From 0abfe348c14fa484681c83a44f271b7f07085153 Mon Sep 17 00:00:00 2001
From: Georg K <jar3b@outlook.com>
Date: Fri, 12 Jun 2026 06:02:20 +0300
Subject: [PATCH] feat(ci): skip .deb rebuild when version already published

build-deb now checks the Debian registry first and skips the slow source
compile+upload when the pinned version already exists. Add a force_deb
workflow_dispatch input to rebuild anyway, and make upload.sh idempotent
(HTTP 409 -> already published, skip).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .gitea/workflows/release.yaml | 27 +++++++++++++++++++++++++++
 agent/INDEX.md                |  7 +++++--
 packaging/deb/upload.sh       | 14 +++++++++++---
 3 files changed, 43 insertions(+), 5 deletions(-)

diff --git a/.gitea/workflows/release.yaml b/.gitea/workflows/release.yaml
index 4999fa0..58d3643 100644
--- a/.gitea/workflows/release.yaml
+++ b/.gitea/workflows/release.yaml
@@ -19,6 +19,11 @@ on:
         description: rlm_raw module branch
         required: false
         default: v3.2.4
+      force_deb:
+        description: Rebuild the .deb even if this version is already published
+        required: false
+        default: false
+        type: boolean
 
 concurrency:
   group: release
@@ -67,13 +72,35 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+      - name: Decide whether to (re)build
+        id: decide
+        env:
+          DEB_USER: ${{ secrets.PACKAGES_USER }}
+          DEB_PASS: ${{ secrets.PACKAGES_TOKEN }}
+          FORCE: ${{ inputs.force_deb }}
+        run: |
+          set -euo pipefail
+          url="${{ env.DEB_REGISTRY }}/dists/${{ env.DEB_DISTRIBUTION }}/${{ env.DEB_COMPONENT }}/binary-amd64/Packages"
+          exists=false
+          if curl -fsSL --user "$DEB_USER:$DEB_PASS" "$url" 2>/dev/null \
+               | grep -q "Version: ${{ needs.prepare.outputs.pkg_version }}"; then
+            exists=true
+          fi
+          should_build=true
+          if [ "$exists" = "true" ] && [ "$FORCE" != "true" ]; then
+            should_build=false
+            echo "Package ${{ needs.prepare.outputs.pkg_version }} already published — skipping build (set force_deb to rebuild)."
+          fi
+          echo "should_build=$should_build" >> "$GITHUB_OUTPUT"
       - name: Build .deb builder image
+        if: ${{ steps.decide.outputs.should_build == 'true' }}
         run: |
           docker build packaging/deb -f packaging/deb/Dockerfile \
             --build-arg RADIUS_TAG=${{ needs.prepare.outputs.radius_tag }} \
             --build-arg RLM_RAW_BRANCH=${{ inputs.rlm_raw_branch }} \
             -t freerad-builder:${{ needs.prepare.outputs.version }}
       - name: Upload .deb to Gitea Debian registry
+        if: ${{ steps.decide.outputs.should_build == 'true' }}
         env:
           DEB_USER: ${{ secrets.PACKAGES_USER }}
           DEB_PASS: ${{ secrets.PACKAGES_TOKEN }}
diff --git a/agent/INDEX.md b/agent/INDEX.md
index ac0aed5..f04a189 100644
--- a/agent/INDEX.md
+++ b/agent/INDEX.md
@@ -40,6 +40,8 @@ prepare ──► build-deb ──► build-image ──► package-helm
 - `.deb` - источник истины: `build-image` и `package-hosted` имеют `needs: build-deb`
   И дополнительно проверяют, что версия `3.2.8+git` уже опубликована в Debian-реестре
   (GET `dists/noble/main/binary-amd64/Packages`), иначе fail.
+- `build-deb` пропускает долгую пересборку, если версия уже в реестре. Принудительно -
+  input `force_deb=true`. Заливка идемпотентна: `upload.sh` пропускает HTTP 409 (уже есть).
 - Авторизация: репо-секреты `PACKAGES_USER` / `PACKAGES_TOKEN` (Gitea token, scope
   `write:package`).
 - Раннер: `ubuntu-latest` с доступным Docker.
@@ -90,8 +92,9 @@ prepare ──► build-deb ──► build-image ──► package-helm
 - Образ при сборке тянет .deb из Debian-реестра Gitea - предполагается публичный read для
   owner `pub`. Если реестр приватный, сборку образа надо чинить (read-токен/buildkit secret),
   а на нодах нужен `DEB_AUTH` для apt.
-- Реестр может отклонить повторную заливку той же версии .deb (релиз - переиздание версии
-  требует bump `VERSION`).
+- Повторная заливка той же версии .deb обрабатывается: `build-deb` её пропускает, а
+  `upload.sh` не падает на HTTP 409. Переиздать изменённое содержимое той же версии нельзя -
+  нужно либо bump `VERSION`, либо удалить пакет в Gitea. `force_deb` только пересобирает.
 - Пароль БД: в hosted - в `.env_cnf` (gitignored, `*.env_cnf`); в k8s - в Secret. В git не
   попадает.
 
diff --git a/packaging/deb/upload.sh b/packaging/deb/upload.sh
index 618cae5..0ee74be 100644
--- a/packaging/deb/upload.sh
+++ b/packaging/deb/upload.sh
@@ -31,11 +31,19 @@ if [ "${#debs[@]}" -eq 0 ]; then
   exit 1
 fi
 
+uploaded=0
+skipped=0
 for file in "${debs[@]}"; do
   echo "Uploading ${file} -> ${upload_url}"
-  curl -fsSL --user "${DEB_USER}:${DEB_PASS}" \
+  code="$(curl -sS -o /tmp/deb-upload.out -w '%{http_code}' \
+    --user "${DEB_USER}:${DEB_PASS}" \
     --upload-file "./${file}" \
-    "${upload_url}"
+    "${upload_url}")"
+  case "$code" in
+    20*) echo "  ok ($code)"; uploaded=$((uploaded + 1)) ;;
+    409) echo "  already published ($code), skipping"; skipped=$((skipped + 1)) ;;
+    *)   echo "  upload failed (HTTP $code):" >&2; cat /tmp/deb-upload.out >&2; exit 1 ;;
+  esac
 done
 
-echo "Uploaded ${#debs[@]} package(s)"
+echo "Done: ${uploaded} uploaded, ${skipped} already present"