fix(site-publish): close split migration boundaries

Authored-By: OpenAI (GPT-5) <noreply@openai.com>

README.md

@@ -133,11 +133,14 @@ any route's mutable objects change.
 Mutable default and override partitions receive their final cache policy before
 the matching prefix-scoped stale deletion, so publication never exposes a
 provisional cache policy or a pointer to a missing immutable target.
-Generated Ingress annotations retain each bucket's prior route. When a move
+Generated Ingress annotations retain each bucket's prior route and immutable paths. When a move
 places that retired prefix inside the new sync scope, only its declared
 immutable subtrees are excluded; a current-file collision fails publication.
 The bucket-keyed history rejects a protected-to-public transition even when the
 artifact is renamed; publishing that artifact publicly requires a new bucket.
+Legacy single-surface is public for this downgrade check. Removing or renaming
+an immutable rule preserves its prior URLs; current mutable content at one of
+those paths is rejected instead of replacing it.
 
 Artifact input directories must be pairwise disjoint after filesystem
 resolution. Publication stops before build or upload if one contains another or

scripts/deploy.py

@@ -178,24 +178,29 @@ def publish_route_immutables(artifact, route, site_dir, credential_env_names=Non
             publish_immutable_rule(artifact, route, rule, html_dir, aws_env)
 
 
-def retired_immutable_filters(artifact, route, html_dir, previous_path):
+def retired_immutable_filters(artifact, route, html_dir, previous_contract):
     """Protect immutable keys only when an old route falls inside the new scope."""
-    if not previous_path or previous_path == route["path"]:
+    if not previous_contract:
         return []
     current_prefix = route["path"].strip("/")
-    previous_prefix = previous_path.strip("/")
+    previous_prefix = previous_contract["path"].strip("/")
     if current_prefix:
         marker = f"{current_prefix}/"
-        if not previous_prefix.startswith(marker):
+        if previous_prefix == current_prefix:
+            previous_prefix = ""
+        elif not previous_prefix.startswith(marker):
             return []
-        previous_prefix = previous_prefix[len(marker):]
+        else:
+            previous_prefix = previous_prefix[len(marker):]
     filters = []
-    for rule in artifact["cache_rules"]:
+    current_immutable = {
-        if not _is_immutable(rule):
+        rule["path"] for rule in artifact["cache_rules"] if _is_immutable(rule)
-            continue
+    }
-        retired_path = "/".join(part for part in (previous_prefix, rule["path"]) if part)
+    for immutable_path in previous_contract["immutable_paths"]:
+        retired_path = "/".join(part for part in (previous_prefix, immutable_path) if part)
         collision = html_dir / retired_path
-        if collision.exists() and any(path.is_file() for path in collision.rglob("*")):
+        if (immutable_path not in current_immutable and collision.exists()
+                and any(path.is_file() for path in collision.rglob("*"))):
             raise RuntimeError(
                 f"current artifact collides with retired immutable partition: {retired_path}"
             )
@@ -203,7 +208,7 @@ def retired_immutable_filters(artifact, route, html_dir, previous_path):
     return filters
 
