   # truncated body, an HTML error page — falling through to a fresh database
   # would erase every other producer on upload. That is precisely the clobber
   # this script exists to remove, so it is a hard failure instead.
-  if [ -n "$(asset_id "$DB.db.tar.zst")" ]; then
+  if asset_exists "$DB.db.tar.zst"; then
     download_asset "$DB.db.tar.zst" "$WORK/$DB.db.tar.zst" \
       || { echo "FATAL: $DB.db.tar.zst is published but could not be fetched;" \
                 "refusing to publish a database that would drop other producers" >&2
@@ -249,7 +259,7 @@ for ARCH_DIR in "$REPO_DIR"/*/; do
   # there — without this fetch it would be rebuilt from just our packages and
   # every other producer would vanish from `pacman -F` while still installing
   # fine, which is the kind of half-broken that goes unnoticed for months.
-  if [ -n "$(asset_id "$DB.files.tar.zst")" ]; then
+  if asset_exists "$DB.files.tar.zst"; then
     download_asset "$DB.files.tar.zst" "$WORK/$DB.files.tar.zst" \
       || { echo "FATAL: $DB.files.tar.zst is published but could not be fetched" >&2; exit 1; }
     bsdtar -tf "$WORK/$DB.files.tar.zst" >/dev/null 2>&1 \