fix: publish only requested server release asset

scripts/publish-github-release.sh

@@ -39,15 +39,15 @@ fi
 
 "$RELEASE_SCRIPT" "$VERSION"
 
-shopt -s nullglob
-ASSETS=("$RELEASE_DIR"/*.tar.gz "$RELEASE_DIR"/*.tgz)
+ARCHIVE="$RELEASE_DIR/verstak-sync-server-linux-amd64-$VERSION.tar.gz"
+if [[ ! -f "$ARCHIVE" ]]; then
+  echo "release archive not found: $ARCHIVE" >&2
+  exit 1
+fi
+ASSETS=("$ARCHIVE")
 if [[ -f "$RELEASE_DIR/SHA256SUMS" ]]; then
   ASSETS+=("$RELEASE_DIR/SHA256SUMS")
 fi
-if [[ ${#ASSETS[@]} -eq 0 ]]; then
-  echo "no release assets found in $RELEASE_DIR" >&2
-  exit 1
-fi
 
 if "$GIT_BIN" rev-parse -q --verify "refs/tags/$VERSION" >/dev/null; then
   if [[ "$("$GIT_BIN" rev-parse "${VERSION}^{commit}")" != "$HEAD" ]]; then

scripts/test-publish-github-release.sh

@@ -6,6 +6,7 @@ PUBLISHER="$ROOT/scripts/publish-github-release.sh"
 VERSION="v0.0.0-test"
 REPOSITORY="mirivlad/verstak-sync-server"
 ASSET_NAME="verstak-sync-server-linux-amd64-${VERSION}.tar.gz"
+STALE_ASSET="verstak-sync-server-linux-amd64-v0.0.0-stale.tar.gz"
 WORK="$(mktemp -d)"
 trap 'rm -rf "$WORK"' EXIT
 
@@ -27,6 +28,8 @@ printf 'checksum\n' > "$VERSTAK_RELEASE_DIR/SHA256SUMS"
 SCRIPT
 chmod +x "$WORK/release.sh"
 
+printf 'stale archive\n' > "$WORK/release/$STALE_ASSET"
+
 cat > "$WORK/bin/git" <<'SCRIPT'
 #!/usr/bin/env bash
 set -euo pipefail
@@ -84,6 +87,10 @@ grep -Fqx "push:origin:refs/tags/$VERSION" "$LOG"
 grep -F "release create $VERSION" "$LOG" >/dev/null
 grep -F "$ASSET_NAME" "$LOG" >/dev/null
 grep -F "SHA256SUMS" "$LOG" >/dev/null
+if grep -F "$STALE_ASSET" "$LOG" >/dev/null; then
+  echo "publisher uploaded an archive from a different release version" >&2
+  exit 1
+fi
 
 run_publisher
 grep -F "release upload $VERSION" "$LOG" >/dev/null