fix: verify and reuse release deploy assets (#8191)

Author: chubes4

src/core/deploy/execution/mod.rs

@@ -10,7 +10,9 @@ mod strategies;
 pub(super) use prepare::{
     execute_preflighted_component_deploy, prepare_component_deploy, PreparedComponentDeploy,
 };
-pub(super) use release_plan::{release_artifact_plan, ReleaseArtifactPlan};
+pub(super) use release_plan::{
+    release_artifact_plan, resolve_planned_release_artifact, ReleaseArtifactPlan,
+};
 
 /// Maximum number of bytes retained when reading a version-target file out of a
 /// deploy artifact. The artifact is downloaded release content and therefore

src/core/deploy/execution/prepare.rs

@@ -9,14 +9,13 @@ use super::super::generated_artifacts::GeneratedBuildArtifactCleanupGuard;
 use super::super::path_roots::{component_remote_path, resolve_effective_remote_path};
 use super::super::policy::{owner_hint_for_path, protected_path_suffixes, validate_deploy_target};
 use super::super::provenance::capture_build_provenance;
+use super::super::release_download::ReleaseArtifact;
 use super::super::types::{
     BuildProvenance, BuildSource, ComponentDeployResult, DeployArtifactSource, DeployConfig,
 };
 use super::super::version_overrides::is_self_deploy;
 use super::preflight::{resolve_preflight_artifact_path, validate_preflight_file_artifact};
-use super::release_plan::{
-    release_artifact_plan, try_download_release_artifact, ReleaseArtifactPlan,
-};
+use super::release_plan::{release_artifact_plan, ReleaseArtifactPlan};
 use super::strategies::{execute_artifact_deploy, execute_file_deploy, execute_git_deploy};
 
 pub(crate) struct PreparedComponentDeploy {
@@ -40,6 +39,7 @@ pub(crate) fn prepare_component_deploy(
     project: &Project,
     local_version: Option<String>,
     remote_version: Option<String>,
+    release_artifact: Option<ReleaseArtifact>,
 ) -> std::result::Result<PreparedComponentDeploy, ComponentDeployResult> {
     let is_git_deploy = component.deploy_strategy.as_deref() == Some("git");
     let is_file_deploy = component.deploy_strategy.as_deref() == Some("file");
@@ -48,22 +48,13 @@ pub(crate) fn prepare_component_deploy(
     // This is the preferred path when the component has remote_url set.
     let release_artifact: Option<PathBuf> =
         match release_artifact_plan(component, config, is_git_deploy, is_file_deploy) {
-            ReleaseArtifactPlan::Reuse { tag, .. } => {
-                match try_download_release_artifact(component, &tag) {
-                    Ok(path) => path,
-                    Err(error) => {
-                        return Err(failed_component_deploy_result(
-                            component,
-                            base_path,
-                            local_version,
-                            remote_version,
-                            None,
-                            error,
-                        )
-                        .with_artifact_source(DeployArtifactSource::ReleaseAsset));
-                    }
-                }
-            }
+            ReleaseArtifactPlan::Reuse { tag, .. } => match release_artifact {
+                Some(artifact) => Some(artifact.path),
+                None => return Err(failed_component_deploy_result(
+                    component, base_path, local_version, remote_version, None,
+                    format!("artifact source release_asset failed for '{}' tag {tag}: verified run-scoped artifact is unavailable. Refusing to fall back to local_build", component.id),
+                ).with_artifact_source(DeployArtifactSource::ReleaseAsset)),
+            },
             ReleaseArtifactPlan::LocalBuild { reason } => {
                 if config.dry_run {
                     log_status!(

src/core/deploy/execution/release_plan.rs

@@ -1,5 +1,3 @@
-use std::path::PathBuf;
-
 use crate::core::component::Component;
 use crate::core::release;
 
@@ -76,34 +74,21 @@ pub(super) fn should_try_download_release_artifact(
     )
 }
 
