ephemeris_release/

artifacts.rs

//! Validated, retry-safe publication of derivation-produced release assets.

use std::collections::{BTreeMap, BTreeSet};
use std::path::{Path, PathBuf};
use std::process::{Command, ExitStatus};
use std::{fs, io, iter};

use ephemeris_files::RepositoryPath;
use ephemeris_token::Token;
use facet::Facet;

use crate::ForgeRelease;
use crate::digest::DigestAlgorithm;
use crate::error::ForgeFailure;
use crate::remote::{RemoteAsset, RemoteRelease};
use crate::state::{AssetSpec, OciSpec};

/// One application release to publish.
#[derive(Clone, Debug, Eq, PartialEq)]
pub(crate) struct Publication<'a> {
    pub unit: String,
    pub tag: String,
    pub target_commit: String,
    pub title: String,
    pub notes: String,
    /// The configured assets by artifact name.
    pub expected: Vec<(&'a str, &'a AssetSpec)>,
    /// The configured OCI artifacts by artifact name.
    pub oci: Vec<(&'a str, &'a OciSpec)>,
    pub version: String,
    pub working_directory: PathBuf,
}

/// Publication or staging validation failure.
#[derive(Debug, thiserror::Error)]
pub(crate) enum ArtifactError {
    /// The staged manifest is not valid JSON of the expected shape.
    #[error("invalid artifact manifest {}", path.display())]
    ManifestDecode {
        /// The manifest.
        path: PathBuf,
        /// The decode failure.
        #[source]
        source: Box<facet_json::DeserializeError>,
    },
    /// The stage holds a different number of artifacts than configured.
    #[error("unit {unit:?} stages {actual} artifacts, but the evaluated state declares {expected}")]
    ArtifactCount {
        /// The release unit.
        unit: String,
        /// The configured count.
        expected: usize,
        /// The staged count.
        actual: usize,
    },
    /// A configured artifact is not staged.
    #[error("artifact {0:?} is absent from the manifest")]
    MissingArtifact(String),
    /// A staged artifact disagrees with its configuration.
    #[error("artifact {name:?} stages a different {field} than the evaluated state declares")]
    ArtifactMismatch {
        /// The artifact.
        name: String,
        /// The manifest field that differs.
        field: &'static str,
    },
    /// A staged file name is unsafe or used twice.
    #[error("artifact filename {0:?} is unsafe or duplicated")]
    UnsafeFilename(String),
    /// A staged artifact is not at `artifacts/<filename>`.
    #[error("artifact {name:?} is staged at {}", path.display())]
    UnexpectedPath {
        /// The artifact.
        name: String,
        /// Where the manifest places it.
        path: PathBuf,
    },
    /// A staged file cannot be read.
    #[error("artifact I/O failed at {path:?}")]
    Io {
        /// The file.
        path: PathBuf,
        /// Why reading failed.
        source: io::Error,
    },
    /// A staged package path is not a regular file.
    #[error("staged package {} is not a file", path.display())]
    NotAFile {
        /// The path.
        path: PathBuf,
    },
    /// The manifest has no push program for an OCI artifact.
    #[error("oci artifact {0:?} has no push program in the manifest")]
    MissingOciProgram(String),
    /// A push program could not be started.
    #[error("oci artifact {name:?} push program {} failed to start", program.display())]
    OciSpawn {
        /// The artifact.
        name: String,
        /// The push program.
        program: PathBuf,
        /// Why starting failed.
        source: io::Error,
    },
    /// A push program exited unsuccessfully.
    #[error("oci artifact {name:?} push failed with {status}")]
    OciPush {
        /// The artifact.
        name: String,
        /// How the program exited.
        status: ExitStatus,
    },
    /// An OCI artifact needs a registry login and the state declares none.
    #[error("oci artifact {0:?} needs a registry login, and the state declares none")]
    MissingRegistryLogin(String),
    /// A forge call failed.
    #[error("remote artifact operation failed")]
    Remote(#[from] ForgeFailure),
    /// Verification after upload found missing or wrong assets.
    #[error("uploaded release {tag:?} is missing required verified assets")]
    IncompleteUpload {
        /// The release tag.
        tag: String,
    },
    /// An already published release holds other content; it is never changed.
    #[error("published release {tag:?} differs from the locally staged artifacts")]
    PublishedMismatch {
        /// The release tag.
        tag: String,
    },
}

#[derive(Debug, Facet)]
#[facet(tag = "kind")]
#[repr(u8)]
enum ManifestEntry {
    #[facet(rename = "asset")]
    Asset(AssetEntry),
    #[facet(rename = "oci")]
    Oci(OciEntry),
    #[facet(rename = "cargo")]
    Cargo(PackageEntry),
    #[facet(rename = "npm")]
    Npm(PackageEntry),
}

