From f8a1321309a8e30c17e4e0681c9cdc77a28b19e0 Mon Sep 17 00:00:00 2001
From: Johan LEROY <contact@johanleroy.fr>
Date: Thu, 18 Jun 2026 17:47:45 +0200
Subject: [PATCH] ci(release): publication idempotente + SBOM via
 upload-artifact@v3 (Gitea/GHES)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

upload-artifact@v4 (@actions/artifact v2+) n'est pas supporté par Gitea Actions.
Le publish skip désormais une version déjà publiée (re-push de tag sans échec).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/workflows/release.yml | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 86f46f1..936b6e8 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -35,15 +35,23 @@ jobs:
             exit 1
           fi
           echo "OK: tag $tag == version $pkg"
-      - run: npm publish -w @johanleroy/git-arboretum
+      # Publication idempotente : skip si la version est déjà sur le registre (utile quand un tag
+      # est re-poussé). Mapper le secret du registre sur NODE_AUTH_TOKEN lu par le .npmrc de setup-node.
+      - name: Publish (skip if already published)
+        run: |
+          pkg=$(node -p "require('./packages/server/package.json').version")
+          if npm view "@johanleroy/git-arboretum@$pkg" version >/dev/null 2>&1; then
+            echo "Version $pkg déjà publiée — publication ignorée."
+          else
+            npm publish -w @johanleroy/git-arboretum
+          fi
         env:
-          # Mapper le secret du registre (PAT Gitea write:package, ou le token auto
-          # GITEA_TOKEN s'il a ce scope) sur NODE_AUTH_TOKEN lu par le .npmrc de setup-node.
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
       # SBOM (transparence supply-chain entreprise) : généré pour le paquet publié et exposé en artefact.
+      # upload-artifact@v3 : Gitea Actions (GHES-like) ne supporte pas @v4 (@actions/artifact v2+).
       - name: Generate SBOM (CycloneDX)
         run: npx --yes @cyclonedx/cyclonedx-npm --omit dev --output-format JSON --output-file sbom.json -w @johanleroy/git-arboretum || npx --yes @cyclonedx/cyclonedx-npm --omit dev --output-format JSON --output-file sbom.json
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v3
         with:
           name: sbom
           path: sbom.json