Harden reconnect and stream open reliability

scripts/upload-gitea-release.sh

@@ -30,6 +30,7 @@ base="${GITEA_URL:-https://git.palav.dev}"
 repo="${GITEA_REPO:-Palav/dosh}"
 token="${GITEA_TOKEN:-}"
 title="${GITEA_TITLE:-$tag}"
+expected_version="${tag#v}"
 
 if [ -z "$token" ] && [ -f "$HOME/.config/dosh/gitea-token" ]; then
   token="$(tr -d '\r\n' <"$HOME/.config/dosh/gitea-token")"
@@ -102,12 +103,49 @@ delete_existing_asset() {
     done
 }
 
+artifact_version() {
+  artifact="$1"
+  case "$artifact" in
+    *.tar.gz)
+      tar -xOf "$artifact" dosh/VERSION 2>/dev/null | tr -d '\r\n'
+      ;;
+    *.zip)
+      unzip -p "$artifact" dosh/VERSION 2>/dev/null | tr -d '\r\n'
+      ;;
+    *)
+      return 1
+      ;;
+  esac
+}
+
+verify_release_artifact_version() {
+  artifact="$1"
+  name="$(basename "$artifact")"
+  case "$name" in
+    *.sha256)
+      return 0
+      ;;
+    dosh-*.tar.gz|dosh-*.zip)
+      actual="$(artifact_version "$artifact" || true)"
+      if [ -z "$actual" ]; then
+        echo "release artifact missing dosh/VERSION: $artifact" >&2
+        exit 1
+      fi
+      if [ "$actual" != "$expected_version" ]; then
+        echo "release artifact version mismatch: $artifact has $actual, expected $expected_version" >&2
+        exit 1
+      fi
+      ;;
+  esac
+}
+
 uploaded=0
 for artifact in "$@"; do
   if [ ! -f "$artifact" ]; then
     continue
   fi
   name="$(basename "$artifact")"
+  verify_release_artifact_version "$artifact"
   delete_existing_asset "$name"
   echo "uploading $name"
   curl -fsS \