#[derive(Debug, Facet)]
#[facet(deny_unknown_fields)]
struct AssetEntry {
    unit: String,
    name: String,
    package: String,
    output: String,
    filename: String,
    format: String,
    variant: String,
    required_names: Vec<String>,
    path: String,
}

#[derive(Debug, Facet)]
#[facet(deny_unknown_fields)]
struct OciEntry {
    unit: String,
    name: String,
    package: String,
    registry: String,
    repository: String,
    latest: bool,
    program: String,
}

#[derive(Debug, Facet)]
#[facet(deny_unknown_fields)]
struct PackageEntry {
    unit: String,
    name: String,
    package: String,
    path: String,
}

/// The registry a staged package file is published to.
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub(crate) enum PackageKind {
    /// A `.crate` file for a Cargo registry.
    Cargo,
    /// A `.tgz` tarball for an npm registry.
    Npm,
}

impl PackageKind {
    /// The artifact kind name in the manifest and the release state.
    pub(crate) const fn label(self) -> &'static str {
        match self {
            Self::Cargo => "cargo",
            Self::Npm => "npm",
        }
    }

    const fn extension(self) -> &'static str {
        match self {
            Self::Cargo => "crate",
            Self::Npm => "tgz",
        }
    }

    fn entry(self, entry: &ManifestEntry) -> Option<&PackageEntry> {
        match entry {
            ManifestEntry::Cargo(package) if self == Self::Cargo => Some(package),
            ManifestEntry::Npm(package) if self == Self::Npm => Some(package),
            ManifestEntry::Cargo(_)
            | ManifestEntry::Npm(_)
            | ManifestEntry::Asset(_)
            | ManifestEntry::Oci(_) => None,
        }
    }
}

#[derive(Debug)]
struct LocalAsset {
    name: String,
    bytes: Vec<u8>,
    sha256: String,
}

/// The login an OCI push program authenticates to its registry with.
#[derive(Clone, Debug)]
pub(crate) struct OciLogin {
    username: String,
    password: Token,
}

impl OciLogin {
    /// Log in as `username` with `password`.
    pub(crate) const fn new(username: String, password: Token) -> Self {
        Self { username, password }
    }
}

#[derive(Debug)]
struct OciPush {
    name: String,
    program: String,
    references: Vec<String>,
    login: OciLogin,
}

impl OciPush {
    /// Resolve the push program and references of each expected OCI artifact.
    ///
    /// The references cover the unit version, and `latest` when requested.
    fn resolve(
        entries: &[ManifestEntry],
        publication: &Publication<'_>,
        login: Option<&OciLogin>,
    ) -> Result<Vec<Self>, ArtifactError> {
        publication
            .oci
            .iter()
            .map(|&(name, spec)| {
                let entry = entries
                    .iter()
                    .find_map(|entry| match entry {
                        ManifestEntry::Oci(oci)
                            if oci.unit == publication.unit && oci.name == name =>
                        {
                            Some(oci)
                        }
                        ManifestEntry::Oci(_)
                        | ManifestEntry::Asset(_)
                        | ManifestEntry::Cargo(_)
                        | ManifestEntry::Npm(_) => None,
                    })
                    .ok_or_else(|| ArtifactError::MissingOciProgram(name.to_owned()))?;
                if let Some(field) = spec.mismatch(entry) {
                    return Err(ArtifactError::ArtifactMismatch {
                        name: name.to_owned(),
                        field,
                    });
                }
                let login = login
                    .ok_or_else(|| ArtifactError::MissingRegistryLogin(name.to_owned()))?
                    .clone();
                let tags =
                    iter::once(publication.version.as_str()).chain(spec.latest.then_some("latest"));
                Ok(Self {
                    name: name.to_owned(),
                    program: entry.program.clone(),
                    references: tags
                        .map(|tag| format!("{}/{}:{tag}", spec.registry, spec.repository))
                        .collect(),
                    login,
                })
            })
            .collect()
    }

    fn run(&self, working_directory: &Path) -> Result<(), ArtifactError> {
        for reference in &self.references {
            let status = Command::new(&self.program)
                .arg(reference)
                .env("EPHEMERIS_OCI_USERNAME", &self.login.username)
                .env("EPHEMERIS_OCI_PASSWORD", self.login.password.expose())
                .current_dir(working_directory)
                .status()
                .map_err(|source| ArtifactError::OciSpawn {
                    name: self.name.clone(),
                    program: PathBuf::from(&self.program),
                    source,
                })?;
            if !status.success() {
                return Err(ArtifactError::OciPush {
                    name: self.name.clone(),
                    status,
                });
            }
        }
        Ok(())
    }
}

