Review found the hole in the first commit's claim. render_site_manifests
advances the stored route contract for every route in site.yaml, and
`access` there is a replacement, not a union the way immutable_paths is.
So a catalogue-only publish could write `protected` for the distributions
bucket that nothing published — and validate_route_migrations then
refuses to put that bucket back public. Unpublished intent became an
irreversible fact.
Reproduced from the repo's own fixture: after a whole publish the record
reads public; after a catalogue-only publish with the route flipped it
reads protected, with nothing written to baseline-dist, and reverting
fails with "artifact distributions cannot become public while reusing
protected bucket baseline-dist".
A scoped run now refuses before the first bucket is touched when an
unselected artifact's path, access or artifact name differs from what is
recorded, naming both contracts. It also refuses an unselected artifact
with no published history, which is the same defect at time zero. Publish
the artifact in the same run.
Three tests: the reviewer's flip scenario (and the same change published
in the same run, which proceeds), the no-history case, and one proving
deploy_static reaches the guard before publish_route_immutables,
reconcile_artifact_cors or s3_sync. Disabling the call site alone turns
the last one red.
The README sentence is narrowed to what the code actually guarantees, and
gains the CORS consequence: a scoped run holds no credential for the
other bucket, so a cors_origins change lands with that artifact's next
publish rather than on the merge that edits site.yaml.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UjQqc4qFmdpAWaYfy2Aypb
A repository whose artifacts ship on different cadences has no way to
publish one of them. Baseline needs it: every merge to main must put the
catalogue live in under five minutes, while `dist/` is content-addressed
and may only be written by a tag release. Today the action iterates
cfg["artifacts"] unconditionally, so the only lever is deleting the
distributions artifact from site.yaml — which changes the stored
publication contract and drives the route-retirement path.
The new `artifacts:` input names the subset this run builds and
publishes. Selection scopes the build, the immutable preflight, the CORS
reconcile, the S3 sync, and credential resolution. It deliberately does
not scope manifest rendering or the immutable-path history: those stay
whole, so a scoped run can never retire another artifact's route or
delete its bucket contents. An undeclared name fails before the first
bucket is touched; `enabled: false` refuses a selection because
decommissioning is whole-site.
Default is unchanged: no input publishes every declared artifact.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UjQqc4qFmdpAWaYfy2Aypb
