fix(release): deviating guard message — reject the rebuilt attempt, burn only vs the original anchor (#353) (#369)

* fix(release): deviating guard message directs full reruns to the original run before asserting a burn (#353)

A deviation from THIS attempt's rebuilt bytes does not by itself burn
the version: an accidental full rerun is rejected, and the operator is
directed back to the ORIGINAL workflow attempt whose preserved
artifact matches what the index accepted. The burn clause is scoped
to a deviation from the ORIGINAL accepted anchor (which finalize
reports as a burn state). Tests assert the message shape and ordering
(original-run direction before the burn clause).

* fix(release): deviating message states the first-attempt burn branch explicitly (#353 review round 2)

The guard's inputs cannot distinguish a first-attempt index conflict
from a full rerun, so the message now states both branches: on the
ORIGINAL workflow attempt the current distributions ARE the original
workflow build anchor and pre-existing/conflicting index files burn
the version outright (finalize cannot classify that run —
github-release fails at this guard); on a full rerun the mismatch
proves only that the rebuilt attempt must be abandoned in favor of the
recoverable original run. 'original accepted anchor' wording replaced
with 'original workflow build anchor'; regressions pin BOTH
interpretations.

Author: caohy1988

producers/scripts/guard_existing_release.py

@@ -35,11 +35,18 @@
 current wheel+sdist bytes), or `deviating` (anything else — burned).
 That makes the guard consistent with the reconciler's recoveries: an
 exact TestPyPI publication with the draft missing PROCEEDS to recreate
-the draft from the preserved original-attempt artifact (a full rerun
-naturally shows `deviating` because rebuilt bytes differ), while
+the draft from the preserved original-attempt artifact, while
 production files always make the missing-release / preserved-draft
-paths authoritative. A published release always fails: that version is
-burned.
+paths authoritative. `deviating` covers two situations the guard cannot
+tell apart from its inputs, so the message states both branches: on
+the ORIGINAL workflow attempt the current distributions ARE the
+original workflow build anchor, and an index conflict (pre-existing or
+tampered files) burns the version outright — finalize cannot classify
+that run because github-release fails at this guard; on a full rerun
+the mismatch proves only that the rebuilt attempt must be abandoned in
+favor of the recoverable original run. A burn is asserted against the
+original workflow build anchor, never merely against a rebuilt one. A
+published release always fails: that version is burned.
 """
 
 from __future__ import annotations
@@ -96,10 +103,17 @@ def decide(release_state: str, pypi: str, testpypi: str) -> GuardAction:
     return GuardAction(
         False,
         1,
-        f"{where} holds files for this version that DIFFER from the"
-        " current dist bytes — the version is burned there (bump the"
-        " version, rebuild, and cut a new tag); any existing draft is"
-        " preserved for forensics",
+        f"{where} holds files for this version that DIFFER from THIS"
+        " attempt's dist bytes. If THIS IS the ORIGINAL workflow"
+        " attempt, these distributions ARE the original workflow build"
+        " anchor — the index already holds conflicting or pre-existing"
+        " files that cannot be replaced, so the version is BURNED: bump"
+        " the version, rebuild, and cut a new tag. If this is a full"
+        " rerun, the mismatch proves only that the rebuilt attempt must"
+        " be abandoned (NOT burned by this check alone): return to the"
+        " ORIGINAL workflow attempt and re-run its FAILED jobs for"
+        " authoritative reconciliation. Any existing draft is preserved"
+        " for forensics",
     )
   if pypi == "exact":
     if release_state == "draft":

producers/tests/test_guard_existing_release.py

@@ -52,15 +52,34 @@ def test_draft_with_exact_testpypi_files_is_preserved_too():
   assert "TestPyPI" in action.message
 
 
-def test_deviating_index_is_burned():
-  # A full rerun rebuilds bytes, so its dist DIFFERS from what the
-  # index accepted: byte validation turns that into an explicit burn.
+def test_deviating_message_states_the_first_attempt_burn_branch():
+  # The guard's inputs cannot distinguish a first-attempt conflict
+  # from a full rerun, so the message must state the ORIGINAL-attempt
+  # branch explicitly (#353 review): on the original attempt the
+  # current distributions ARE the original workflow build anchor, and
+  # pre-existing/conflicting index files burn the version — finalize
+  # cannot classify that run because github-release fails here.
   for release in ("absent", "draft"):
     action = guard_existing_release.decide(release, "deviating", "absent")
     assert not action.proceed
     assert action.exit_code != 0
-    assert "DIFFER" in action.message
+    assert "ORIGINAL workflow" in action.message
+    assert "original workflow build anchor" in action.message
+    assert "BURNED" in action.message
     assert "bump" in action.message
+    assert "accepted anchor" not in action.message  # corrected wording
+
+
+def test_deviating_message_states_the_full_rerun_reject_branch():
+  # Same inputs, second interpretation: a full rerun's rebuilt bytes
+  # prove only that the rebuilt attempt must be abandoned — return to
+  # the original run for authoritative reconciliation.
+  for release in ("absent", "draft"):
+    action = guard_existing_release.decide(release, "deviating", "absent")
+    assert "full" in action.message and "rerun" in action.message
+    assert "NOT burned" in action.message
+    assert "abandoned" in action.message
+    assert "ORIGINAL workflow attempt" in action.message
   action = guard_existing_release.decide("absent", "absent", "deviating")
   assert not action.proceed
   assert "TestPyPI" in action.message