/// The artifacts a publication run was given, read once for every unit.
#[derive(Debug)]
pub(crate) struct Stage {
    entries: Vec<ManifestEntry>,
    directory: PathBuf,
}

/// One unit's forge release with its local files read and checked.
#[derive(Debug)]
pub(crate) struct StagedRelease<'a> {
    publication: Publication<'a>,
    assets: Vec<LocalAsset>,
    pushes: Vec<OciPush>,
}

impl Stage {
    /// Read the manifest of the built artifacts in `directory`.
    ///
    /// # Errors
    /// Returns an error when the manifest cannot be read or decoded.
    pub(crate) fn read(manifest: &Path, directory: &Path) -> Result<Self, ArtifactError> {
        Ok(Self {
            entries: ManifestEntry::read_all(manifest)?,
            directory: directory.to_owned(),
        })
    }

    /// A stage without artifacts, for runs that publish none.
    pub(crate) const fn empty() -> Self {
        Self {
            entries: Vec::new(),
            directory: PathBuf::new(),
        }
    }

    /// The staged package file of one unit.
    ///
    /// `name` and `package` are the artifact name and package the evaluated
    /// state declares.
    ///
    /// # Errors
    /// Returns an error when the unit does not stage exactly one package of
    /// `kind`, when it disagrees with the declaration, or when the file is
    /// missing.
    pub(crate) fn package(
        &self,
        unit: &str,
        kind: PackageKind,
        name: &str,
        package: &str,
    ) -> Result<PathBuf, ArtifactError> {
        let entries: Vec<_> = self
            .entries
            .iter()
            .filter_map(|entry| kind.entry(entry))
            .filter(|entry| entry.unit == unit)
            .collect();
        if entries.len() > 1 {
            return Err(ArtifactError::ArtifactCount {
                unit: unit.to_owned(),
                expected: 1,
                actual: entries.len(),
            });
        }
        let entry = entries
            .first()
            .filter(|entry| entry.name == name)
            .ok_or_else(|| ArtifactError::MissingArtifact(name.to_owned()))?;
        if entry.package != package {
            return Err(ArtifactError::ArtifactMismatch {
                name: name.to_owned(),
                field: "package",
            });
        }
        if RepositoryPath::try_from(entry.path.as_str()).is_err() {
            return Err(ArtifactError::UnsafeFilename(entry.path.clone()));
        }
        let expected_path = Path::new("artifacts").join(format!("{unit}.{}", kind.extension()));
        if Path::new(&entry.path) != expected_path {
            return Err(ArtifactError::UnexpectedPath {
                name: name.to_owned(),
                path: PathBuf::from(&entry.path),
            });
        }
        let path = self.directory.join(&entry.path);
        match fs::metadata(&path) {
            Ok(metadata) if metadata.is_file() => Ok(path),
            Ok(_) => Err(ArtifactError::NotAFile { path }),
            Err(source) => Err(ArtifactError::Io { path, source }),
        }
    }

    /// The bytes of the staged asset `name` of `unit`, or `None` when the
    /// manifest has no such asset.
    ///
    /// # Errors
    /// Returns an error when the asset file cannot be read.
    pub(crate) fn asset_bytes(
        &self,
        unit: &str,
        name: &str,
    ) -> Result<Option<Vec<u8>>, ArtifactError> {
        let Some(entry) = self.entries.iter().find_map(|entry| match entry {
            ManifestEntry::Asset(asset) if asset.unit == unit && asset.name == name => Some(asset),
            ManifestEntry::Asset(_)
            | ManifestEntry::Oci(_)
            | ManifestEntry::Cargo(_)
            | ManifestEntry::Npm(_) => None,
        }) else {
            return Ok(None);
        };
        let path = self.directory.join(&entry.path);
        let bytes = fs::read(&path).map_err(|source| ArtifactError::Io { path, source })?;
        Ok(Some(bytes))
    }

    /// Check and read the staged files of one publication.
    ///
    /// # Errors
    /// Returns an error when the staged files do not match the publication,
    /// or an OCI artifact has no `login`.
    pub(crate) fn release<'a>(
        &self,
        publication: Publication<'a>,
        login: Option<&OciLogin>,
    ) -> Result<StagedRelease<'a>, ArtifactError> {
        let assets = LocalAsset::load_all(&self.entries, &self.directory, &publication)?;
        let pushes = OciPush::resolve(&self.entries, &publication, login)?;
        Ok(StagedRelease {
            publication,
            assets,
            pushes,
        })
    }
}