 
-def s3_sync(artifact, route, site_dir, credential_env_names=None, previous_path=None):
+def s3_sync(artifact, route, site_dir, credential_env_names=None, previous_contract=None):
     endpoint = artifact["s3_endpoint"]
     html_dir = site_dir / artifact["build_dir"]
     aws_env = publication_aws_env(artifact, credential_env_names)
@@ -231,7 +236,7 @@ def s3_sync(artifact, route, site_dir, credential_env_names=None, previous_path=
     # so a fresh upload always carries the right MIME type.
     specific_paths = [rule["path"] for rule in artifact["cache_rules"] if rule["path"]]
     default_filters = [arg for path in specific_paths for arg in ("--exclude", f"{path}/*")]
-    retired_filters = retired_immutable_filters(artifact, route, html_dir, previous_path)
+    retired_filters = retired_immutable_filters(artifact, route, html_dir, previous_contract)
     run(["aws", "--endpoint-url", endpoint, "s3", "cp", f"{html_dir}/", destination,
          "--recursive", "--only-show-errors", "--cache-control", default_cache,
          *default_filters, *retired_filters, *exclude_args], env=aws_env)
@@ -312,7 +317,13 @@ def render_site_manifests(site_name, action_dir, app_dir, manifests_dir, cfg):
     for route in cfg["routes"]:
         artifact = artifact_by_name[route["artifact"]]
         resource_name = k8s_name(site_name) if cfg["compatibility"] else f"{k8s_name(site_name)}-{route['name']}"
-        routes.append({**route, "resource_name": resource_name, "artifact_config": artifact})
+        immutable_paths = [
+            rule["path"] for rule in artifact["cache_rules"] if _is_immutable(rule)
+        ]
+        routes.append({
+            **route, "resource_name": resource_name, "artifact_config": artifact,
+            "immutable_paths_json": json.dumps(immutable_paths, separators=(",", ":")),
+        })
     template_vars = {
         "site": site_name,
         "site_k8s": k8s_name(site_name),
@@ -337,16 +348,26 @@ def previous_route_contracts(app_dir):
         artifact = annotations.get("site-publish.fritzlab.net/artifact")
         access = annotations.get("site-publish.fritzlab.net/access")
         bucket = annotations.get("site-publish.fritzlab.net/bucket")
+        immutable_paths_json = annotations.get("site-publish.fritzlab.net/immutable-paths")
         route_path = annotations.get("site-publish.fritzlab.net/route-path")
-        values = (artifact, access, bucket, route_path)
+        values = (artifact, access, bucket, immutable_paths_json, route_path)
         if all(value is None for value in values):
             continue
         if (not all(isinstance(value, str) for value in values)
                 or access not in {"public", "protected"} or not route_path.startswith("/")):
             raise RuntimeError(f"invalid site-publish route history in {path}")
+        try:
+            immutable_paths = json.loads(immutable_paths_json)
+        except json.JSONDecodeError as exc:
+            raise RuntimeError(f"invalid site-publish route history in {path}") from exc
+        if not isinstance(immutable_paths, list) or any(not isinstance(item, str) for item in immutable_paths):
+            raise RuntimeError(f"invalid site-publish route history in {path}")
         if bucket in contracts:
             raise RuntimeError(f"duplicate site-publish route history for bucket {bucket}")
-        contracts[bucket] = {"path": route_path, "access": access, "artifact": artifact}
+        contracts[bucket] = {
+            "path": route_path, "access": access, "artifact": artifact,
+            "immutable_paths": immutable_paths,
+        }
     return contracts
 
 
@@ -355,7 +376,8 @@ def validate_route_migrations(cfg, previous_contracts):
     for route in cfg["routes"]:
         artifact = artifacts[route["artifact"]]
         previous = previous_contracts.get(artifact["bucket"])
-        if (previous and previous["access"] == "protected" and route["access"] == "public"
+        if (previous and previous["access"] == "protected"
+                and route["access"] in {"public", "legacy"}
         ):
             raise RuntimeError(
                 f"artifact {route['artifact']} cannot become public while reusing protected "
@@ -386,7 +408,7 @@ def deploy_static(site_name, site_dir, action_dir, token, cfg):
     for route in cfg["routes"]:
         s3_sync(
             artifact_by_name[route["artifact"]], route, site_dir, credential_env_names,
-            (previous_contracts.get(artifact_by_name[route["artifact"]]["bucket"]) or {}).get("path"),
+            previous_contracts.get(artifact_by_name[route["artifact"]]["bucket"]),
         )
     if cfg["compatibility"]:
         ensure_bucket_aliases(site_name, cfg["aliases"], os.environ.get("GARAGE_ADMIN_TOKEN"))

