fix: require complete release asset inventory

Author: Saitamasans

.github/workflows/release.yml

@@ -24,14 +24,17 @@ jobs:
       - run: python scripts/security_scan.py .
       - run: python -m build
       - run: python scripts/generate_supply_chain_docs.py
+      - name: Stage flat source assets
+        run: |
+          mkdir -p build/release-assets
+          cp dist/multi_api_test_executor-*.whl build/release-assets/
+          cp dist/multi_api_test_executor-*.tar.gz build/release-assets/
+          cp build/release/sbom.cdx.json build/release-assets/
+          cp build/release/THIRD_PARTY_LICENSES.txt build/release-assets/
       - uses: actions/upload-artifact@v4
         with:
           name: release-source-assets
-          path: |
-            dist/multi_api_test_executor-*.whl
-            dist/multi_api_test_executor-*.tar.gz
-            build/release/sbom.cdx.json
-            build/release/THIRD_PARTY_LICENSES.txt
+          path: build/release-assets/*
 
   native-bundles:
     strategy:
@@ -73,6 +76,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/download-artifact@v4
         with: {path: artifacts, merge-multiple: true}
+      - run: python scripts/validate_release_assets.py artifacts --tag ${{ github.ref_name }}
       - name: Write aggregate checksums
         run: |
           python - <<'PY'

scripts/validate_release_assets.py

@@ -0,0 +1,51 @@
+from __future__ import annotations
+
+import argparse
+import json
+import re
+from pathlib import Path
+
+VERSION = re.compile(r"^v?(\d+\.\d+\.\d+(?:-[0-9A-Za-z.]+)?)$")
+
+
+def expected_asset_names(tag: str) -> set[str]:
+    match = VERSION.fullmatch(tag)
+    if not match:
+        raise ValueError(f"unsupported release tag: {tag}")
+    version = match.group(1)
+    package_version = version.split("-", 1)[0]
+    return {
+        f"multi-api-test-executor-{version}-windows-x64.zip",
+        f"multi-api-test-executor-{version}-linux-x64.tar.gz",
+        f"multi-api-test-executor-{version}-macos-x64.tar.gz",
+        f"multi_api_test_executor-{package_version}-py3-none-any.whl",
+        f"multi_api_test_executor-{package_version}.tar.gz",
+        "sbom.cdx.json",
+        "THIRD_PARTY_LICENSES.txt",
+    }
+
+
+def validate_release_assets(directory: Path, tag: str) -> set[str]:
+    expected = expected_asset_names(tag)
+    actual = {path.name for path in directory.iterdir() if path.is_file()}
+    missing = sorted(expected - actual)
+    unexpected = sorted(actual - expected)
+    empty = sorted(name for name in expected & actual if not (directory / name).stat().st_size)
+    if missing or unexpected or empty:
+        raise ValueError(
+            f"release inventory mismatch: missing={missing}, unexpected={unexpected}, empty={empty}"
+        )
+    return actual
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("directory", type=Path)
+    parser.add_argument("--tag", required=True)
+    args = parser.parse_args()
+    assets = validate_release_assets(args.directory, args.tag)
+    print(json.dumps({"tag": args.tag, "assets": sorted(assets)}))
+
+
+if __name__ == "__main__":
+    main()

tests/unit/test_release_packaging.py

@@ -47,5 +47,26 @@ def test_release_workflow_publishes_native_assets_and_supply_chain_files() -> No
         "SHA256SUMS.txt",
         "docs/release-notes-v0.1.0.md",
         "prerelease: ${{ contains(github.ref_name, '-') }}",
+        "python scripts/validate_release_assets.py",
+        "path: build/release-assets/*",
     ]:
         assert phrase in workflow
+
+
+def test_release_asset_validator_requires_complete_exact_inventory(tmp_path: Path) -> None:
+    script = ROOT / "scripts/validate_release_assets.py"
+    namespace: dict[str, object] = {"__name__": "release_validator_test", "__file__": str(script)}
+    exec(compile(script.read_text(encoding="utf-8"), str(script), "exec"), namespace)
+    expected = namespace["expected_asset_names"]("v0.1.0-rc.2")
+    for name in expected:
+        (tmp_path / name).write_bytes(b"release-asset")
+
+    assert namespace["validate_release_assets"](tmp_path, "v0.1.0-rc.2") == expected
+
+    (tmp_path / "sbom.cdx.json").unlink()
+    try:
+        namespace["validate_release_assets"](tmp_path, "v0.1.0-rc.2")
+    except ValueError as exc:
+        assert "missing" in str(exc)
+    else:
+        raise AssertionError("incomplete release inventory was accepted")