/// What [`StagedRelease::prepare`] leaves to do.
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub(crate) enum Prepared {
    /// The release was published before and matches the staged files.
    Published,
    /// The draft with this ID holds every artifact and awaits publication.
    Draft(u64),
}

impl Prepared {
    /// Publish the draft that [`StagedRelease::prepare`] completed. A
    /// published release stays as it is.
    ///
    /// # Errors
    /// Returns an error when the forge call fails.
    pub(crate) async fn publish<R: ForgeRelease>(self, remote: &R) -> Result<(), ArtifactError> {
        match self {
            Self::Published => Ok(()),
            Self::Draft(id) => Ok(remote.publish(id).await.map_err(ForgeFailure::new)?),
        }
    }
}

impl StagedRelease<'_> {
    /// Complete the release's artifacts: create a missing draft, replace
    /// wrong assets on a draft, and push OCI artifacts. A published release
    /// is only verified, and only when the unit declares artifacts.
    ///
    /// # Errors
    /// Returns an error when a forge call or a push fails, or when a
    /// published release differs from the staged files.
    pub(crate) async fn prepare<R: ForgeRelease>(
        &self,
        remote: &R,
    ) -> Result<Prepared, ArtifactError> {
        let publication = &self.publication;
        let id = match remote
            .release_by_tag(&publication.tag)
            .await
            .map_err(ForgeFailure::new)?
        {
            Some(RemoteRelease {
                id: _,
                draft: false,
            }) if publication.expected.is_empty() && publication.oci.is_empty() => {
                return Ok(Prepared::Published);
            }
            Some(RemoteRelease { id, draft: false }) => {
                let existing = remote.assets(id).await.map_err(ForgeFailure::new)?;
                return if LocalAsset::all_match(&self.assets, &existing, remote).await? {
                    Ok(Prepared::Published)
                } else {
                    Err(ArtifactError::PublishedMismatch {
                        tag: publication.tag.clone(),
                    })
                };
            }
            Some(RemoteRelease { id, draft: true }) => id,
            None => remote
                .create_draft(
                    &publication.tag,
                    &publication.target_commit,
                    &publication.title,
                    &publication.notes,
                )
                .await
                .map_err(ForgeFailure::new)?,
        };
        let mut kept = BTreeSet::new();
        for asset in remote.assets(id).await.map_err(ForgeFailure::new)? {
            let wanted = self.assets.iter().find(|local| local.name == asset.name);
            let keep = match wanted {
                Some(local) if !kept.contains(&asset.name) => local.matches(&asset, remote).await?,
                Some(_) | None => false,
            };
            if keep {
                kept.insert(asset.name);
            } else {
                remote
                    .delete_asset(id, asset.id)
                    .await
                    .map_err(ForgeFailure::new)?;
            }
        }
        for local in &self.assets {
            if !kept.contains(&local.name) {
                remote
                    .upload(id, &local.name, &local.bytes)
                    .await
                    .map_err(ForgeFailure::new)?;
            }
        }
        let existing = remote.assets(id).await.map_err(ForgeFailure::new)?;
        if !LocalAsset::all_match(&self.assets, &existing, remote).await? {
            return Err(ArtifactError::IncompleteUpload {
                tag: publication.tag.clone(),
            });
        }
        for push in &self.pushes {
            push.run(&publication.working_directory)?;
        }
        Ok(Prepared::Draft(id))
    }
}

impl LocalAsset {
    fn load_all(
        entries: &[ManifestEntry],
        directory: &Path,
        publication: &Publication<'_>,
    ) -> Result<Vec<Self>, ArtifactError> {
        let entries: BTreeMap<_, _> = entries
            .iter()
            .filter_map(|entry| match entry {
                ManifestEntry::Asset(asset) if asset.unit == publication.unit => {
                    Some((asset.name.clone(), asset))
                }
                ManifestEntry::Asset(_)
                | ManifestEntry::Oci(_)
                | ManifestEntry::Cargo(_)
                | ManifestEntry::Npm(_) => None,
            })
            .collect();
        if entries.len() != publication.expected.len() {
            return Err(ArtifactError::ArtifactCount {
                unit: publication.unit.clone(),
                expected: publication.expected.len(),
                actual: entries.len(),
            });
        }
        let declared_names: BTreeSet<&str> = publication
            .expected
            .iter()
            .map(|(_, spec)| spec.filename.as_str())
            .collect();
        let mut filenames = BTreeSet::new();
        let mut result = Vec::new();
        for &(name, spec) in &publication.expected {
            let entry = entries
                .get(name)
                .ok_or_else(|| ArtifactError::MissingArtifact(name.to_owned()))?;
            if let Some(field) = spec.mismatch(entry, &declared_names) {
                return Err(ArtifactError::ArtifactMismatch {
                    name: name.to_owned(),
                    field,
                });
            }
            if !filenames.insert(entry.filename.clone())
                || RepositoryPath::try_from(entry.path.as_str()).is_err()
            {
                return Err(ArtifactError::UnsafeFilename(entry.filename.clone()));
            }
            let expected_path = Path::new("artifacts").join(&entry.filename);
            if Path::new(&entry.path) != expected_path {
                return Err(ArtifactError::UnexpectedPath {
                    name: entry.name.clone(),
                    path: PathBuf::from(&entry.path),
                });
            }
            let path = directory.join(&entry.path);
            let bytes = fs::read(&path).map_err(|source| ArtifactError::Io { path, source })?;
            let sha256 = DigestAlgorithm::Sha256.hex(&bytes);
            result.push(Self {
                name: entry.filename.clone(),
                bytes,
                sha256,
            });
        }
        Ok(result)
    }