templates/ingress.yaml.j2

@@ -8,6 +8,7 @@ metadata:
     site-publish.fritzlab.net/artifact: {{ route.artifact | tojson }}
     site-publish.fritzlab.net/access: {{ route.access | tojson }}
     site-publish.fritzlab.net/bucket: {{ route.artifact_config.bucket | tojson }}
+    site-publish.fritzlab.net/immutable-paths: {{ route.immutable_paths_json | tojson }}
     site-publish.fritzlab.net/route-path: {{ route.path | tojson }}
 {%- endif %}
     traefik.ingress.kubernetes.io/router.middlewares: https-redirect@file,retry-upstream@file{% if route.access_middleware %},{{ route.access_middleware }}@file{% endif %}{% for m in route.middlewares %},{{ m }}@file{% endfor %}

tests/test_contract.py

@@ -471,7 +471,10 @@ class PublishingTests(unittest.TestCase):
             }, clear=False), patch.object(
                 deploy, "run", side_effect=lambda command, **_: commands.append(command)
             ):
-                deploy.s3_sync(artifact, route, root, previous_path="/foo")
+                deploy.s3_sync(artifact, route, root, previous_contract={
+                    "path": "/foo", "access": "public", "artifact": "distributions",
+                    "immutable_paths": ["releases"],
+                })
             rendered = [" ".join(command) for command in commands]
             self.assertTrue(all("foo/releases/*" in command for command in rendered[:2]))
             self.assertTrue(all("*/releases/*" not in command for command in rendered))
@@ -481,6 +484,7 @@ class PublishingTests(unittest.TestCase):
         previous = {
             "baseline-dist": {
                 "path": "/dist", "access": "protected", "artifact": "old-name",
+                "immutable_paths": ["releases"],
             }
         }
         with self.assertRaisesRegex(RuntimeError, "cannot become public while reusing protected"):
@@ -495,6 +499,39 @@ class PublishingTests(unittest.TestCase):
         previous = {"retired-protected-bucket": previous["baseline-dist"]}
         deploy.validate_route_migrations(cfg, previous)
 
+    def test_protected_split_bucket_cannot_become_legacy_public(self):
+        cfg = normalize_site_config(fixture("legacy-site.yaml"), "baseline.fritzlab.net")
+        previous = {
+            "baseline.fritzlab.net": {
+                "path": "/portal", "access": "protected", "artifact": "portal",
+                "immutable_paths": [],
+            }
+        }
+        with self.assertRaisesRegex(RuntimeError, "cannot become public while reusing protected"):
+            deploy.validate_route_migrations(cfg, previous)
+
+    def test_removed_immutable_rule_preserves_prior_keys(self):
+        cfg = normalize_site_config(fixture("split-site.yaml"), "baseline.fritzlab.net")
+        artifact = next(item for item in cfg["artifacts"] if item["name"] == "distributions")
+        artifact["cache_rules"] = [
+            rule for rule in artifact["cache_rules"] if rule["path"] != "releases"
+        ]
+        route = next(item for item in cfg["routes"] if item["artifact"] == "distributions")
+        with tempfile.TemporaryDirectory() as tmp:
+            html = Path(tmp)
+            filters = deploy.retired_immutable_filters(artifact, route, html, {
+                "path": "/dist", "access": "public", "artifact": "distributions",
+                "immutable_paths": ["releases"],
+            })
+            self.assertEqual(["--exclude", "releases/*"], filters)
+            (html / "releases").mkdir()
+            (html / "releases" / "replacement.js").write_text("mutable")
+            with self.assertRaisesRegex(RuntimeError, "collides with retired immutable"):
+                deploy.retired_immutable_filters(artifact, route, html, {
+                    "path": "/dist", "access": "public", "artifact": "distributions",
+                    "immutable_paths": ["releases"],
+                })
+
     def test_later_route_immutable_failure_stops_all_mutable_publication(self):
         cfg = normalize_site_config(fixture("split-site.yaml"), "baseline.fritzlab.net")
         with tempfile.TemporaryDirectory() as tmp: