From 07b96da4a933015a23963286c7e5b3bee3be29cd Mon Sep 17 00:00:00 2001
From: Yvan Janssens <yvanj@cyber.gent>
Date: Tue, 5 May 2026 13:13:35 +0200
Subject: [PATCH] Verify package artifacts before skipping build

---
 scripts/ci/preflight-package.sh | 75 +++++++++++++++++++++++++++++----
 1 file changed, 66 insertions(+), 9 deletions(-)

diff --git a/scripts/ci/preflight-package.sh b/scripts/ci/preflight-package.sh
index 2dace3c..35c07ee 100644
--- a/scripts/ci/preflight-package.sh
+++ b/scripts/ci/preflight-package.sh
@@ -130,11 +130,15 @@ fetch_package_index() {
   return 1
 }
 
-package_exists_in_index() {
+package_index_match_filenames() {
   local package_name="$1"
   local package_version="$2"
+  local package_architecture="$3"
 
-  awk -v target_package="$package_name" -v target_version="$package_version" '
+  awk \
+    -v target_package="$package_name" \
+    -v target_version="$package_version" \
+    -v target_architecture="$package_architecture" '
     BEGIN {
       RS = ""
       FS = "\n"
@@ -142,6 +146,9 @@ package_exists_in_index() {
     {
       found_package = 0
       found_version = 0
+      found_architecture = 0
+      filename = ""
+
       for (i = 1; i <= NF; i++) {
         if ($i == "Package: " target_package) {
           found_package = 1
@@ -149,10 +156,17 @@ package_exists_in_index() {
         if ($i == "Version: " target_version) {
           found_version = 1
         }
+        if ($i == "Architecture: " target_architecture) {
+          found_architecture = 1
+        }
+        if ($i ~ /^Filename: /) {
+          filename = substr($i, 11)
+        }
       }
-      if (found_package && found_version) {
+
+      if (found_package && found_version && found_architecture && filename != "") {
+        print filename
         matched = 1
-        exit
       }
     }
     END {
@@ -164,6 +178,36 @@ package_exists_in_index() {
   '
 }
 
+package_file_exists() {
+  local package_filename="${1#/}"
+  local url="$base_url/api/packages/$owner/debian/$package_filename"
+  local status_code
+
+  status_code="$(
+    curl \
+      --silent \
+      --show-error \
+      --location \
+      --output /dev/null \
+      --write-out '%{http_code}' \
+      --user "$username:$GITEA_PACKAGE_TOKEN" \
+      --range 0-0 \
+      "$url"
+  )"
+
+  case "$status_code" in
+    200|206)
+      return 0
+      ;;
+    404)
+      return 1
+      ;;
+    *)
+      die "Package file probe failed with HTTP $status_code for $url"
+      ;;
+  esac
+}
+
 write_metadata() {
   local skip_build="$1"
   local package_name="$2"
@@ -212,18 +256,31 @@ package_version="$(determine_hyperion_version "$hyperion_dir")"
 log "Checking Gitea for $package_name/$package_version ($package_distribution/$package_component/$package_architecture)"
 package_index_file="$(mktemp)"
 have_package_index=false
+matched_package_filenames=()
 
 if fetch_package_index >"$package_index_file"; then
   have_package_index=true
 fi
 
-if [[ "$have_package_index" == "true" ]] && package_exists_in_index "$package_name" "$package_version" <"$package_index_file"; then
-  rm -f "$package_index_file"
-  write_metadata true "$package_name" "$package_version"
-  log "Package already exists in registry; build will be skipped"
-  exit 0
+if [[ "$have_package_index" == "true" ]]; then
+  while IFS= read -r package_filename; do
+    matched_package_filenames+=("$package_filename")
+  done < <(
+    package_index_match_filenames "$package_name" "$package_version" "$package_architecture" <"$package_index_file"
+  )
 fi
 
+for package_filename in "${matched_package_filenames[@]}"; do
+  if package_file_exists "$package_filename"; then
+    rm -f "$package_index_file"
+    write_metadata true "$package_name" "$package_version"
+    log "Package already exists in registry; build will be skipped"
+    exit 0
+  fi
+
+  log "Package index entry found for $package_name/$package_version, but artifact $package_filename is missing; build will continue"
+done
+
 rm -f "$package_index_file"
 write_metadata false "$package_name" "$package_version"
 log "Package does not exist in registry; build will continue"