    async fn all_match<R: ForgeRelease>(
        local: &[Self],
        remote_assets: &[RemoteAsset],
        remote: &R,
    ) -> Result<bool, ArtifactError> {
        if local.len() != remote_assets.len() {
            return Ok(false);
        }
        for artifact in local {
            let Some(asset) = remote_assets
                .iter()
                .find(|asset| asset.name == artifact.name)
            else {
                return Ok(false);
            };
            if !artifact.matches(asset, remote).await? {
                return Ok(false);
            }
        }
        Ok(true)
    }

    async fn matches<R: ForgeRelease>(
        &self,
        asset: &RemoteAsset,
        remote: &R,
    ) -> Result<bool, ArtifactError> {
        if usize::try_from(asset.size).ok() != Some(self.bytes.len()) {
            return Ok(false);
        }
        let digest = if let Some(value) = asset.sha256.as_deref() {
            value.strip_prefix("sha256:").unwrap_or(value).to_owned()
        } else {
            let bytes = remote.asset_bytes(asset).await.map_err(ForgeFailure::new)?;
            DigestAlgorithm::Sha256.hex(&bytes)
        };
        Ok(digest == self.sha256)
    }
}

impl ManifestEntry {
    fn read_all(manifest: &Path) -> Result<Vec<Self>, ArtifactError> {
        let raw = fs::read_to_string(manifest).map_err(|source| ArtifactError::Io {
            path: manifest.to_owned(),
            source,
        })?;
        facet_json::from_str(&raw).map_err(|source| ArtifactError::ManifestDecode {
            path: manifest.to_owned(),
            source: Box::new(source),
        })
    }
}

impl AssetSpec {
    /// The first field of the staged `entry` that differs from this spec.
    /// `declared` holds the file names of every asset of the unit.
    fn mismatch(&self, entry: &AssetEntry, declared: &BTreeSet<&str>) -> Option<&'static str> {
        let required: BTreeSet<&str> = self.required_names.iter().map(String::as_str).collect();
        let staged: BTreeSet<&str> = entry.required_names.iter().map(String::as_str).collect();
        [
            ("package", entry.package == self.package),
            ("output", entry.output == self.output),
            ("filename", entry.filename == self.filename),
            ("format", entry.format == self.format),
            ("variant", entry.variant == self.variant),
            (
                "required_names",
                staged == required && required.is_subset(declared),
            ),
        ]
        .into_iter()
        .find_map(|(field, equal)| (!equal).then_some(field))
    }
}

impl OciSpec {
    /// The first field of the staged `entry` that differs from this spec.
    fn mismatch(&self, entry: &OciEntry) -> Option<&'static str> {
        [
            ("registry", entry.registry == self.registry),
            ("repository", entry.repository == self.repository),
            ("latest", entry.latest == self.latest),
        ]
        .into_iter()
        .find_map(|(field, equal)| (!equal).then_some(field))
    }
}

#[cfg(test)]
mod tests {
    use std::cell::RefCell;
    use std::sync::LazyLock;

    use super::*;

    static ASSETS: LazyLock<[AssetSpec; 2]> = LazyLock::new(|| {
        let required_names = vec!["prod.deb".to_owned(), "test.deb".to_owned()];
        [
            AssetSpec {
                package: "app".into(),
                output: "prod".into(),
                filename: "prod.deb".into(),
                format: "deb".into(),
                variant: "production".into(),
                required_names: required_names.clone(),
            },
            AssetSpec {
                package: "app-test".into(),
                output: "test".into(),
                filename: "test.deb".into(),
                format: "deb".into(),
                variant: "testbroker".into(),
                required_names,
            },
        ]
    });

    static IMAGE: LazyLock<OciSpec> = LazyLock::new(|| OciSpec {
        package: "image".into(),
        registry: "registry.example/team".into(),
        repository: "app".into(),
        latest: true,
    });

