From 7f48af45cd6ad5ddccd660f24c4ea28573d61326 Mon Sep 17 00:00:00 2001
From: DuProcess <273172371+DuProcess@users.noreply.github.com>
Date: Sun, 12 Jul 2026 21:37:27 -0400
Subject: [PATCH] Require complete release uploads by default

---
 scripts/upload-gitea-release.sh | 39 +++++++++++++++++++++++++++++++++
 tests/release_scripts.rs        | 19 ++++++++++++++++
 2 files changed, 58 insertions(+)

diff --git a/scripts/upload-gitea-release.sh b/scripts/upload-gitea-release.sh
index efe2e52..8a9437e 100755
--- a/scripts/upload-gitea-release.sh
+++ b/scripts/upload-gitea-release.sh
@@ -11,6 +11,8 @@ Environment:
   GITEA_REPO      owner/repo, default Palav/dosh
   GITEA_TOKEN     Token with release write permission
   GITEA_TITLE     Release title, default TAG
+  DOSH_RELEASE_ALLOW_PARTIAL=1
+                  Allow uploading an incomplete platform set. Default: refuse.
 EOF
 }
 
@@ -31,6 +33,7 @@ repo="${GITEA_REPO:-Palav/dosh}"
 token="${GITEA_TOKEN:-}"
 title="${GITEA_TITLE:-$tag}"
 expected_version="${tag#v}"
+allow_partial="${DOSH_RELEASE_ALLOW_PARTIAL:-0}"
 
 artifact_version() {
   artifact="$1"
@@ -80,6 +83,42 @@ if [ "$#" -eq 0 ]; then
   done
 fi
 
+require_complete_release_artifacts() {
+  [ "$allow_partial" = "1" ] && return 0
+  missing=0
+  for required in \
+    dosh-linux-x86_64.tar.gz \
+    dosh-macos-aarch64.tar.gz \
+    dosh-macos-x86_64.tar.gz \
+    dosh-windows-x86_64.zip; do
+    found=0
+    checksum_found=0
+    for artifact in "$@"; do
+      name="$(basename "$artifact")"
+      if [ "$name" = "$required" ]; then
+        found=1
+      fi
+      if [ "$name" = "$required.sha256" ]; then
+        checksum_found=1
+      fi
+    done
+    if [ "$found" -ne 1 ]; then
+      echo "missing required release artifact: $required" >&2
+      missing=1
+    fi
+    if [ "$checksum_found" -ne 1 ]; then
+      echo "missing required release checksum: $required.sha256" >&2
+      missing=1
+    fi
+  done
+  if [ "$missing" -ne 0 ]; then
+    echo "refusing partial release upload; set DOSH_RELEASE_ALLOW_PARTIAL=1 to override" >&2
+    exit 1
+  fi
+}
+
+require_complete_release_artifacts "$@"
+
 api="$base/api/v1/repos/$repo"
 auth_header="Authorization: token $token"
 
diff --git a/tests/release_scripts.rs b/tests/release_scripts.rs
index 276d4a8..50e07f8 100644
--- a/tests/release_scripts.rs
+++ b/tests/release_scripts.rs
@@ -19,6 +19,25 @@ fn release_scripts_skip_stale_artifacts_when_auto_discovering() {
     assert!(publish.contains("actual=\"$(artifact_version \"$artifact\" || true)\""));
 }
 
+#[test]
+fn release_upload_refuses_partial_platform_sets_by_default() {
+    let upload = include_str!("../scripts/upload-gitea-release.sh");
+    assert!(upload.contains("require_complete_release_artifacts \"$@\""));
+    assert!(upload.contains("DOSH_RELEASE_ALLOW_PARTIAL=1"));
+    assert!(upload.contains("refusing partial release upload"));
+    for name in [
+        "dosh-linux-x86_64.tar.gz",
+        "dosh-macos-aarch64.tar.gz",
+        "dosh-macos-x86_64.tar.gz",
+        "dosh-windows-x86_64.zip",
+    ] {
+        assert!(
+            upload.contains(name),
+            "release upload completeness check must require {name}"
+        );
+    }
+}
+
 #[test]
 fn installers_skip_stale_latest_release_prebuilts() {
     let install = include_str!("../install.sh");