-/// Try to download a release artifact from GitHub for the selected deploy tag.
-///
-/// Returns `Ok(Some(path))` only when the planned release asset was downloaded.
-/// Once deploy has selected the release asset path, any download miss fails closed
-/// instead of silently rebuilding from the local checkout.
-pub(super) fn try_download_release_artifact(
+pub(crate) fn resolve_planned_release_artifact(
     component: &Component,
     tag: &str,
-) -> std::result::Result<Option<PathBuf>, String> {
-    let Some(remote_url) = component.remote_url.as_ref() else {
-        return Ok(None);
-    };
-    let Some(github) = release_download::parse_github_url(remote_url) else {
-        return Ok(None);
-    };
-    let Some(artifact_name) = release_download::resolve_artifact_name(component) else {
-        return Ok(None);
-    };
-
-    log_status!(
-        "deploy",
-        "Attempting to download release artifact for '{}' tag {} from GitHub...",
-        component.id,
-        tag
-    );
-
-    release_download::download_release_artifact(&github, &component.github, tag, &artifact_name)
-        .map(Some)
+    store: &mut release_download::ReleaseArtifactStore,
+) -> std::result::Result<release_download::ReleaseArtifact, String> {
+    let remote_url = component
+        .remote_url
+        .as_deref()
+        .ok_or_else(|| "component has no remote_url".to_string())?;
+    let github = release_download::parse_github_url(remote_url)
+        .ok_or_else(|| "component remote_url is not a GitHub repository URL".to_string())?;
+    let artifact_name = release_download::resolve_artifact_name(component)
+        .ok_or_else(|| "component has no build_artifact filename".to_string())?;
+    store
+        .resolve(&github, &component.github, tag, &artifact_name)
         .map_err(|error| release_asset_download_error(component, tag, &artifact_name, error))
 }
 

src/core/deploy/mod.rs

@@ -39,10 +39,24 @@ use crate::core::project;
 /// This is the preferred entry point for callers - it handles project loading
 /// and SSH context resolution, keeping those details encapsulated.
 pub fn run(project_id: &str, config: &DeployConfig) -> Result<DeployOrchestrationResult> {
+    let mut release_artifacts = release_download::ReleaseArtifactStore::default();
+    run_with_release_artifacts(project_id, config, &mut release_artifacts)
+}
+
+fn run_with_release_artifacts(
+    project_id: &str,
+    config: &DeployConfig,
+    release_artifacts: &mut release_download::ReleaseArtifactStore,
+) -> Result<DeployOrchestrationResult> {
     let project = project::load(project_id)?;
-    project::validate_deploy_component_local_paths(&project, &config.component_ids)?;
+    // A version-pinned release asset is resolved remotely before orchestration;
+    // requiring its configured checkout to exist would reintroduce a mutable
+    // source gate. Other modes retain the existing early local-path validation.
+    if config.expected_version.is_none() {
+        project::validate_deploy_component_local_paths(&project, &config.component_ids)?;
+    }
     let (ctx, base_path) = resolve_project_ssh_with_base_path(project_id)?;
-    orchestration::deploy_components(config, &project, &ctx, &base_path)
+    orchestration::deploy_components(config, &project, &ctx, &base_path, release_artifacts)
 }
 
 /// Read deployed component versions without running deploy planning or git
@@ -137,6 +151,7 @@ pub fn run_multi(
     let mut failed: u32 = 0;
     let skipped: u32 = unknown_projects.len() as u32;
     let mut planned: u32 = 0;
+    let mut release_artifacts = release_download::ReleaseArtifactStore::default();
     // Record skipped results for unknown projects
     for pid in &unknown_projects {
         project_results.push(ProjectDeployResult {
@@ -174,7 +189,7 @@ pub fn run_multi(
             tagged: config.tagged,
         };
 