    #[derive(Default)]
    struct Fake {
        state: RefCell<State>,
    }
    #[derive(Default)]
    struct State {
        release: Option<RemoteRelease>,
        assets: Vec<(RemoteAsset, Vec<u8>)>,
        calls: Vec<String>,
        failing_uploads: usize,
        next_id: u64,
    }

    impl ForgeRelease for Fake {
        type Error = io::Error;
        async fn delete_asset(&self, _: u64, asset_id: u64) -> Result<(), Self::Error> {
            let mut state = self.state.borrow_mut();
            let index = state
                .assets
                .iter()
                .position(|(asset, _)| asset.id == asset_id)
                .ok_or_else(|| io::Error::other("no such asset"))?;
            let (asset, _) = state.assets.remove(index);
            state.calls.push(format!("delete:{}", asset.name));
            drop(state);
            Ok(())
        }
        async fn release_by_tag(&self, _: &str) -> Result<Option<RemoteRelease>, Self::Error> {
            Ok(self.state.borrow().release)
        }
        async fn create_draft(
            &self,
            _: &str,
            _: &str,
            _: &str,
            _: &str,
        ) -> Result<u64, Self::Error> {
            let mut state = self.state.borrow_mut();
            state.calls.push("draft".into());
            state.release = Some(RemoteRelease { id: 1, draft: true });
            drop(state);
            Ok(1)
        }
        async fn assets(&self, _: u64) -> Result<Vec<RemoteAsset>, Self::Error> {
            Ok(self
                .state
                .borrow()
                .assets
                .iter()
                .map(|(asset, _)| asset.clone())
                .collect())
        }
        async fn upload(&self, _: u64, filename: &str, bytes: &[u8]) -> Result<(), Self::Error> {
            let mut state = self.state.borrow_mut();
            if state.failing_uploads > 0 {
                state.failing_uploads = state.failing_uploads.saturating_sub(1);
                return Err(io::Error::other("upload interrupted"));
            }
            state.calls.push(format!("upload:{filename}"));
            let digest = DigestAlgorithm::Sha256.hex(bytes);
            state.next_id = state.next_id.saturating_add(1);
            let id = state.next_id.saturating_add(100);
            state.assets.push((
                RemoteAsset {
                    id,
                    name: filename.into(),
                    size: u64::try_from(bytes.len()).unwrap_or(u64::MAX),
                    sha256: Some(format!("sha256:{digest}")),
                    download_url: String::new(),
                },
                bytes.to_vec(),
            ));
            drop(state);
            Ok(())
        }
        async fn asset_bytes(&self, asset: &RemoteAsset) -> Result<Vec<u8>, Self::Error> {
            Ok(self
                .state
                .borrow()
                .assets
                .iter()
                .find(|(candidate, _)| candidate.id == asset.id)
                .map(|(_, bytes)| bytes.clone())
                .unwrap_or_default())
        }
        async fn publish(&self, _: u64) -> Result<(), Self::Error> {
            self.state.borrow_mut().calls.push("publish".into());
            Ok(())
        }
    }

    async fn publish(
        manifest: &Path,
        directory: &Path,
        publication: &Publication<'_>,
        remote: &Fake,
    ) -> Result<(), ArtifactError> {
        let login = OciLogin::new("bot".into(), Token::new("secret"));
        let release =
            Stage::read(manifest, directory)?.release(publication.clone(), Some(&login))?;
        release.prepare(remote).await?.publish(remote).await
    }

    fn asset(id: u64, name: &str, bytes: &[u8]) -> (RemoteAsset, Vec<u8>) {
        (
            RemoteAsset {
                id,
                name: name.into(),
                size: u64::try_from(bytes.len()).unwrap(),
                sha256: None,
                download_url: String::new(),
            },
            bytes.to_vec(),
        )
    }

