feat(ci): skip .deb rebuild when version already published

build-deb now checks the Debian registry first and skips the slow source
compile+upload when the pinned version already exists. Add a force_deb
workflow_dispatch input to rebuild anyway, and make upload.sh idempotent
(HTTP 409 -> already published, skip).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/release.yaml

@@ -19,6 +19,11 @@ on:
         description: rlm_raw module branch
         required: false
         default: v3.2.4
+      force_deb:
+        description: Rebuild the .deb even if this version is already published
+        required: false
+        default: false
+        type: boolean
 
 concurrency:
   group: release
@@ -67,13 +72,35 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+      - name: Decide whether to (re)build
+        id: decide
+        env:
+          DEB_USER: ${{ secrets.PACKAGES_USER }}
+          DEB_PASS: ${{ secrets.PACKAGES_TOKEN }}
+          FORCE: ${{ inputs.force_deb }}
+        run: |
+          set -euo pipefail
+          url="${{ env.DEB_REGISTRY }}/dists/${{ env.DEB_DISTRIBUTION }}/${{ env.DEB_COMPONENT }}/binary-amd64/Packages"
+          exists=false
+          if curl -fsSL --user "$DEB_USER:$DEB_PASS" "$url" 2>/dev/null \
+               | grep -q "Version: ${{ needs.prepare.outputs.pkg_version }}"; then
+            exists=true
+          fi
+          should_build=true
+          if [ "$exists" = "true" ] && [ "$FORCE" != "true" ]; then
+            should_build=false
+            echo "Package ${{ needs.prepare.outputs.pkg_version }} already published — skipping build (set force_deb to rebuild)."
+          fi
+          echo "should_build=$should_build" >> "$GITHUB_OUTPUT"
       - name: Build .deb builder image
+        if: ${{ steps.decide.outputs.should_build == 'true' }}
         run: |
           docker build packaging/deb -f packaging/deb/Dockerfile \
             --build-arg RADIUS_TAG=${{ needs.prepare.outputs.radius_tag }} \
             --build-arg RLM_RAW_BRANCH=${{ inputs.rlm_raw_branch }} \
             -t freerad-builder:${{ needs.prepare.outputs.version }}
       - name: Upload .deb to Gitea Debian registry
+        if: ${{ steps.decide.outputs.should_build == 'true' }}
         env:
           DEB_USER: ${{ secrets.PACKAGES_USER }}
           DEB_PASS: ${{ secrets.PACKAGES_TOKEN }}