-        match run(project_id, &project_config) {
+        match run_with_release_artifacts(project_id, &project_config, &mut release_artifacts) {
             Ok(result) => {
                 let deploy_failed = result.summary.failed > 0;
                 let is_planned = config.dry_run || config.check;

src/core/deploy/orchestration/mod.rs

@@ -7,12 +7,14 @@ use crate::core::project::Project;
 use crate::core::release::version;
 
 use super::execution::{
-    execute_preflighted_component_deploy, prepare_component_deploy, PreparedComponentDeploy,
+    execute_preflighted_component_deploy, prepare_component_deploy, release_artifact_plan,
+    resolve_planned_release_artifact, PreparedComponentDeploy, ReleaseArtifactPlan,
 };
 use super::orchestration_ref_checkout::{ExactRefCheckout, ExactRefIdentity};
 use super::orchestration_tag_checkout::{checkout_deploy_tags, restore_branches};
 use super::path_roots::{project_with_detected_path_roots, resolve_effective_remote_path};
 use super::planning::{load_project_components, plan_components};
+use super::release_download::{ReleaseArtifact, ReleaseArtifactStore};
 use super::types::{ComponentDeployResult, DeployConfig, DeployOrchestrationResult, DeploySummary};
 use super::version_overrides::fetch_remote_versions_for_project;
 
@@ -34,6 +36,7 @@ pub(super) fn deploy_components(
     project: &Project,
     ctx: &RemoteProjectContext,
     base_path: &str,
+    release_artifacts: &mut ReleaseArtifactStore,
 ) -> Result<DeployOrchestrationResult> {
     let loaded = load_project_components(project, &config.component_ids, config.check)?;
     validate_supported_build_configs(&loaded.deployable)?;
@@ -105,6 +108,31 @@ pub(super) fn deploy_components(
 
     validate_effective_remote_paths(&components, &project, base_path)?;
 
+    // Release assets are immutable remote inputs. Resolve and verify them before
+    // touching any configured checkout, then reuse the same run-scoped bytes for
+    // every target/project that requests this component.
+    let mut resolved_release_artifacts: HashMap<String, ReleaseArtifact> = HashMap::new();
+    for component in &components {
+        if let ReleaseArtifactPlan::Reuse { tag, .. } =
+            release_artifact_plan(component, config, false, false)
+        {
+            let artifact = resolve_planned_release_artifact(component, &tag, release_artifacts)
+                .map_err(|error| {
+                    Error::validation_invalid_argument("releaseArtifact", error, None, None)
+                })?;
+            log_status!(
+                "deploy",
+                "Verified release asset: tag={} name={} size={} sha256={} source={}",
+                artifact.tag,
+                artifact.name,
+                artifact.size,
+                artifact.sha256,
+                artifact.url
+            );
+            resolved_release_artifacts.insert(component.id.clone(), artifact);
+        }
+    }
+
     // Resolve first, then materialize immutable detached worktrees for real deploys.
     // Dry-run resolves in `run_dry_run_mode` and never creates a worktree.
     let exact_ref_checkouts = if !config.dry_run {
@@ -172,35 +200,43 @@ pub(super) fn deploy_components(
         )?);
     }
 
+    // Only local builds require mutable checkout safety checks. Release assets are
+    // resolved and verified above and must not read or alter a source checkout.
+    let local_build_components: Vec<Component> = components
+        .iter()
+        .filter(|component| !resolved_release_artifacts.contains_key(&component.id))
+        .cloned()
+        .collect();
+
     // Sync: pull latest changes before deploying (unless --no-pull or --skip-build)
     if config.requested_ref.is_none() && !config.no_pull && !config.skip_build {
-        sync_components(&components)?;
+        sync_components(&local_build_components)?;
     }
 
     // Warn when --head deploys from a non-default branch (safety guardrail)
     if config.head && !config.skip_build {
-        warn_non_default_branch(&components, config)?;
+        warn_non_default_branch(&local_build_components, config)?;
     }
 
     if config.requested_ref.is_none() && !config.force {
-        check_uncommitted_changes(&components)?;
+        check_uncommitted_changes(&local_build_components)?;
     }
 