    fn fixture() -> (tempfile::TempDir, PathBuf, Publication<'static>) {
        let directory = tempfile::tempdir().unwrap();
        fs::create_dir_all(directory.path().join("artifacts")).unwrap();
        fs::write(directory.path().join("artifacts/prod.deb"), b"prod").unwrap();
        fs::write(directory.path().join("artifacts/test.deb"), b"test").unwrap();
        let manifest = directory.path().join("manifest.json");
        fs::write(&manifest, r#"[{"kind":"asset","unit":"app","name":"production","package":"app","output":"prod","filename":"prod.deb","format":"deb","variant":"production","required_names":["prod.deb","test.deb"],"path":"artifacts/prod.deb"},{"kind":"asset","unit":"app","name":"testbroker","package":"app-test","output":"test","filename":"test.deb","format":"deb","variant":"testbroker","required_names":["prod.deb","test.deb"],"path":"artifacts/test.deb"}]"#).unwrap();
        let publication = Publication {
            unit: "app".into(),
            tag: "app-v1-1".into(),
            target_commit: "abc".into(),
            title: "App".into(),
            notes: String::new(),
            expected: vec![("production", &ASSETS[0]), ("testbroker", &ASSETS[1])],
            oci: Vec::new(),
            version: "1".into(),
            working_directory: directory.path().to_owned(),
        };
        (directory, manifest, publication)
    }

    #[tokio::test]
    async fn verifies_all_outputs_before_creating_a_draft_then_uploads_and_publishes() {
        let (directory, manifest, publication) = fixture();
        let remote = Fake::default();
        publish(&manifest, directory.path(), &publication, &remote)
            .await
            .unwrap();
        assert_eq!(
            remote.state.borrow_mut().calls,
            ["draft", "upload:prod.deb", "upload:test.deb", "publish"]
        );
    }

    #[tokio::test]
    async fn a_stale_staged_field_names_the_mismatch_before_any_remote_call() {
        let (directory, manifest, publication) = fixture();
        let raw = fs::read_to_string(&manifest).unwrap();
        fs::write(
            &manifest,
            raw.replace(r#""variant":"production""#, r#""variant":"old""#),
        )
        .unwrap();
        let remote = Fake::default();
        assert!(matches!(
            publish(&manifest, directory.path(), &publication, &remote).await,
            Err(ArtifactError::ArtifactMismatch { name, field })
                if name == "production" && field == "variant"
        ));
        assert_eq!(remote.state.borrow_mut().calls, Vec::<String>::new());
    }

    #[tokio::test]
    async fn staged_required_names_must_equal_the_configured_ones() {
        let (directory, manifest, publication) = fixture();
        let raw = fs::read_to_string(&manifest).unwrap();
        fs::write(
            &manifest,
            raw.replacen(
                r#""required_names":["prod.deb","test.deb"]"#,
                r#""required_names":["prod.deb"]"#,
                1,
            ),
        )
        .unwrap();
        let remote = Fake::default();
        assert!(matches!(
            publish(&manifest, directory.path(), &publication, &remote).await,
            Err(ArtifactError::ArtifactMismatch { name, field })
                if name == "production" && field == "required_names"
        ));
    }

    #[tokio::test]
    async fn a_missing_required_output_causes_no_remote_calls() {
        let (directory, manifest, publication) = fixture();
        fs::remove_file(directory.path().join("artifacts/test.deb")).unwrap();
        let remote = Fake::default();
        assert!(
            publish(&manifest, directory.path(), &publication, &remote)
                .await
                .is_err()
        );
        assert_eq!(remote.state.borrow_mut().calls, Vec::<String>::new());
    }

    #[tokio::test]
    async fn retries_verify_existing_bytes_and_never_change_a_published_release() {
        let (directory, manifest, publication) = fixture();
        let remote = Fake::default();
        publish(&manifest, directory.path(), &publication, &remote)
            .await
            .unwrap();
        remote.state.borrow_mut().release.as_mut().unwrap().draft = false;
        remote.state.borrow_mut().calls.clear();
        publish(&manifest, directory.path(), &publication, &remote)
            .await
            .unwrap();
        assert_eq!(remote.state.borrow_mut().calls, Vec::<String>::new());
        remote.state.borrow_mut().assets[0].1 = b"wrng".to_vec();
        remote.state.borrow_mut().assets[0].0.sha256 = None;
        assert!(matches!(
            publish(&manifest, directory.path(), &publication, &remote).await,
            Err(ArtifactError::PublishedMismatch { tag }) if tag == "app-v1-1"
        ));
        assert_eq!(remote.state.borrow_mut().calls, Vec::<String>::new());
    }

    #[tokio::test]
    async fn a_published_release_of_a_unit_without_artifacts_is_not_inspected() {
        let (directory, manifest, mut publication) = fixture();
        fs::write(&manifest, "[]").unwrap();
        publication.expected.clear();
        let remote = Fake {
            state: RefCell::new(State {
                release: Some(RemoteRelease {
                    id: 1,
                    draft: false,
                }),
                assets: vec![asset(1, "hand.txt", b"hand")],
                ..State::default()
            }),
        };
        publish(&manifest, directory.path(), &publication, &remote)
            .await
            .unwrap();
        assert_eq!(remote.state.borrow_mut().calls, Vec::<String>::new());
    }

