fix(aihr): reject stale release artifacts

2026-07-14 13:01:29 +08:00
parent d50bfbf788
commit 0433250bef
2 changed files with 25 additions and 0 deletions
@@ -49,10 +49,34 @@ require_file "$frontend_asset_path"
 require_file "$mobile_asset_path"
 grep -q '/h5/' "$mobile_index" || fail "mobile H5 index does not contain the /h5/ base path"

+head_epoch="$(git show -s --format=%ct HEAD)"
+
+file_epoch() {
+  if stat -f %m "$1" >/dev/null 2>&1; then
+    stat -f %m "$1"
+  else
+    stat -c %Y "$1"
+  fi
+}
+
+require_fresh_artifact() {
+  local artifact="$1"
+  local artifact_epoch
+  artifact_epoch="$(file_epoch "$artifact")" || fail "cannot read artifact timestamp: $artifact"
+  [[ "$artifact_epoch" -ge "$head_epoch" ]] || fail "artifact is older than HEAD; rebuild before release: $artifact"
+}
+
+require_fresh_artifact "$frontend_index"
+require_fresh_artifact "$frontend_asset_path"
+require_fresh_artifact "$mobile_index"
+require_fresh_artifact "$mobile_asset_path"
+require_fresh_artifact "$backend_jar"
+
 changed_files="$(git status --porcelain)"
 [[ -z "$changed_files" ]] || fail "worktree has uncommitted changes; commit the release batch before publishing"

 echo "commit=$(git rev-parse HEAD)"
+echo "head_epoch=$head_epoch"
 echo "worktree=clean"
 echo "frontend_index_sha256=$(sha256 "$frontend_index")"
 echo "frontend_asset=$frontend_asset"