     // Check for HEAD-vs-tag gap before the tag checkout.
     if config.requested_ref.is_none() && !config.head && !config.skip_build {
-        check_unreleased_commits(&components, config)?;
+        check_unreleased_commits(&local_build_components, config)?;
     }
 
     // Checkout the deploy tag for each component (unless --head or --skip-build).
     let tag_checkouts = if config.requested_ref.is_none() && !config.head && !config.skip_build {
-        checkout_deploy_tags(&components, config.expected_version.as_deref())?
+        checkout_deploy_tags(&local_build_components, config.expected_version.as_deref())?
     } else {
         Vec::new()
     };
 
     // Verify expected version if --version was specified
     if let Some(ref expected) = config.expected_version {
-        if let Err(err) = verify_expected_version(&components, expected) {
+        if let Err(err) = verify_expected_version(&local_build_components, expected) {
             if !tag_checkouts.is_empty() {
                 restore_branches(&tag_checkouts);
             }
@@ -221,6 +257,7 @@ pub(super) fn deploy_components(
         base_path,
         &local_versions,
         &remote_versions,
+        &resolved_release_artifacts,
     ) {
         Ok(prepared) => prepared,
         Err(failures) => {
@@ -255,6 +292,11 @@ pub(super) fn deploy_components(
         let exact_ref_identity = exact_ref_identities.get(&component.id);
         let deployed_ref = if let Some(identity) = exact_ref_identity {
             Some(identity.requested_ref.clone())
+        } else if let Some(artifact) = resolved_release_artifacts.get(&component.id) {
+            Some(match artifact.commit.as_deref() {
+                Some(commit) => format!("{} ({commit})", artifact.tag),
+                None => artifact.tag.clone(),
+            })
         } else if let Some(checkout) = tag_checkouts
             .iter()
             .find(|c| c.component_id == component.id)
@@ -289,6 +331,8 @@ pub(super) fn deploy_components(
         build_provenance.built_from_ref = deployed_ref;
         if let Some(identity) = exact_ref_identity {
             build_provenance.built_from_commit = Some(identity.resolved_sha.clone());
+        } else if let Some(artifact) = resolved_release_artifacts.get(&component.id) {
+            build_provenance.built_from_commit = artifact.commit.clone();
         }
         result = result.with_build_provenance(build_provenance);
 
@@ -353,6 +397,7 @@ fn prepare_component_deployments(
     base_path: &str,
     local_versions: &HashMap<String, String>,
     remote_versions: &HashMap<String, String>,
+    release_artifacts: &HashMap<String, ReleaseArtifact>,
 ) -> std::result::Result<Vec<PreparedComponentDeploy>, Vec<ComponentDeployResult>> {
     let mut prepared_deployments = Vec::new();
     let mut failures = Vec::new();
@@ -374,6 +419,7 @@ fn prepare_component_deployments(
             project,
             local_versions.get(&component.id).cloned(),
             remote_versions.get(&component.id).cloned(),
+            release_artifacts.get(&component.id).cloned(),
         ) {
             Ok(prepared) => prepared_deployments.push(prepared),
             Err(result) => failures.push(result),
@@ -1206,6 +1252,7 @@ mod tests {
             "/srv/site",
             &HashMap::new(),
             &HashMap::new(),
+            &HashMap::new(),
         ) {
             Ok(_) => panic!("a later missing artifact must abort the whole deploy batch"),
             Err(failures) => failures,
@@ -1340,6 +1387,7 @@ mod tests {
             "/srv/site",
             &HashMap::new(),
             &HashMap::new(),
+            &HashMap::new(),
         )
         .expect("prepare exact-ref artifact");
 
@@ -1478,6 +1526,7 @@ mod tests {
                 "/srv/site",
                 &HashMap::new(),
                 &HashMap::new(),
+                &HashMap::new(),
             ) {
                 Ok(_) => panic!("failed build should abort preflight"),
                 Err(failures) => failures,