    #[tokio::test]
    async fn a_rerun_after_a_failed_upload_repairs_a_draft_with_wrong_and_extra_assets() {
        let (directory, manifest, publication) = fixture();
        let remote = Fake {
            state: RefCell::new(State {
                release: Some(RemoteRelease { id: 1, draft: true }),
                assets: vec![
                    asset(1, "prod.deb", b"prod"),
                    asset(2, "test.deb", b"tset"),
                    asset(3, "stale.deb", b"stale"),
                ],
                failing_uploads: 1,
                ..State::default()
            }),
        };
        assert!(matches!(
            publish(&manifest, directory.path(), &publication, &remote).await,
            Err(ArtifactError::Remote(_))
        ));
        assert_eq!(
            remote.state.borrow_mut().calls,
            ["delete:test.deb", "delete:stale.deb"]
        );
        remote.state.borrow_mut().calls.clear();
        publish(&manifest, directory.path(), &publication, &remote)
            .await
            .unwrap();
        assert_eq!(
            remote.state.borrow_mut().calls,
            ["upload:test.deb", "publish"]
        );
        let names: Vec<_> = remote
            .state
            .borrow()
            .assets
            .iter()
            .map(|(asset, bytes)| (asset.name.clone(), bytes.clone()))
            .collect();
        assert_eq!(
            names,
            [
                ("prod.deb".to_owned(), b"prod".to_vec()),
                ("test.deb".to_owned(), b"test".to_vec())
            ]
        );
    }

    #[cfg(unix)]
    fn with_oci_program(
        directory: &Path,
        manifest: &Path,
        publication: &mut Publication<'static>,
        script: &str,
    ) {
        use std::os::unix::fs::PermissionsExt as _;

        let program = directory.join("push");
        fs::write(&program, format!("#!/bin/sh\n{script}\n")).unwrap();
        fs::set_permissions(&program, fs::Permissions::from_mode(0o755)).unwrap();
        let raw = fs::read_to_string(manifest).unwrap();
        let oci = format!(
            r#"{{"kind":"oci","unit":"app","name":"image","package":"image","registry":"registry.example/team","repository":"app","latest":true,"program":{program:?}}}"#
        );
        fs::write(manifest, format!("{},{oci}]", raw.trim_end_matches(']'))).unwrap();
        publication.oci.push(("image", &IMAGE));
    }

    #[cfg(unix)]
    #[tokio::test]
    async fn oci_pushes_run_after_the_uploads_and_before_the_release_is_published() {
        let (directory, manifest, mut publication) = fixture();
        with_oci_program(
            directory.path(),
            &manifest,
            &mut publication,
            "printf '%s\\n' \"$1\" >> \"$(dirname \"$0\")/pushed\"",
        );
        let remote = Fake::default();
        publish(&manifest, directory.path(), &publication, &remote)
            .await
            .unwrap();
        assert_eq!(
            remote.state.borrow_mut().calls,
            ["draft", "upload:prod.deb", "upload:test.deb", "publish"]
        );
        assert_eq!(
            fs::read_to_string(directory.path().join("pushed")).unwrap(),
            "registry.example/team/app:1\nregistry.example/team/app:latest\n"
        );
    }

    #[cfg(unix)]
    #[tokio::test]
    async fn a_failed_oci_push_leaves_the_release_a_draft() {
        let (directory, manifest, mut publication) = fixture();
        with_oci_program(directory.path(), &manifest, &mut publication, "exit 3");
        let remote = Fake::default();
        let result = publish(&manifest, directory.path(), &publication, &remote).await;
        assert!(matches!(
            result,
            Err(ArtifactError::OciPush { name, status })
                if name == "image" && status.code() == Some(3)
        ));
        assert_eq!(
            remote.state.borrow_mut().calls,
            ["draft", "upload:prod.deb", "upload:test.deb"]
        );
    }

    #[cfg(unix)]
    #[tokio::test]
    async fn a_published_release_is_not_pushed_again() {
        let (directory, manifest, mut publication) = fixture();
        let remote = Fake::default();
        publish(&manifest, directory.path(), &publication, &remote)
            .await
            .unwrap();
        remote.state.borrow_mut().release.as_mut().unwrap().draft = false;
        with_oci_program(
            directory.path(),
            &manifest,
            &mut publication,
            "touch \"$(dirname \"$0\")/pushed\"",
        );
        publish(&manifest, directory.path(), &publication, &remote)
            .await
            .unwrap();
        assert!(!directory.path().join("pushed").exists());
    }
}