opn

scripts/check-and-build.sh

@@ -3,6 +3,36 @@ set -Eeuo pipefail
 source /opt/rust-package-builder/scripts/lib.sh
 
 STATE_FILE="$DATA_DIR/state/last_commit"
+REPOSITORY="$DATA_DIR/repository"
+
+published_release_complete_for_commit() {
+    local sha=$1
+    local current="$REPOSITORY/current"
+    local opnsense="$current/opnsense"
+    local package_dir="$opnsense/$OPNSENSE_ABI/amd64"
+
+    [[ -d "$current" ]] || return 1
+
+    # Linux side of the atomic release.
+    [[ -f "$current/apt/dists/$REPO_DISTRIBUTION/InRelease" ]] || return 1
+    [[ -f "$current/rpm/x86_64/repodata/repomd.xml" ]] || return 1
+
+    # OPNsense side. BUILD-INFO ties the published pkg repository to the same
+    # source commit so an old Linux-only release cannot be mistaken for a
+    # complete unified release after migration.
+    [[ -f "$opnsense/meta.conf" ]] || return 1
+    [[ -f "$opnsense/packagesite.pkg" ]] || return 1
+    [[ -f "$opnsense/data.pkg" ]] || return 1
+    [[ -f "$opnsense/RustProxy.conf" ]] || return 1
+    [[ -f "$opnsense/BUILD-INFO.txt" ]] || return 1
+    [[ -f "$opnsense/os-rustproxy-latest.pkg" ]] || return 1
+    grep -Fqx "source_commit=$sha" "$opnsense/BUILD-INFO.txt" || return 1
+    grep -Fqx "opnsense_series=$OPNSENSE_ABI" "$opnsense/BUILD-INFO.txt" || return 1
+    [[ -d "$package_dir" ]] || return 1
+    find "$package_dir" -maxdepth 1 -type f -name 'os-rustproxy-*.pkg' -print -quit | grep -q . || return 1
+
+    return 0
+}
 
 log "checking repository"
 REMOTE_SHA=$(git ls-remote "$SOURCE_REPO" "refs/heads/$SOURCE_BRANCH" | awk 'NR == 1 {print $1}')
@@ -12,9 +42,15 @@ LAST_SHA=""
 [[ -r "$STATE_FILE" ]] && LAST_SHA=$(cat "$STATE_FILE")
 
 if [[ "$REMOTE_SHA" == "$LAST_SHA" ]]; then
-    log "no changes: $REMOTE_SHA"
+    if published_release_complete_for_commit "$REMOTE_SHA"; then
+        log "no changes and unified release is complete: $REMOTE_SHA"
+        exit 0
+    fi
+
+    log "commit unchanged, but unified release is incomplete; rebuilding missing artifacts for $REMOTE_SHA"
+    /opt/rust-package-builder/scripts/build-release.sh "$REMOTE_SHA" repair-missing-artifacts
     exit 0
 fi
 
 log "new commit detected: $REMOTE_SHA"
-/opt/rust-package-builder/scripts/build-release.sh "$REMOTE_SHA"
+/opt/rust-package-builder/scripts/build-release.sh "$REMOTE_SHA" new-commit