fix(site-publish): close split migration boundaries

Authored-By: OpenAI (GPT-5) <noreply@openai.com>

README.md

@@ -133,11 +133,11 @@ any route's mutable objects change.
 Mutable default and override partitions receive their final cache policy before
 the matching prefix-scoped stale deletion, so publication never exposes a
 provisional cache policy or a pointer to a missing immutable target.
-Generated Ingress annotations retain each bucket's prior route. When a move
+Generated Ingress annotations retain each artifact's prior route. When a move
 places that retired prefix inside the new sync scope, only its declared
 immutable subtrees are excluded; a current-file collision fails publication.
-The bucket-keyed history rejects a protected-to-public transition even when the
-artifact is renamed; publishing that artifact publicly requires a new bucket.
+The same history rejects a protected-to-public transition that reuses its
+protected bucket; publishing that artifact publicly requires a new bucket.
 
 Artifact input directories must be pairwise disjoint after filesystem
 resolution. Publication stops before build or upload if one contains another or

scripts/deploy.py

@@ -326,7 +326,7 @@ def render_site_manifests(site_name, action_dir, app_dir, manifests_dir, cfg):
 
 
 def previous_route_contracts(app_dir):
-    """Read bucket-keyed route history from generated Ingresses."""
+    """Read artifact route, access, and bucket history from generated Ingresses."""
     contracts = {}
     manifests = app_dir / "manifests"
     if not manifests.exists():
@@ -344,19 +344,19 @@ def previous_route_contracts(app_dir):
         if (not all(isinstance(value, str) for value in values)
                 or access not in {"public", "protected"} or not route_path.startswith("/")):
             raise RuntimeError(f"invalid site-publish route history in {path}")
-        if bucket in contracts:
-            raise RuntimeError(f"duplicate site-publish route history for bucket {bucket}")
-        contracts[bucket] = {"path": route_path, "access": access, "artifact": artifact}
+        if artifact in contracts:
+            raise RuntimeError(f"duplicate site-publish route history for artifact {artifact}")
+        contracts[artifact] = {"path": route_path, "access": access, "bucket": bucket}
     return contracts
 
 
 def validate_route_migrations(cfg, previous_contracts):
     artifacts = {artifact["name"]: artifact for artifact in cfg["artifacts"]}
     for route in cfg["routes"]:
+        previous = previous_contracts.get(route["artifact"])
         artifact = artifacts[route["artifact"]]
-        previous = previous_contracts.get(artifact["bucket"])
         if (previous and previous["access"] == "protected" and route["access"] == "public"
-        ):
+                and previous["bucket"] == artifact["bucket"]):
             raise RuntimeError(
                 f"artifact {route['artifact']} cannot become public while reusing protected "
                 f"bucket {artifact['bucket']}"
@@ -386,7 +386,7 @@ def deploy_static(site_name, site_dir, action_dir, token, cfg):
     for route in cfg["routes"]:
         s3_sync(
             artifact_by_name[route["artifact"]], route, site_dir, credential_env_names,
-            (previous_contracts.get(artifact_by_name[route["artifact"]]["bucket"]) or {}).get("path"),
+            (previous_contracts.get(route["artifact"]) or {}).get("path"),
         )
     if cfg["compatibility"]:
         ensure_bucket_aliases(site_name, cfg["aliases"], os.environ.get("GARAGE_ADMIN_TOKEN"))

templates/ingress.yaml.j2

@@ -4,9 +4,9 @@ metadata:
   name: {{ route.resource_name }}
   namespace: {{ namespace }}
   annotations:
-    site-publish.fritzlab.net/artifact: {{ route.artifact | tojson }}
-    site-publish.fritzlab.net/access: {{ route.access | tojson }}
-    site-publish.fritzlab.net/bucket: {{ route.artifact_config.bucket | tojson }}
+    site-publish.fritzlab.net/artifact: {{ route.artifact }}
+    site-publish.fritzlab.net/access: {{ route.access }}
+    site-publish.fritzlab.net/bucket: {{ route.artifact_config.bucket }}
     site-publish.fritzlab.net/route-path: {{ route.path | tojson }}
     traefik.ingress.kubernetes.io/router.middlewares: https-redirect@file,retry-upstream@file{% if route.access_middleware %},{{ route.access_middleware }}@file{% endif %}{% for m in route.middlewares %},{{ m }}@file{% endfor %}
 spec:

tests/test_contract.py

@@ -273,17 +273,6 @@ class GenerationTests(unittest.TestCase):
         self.assertNotIn("passhostheader", files["manifests/ingress-portal.yaml"])
         self.assertIn("baseline-dist.web.sjc001.fritzlab.net", files["manifests/service-distributions.yaml"])
 
-    def test_yaml_ambiguous_artifact_name_stays_a_string_annotation(self):
-        raw = fixture("split-site.yaml")
-        raw["artifacts"][0]["name"] = "yes"
-        raw["routes"][0]["artifact"] = "yes"
-        tmp, _, files = self.render(raw)
-        self.addCleanup(tmp.cleanup)
-        ingress = yaml.safe_load(files["manifests/ingress-portal.yaml"])
-        self.assertEqual(
-            "yes", ingress["metadata"]["annotations"]["site-publish.fritzlab.net/artifact"],
-        )
-
     def test_generation_is_deterministic_when_input_lists_are_reversed(self):
         raw = fixture("split-site.yaml")
         first_tmp, _, first = self.render(raw)
@@ -477,20 +466,13 @@ class PublishingTests(unittest.TestCase):
     def test_protected_bucket_cannot_become_public_across_deployments(self):
         cfg = normalize_site_config(fixture("split-site.yaml"), "baseline.fritzlab.net")
         previous = {
-            "baseline-dist": {
-                "path": "/dist", "access": "protected", "artifact": "old-name",
+            "distributions": {
+                "path": "/dist", "access": "protected", "bucket": "baseline-dist",
             }
         }
         with self.assertRaisesRegex(RuntimeError, "cannot become public while reusing protected"):
             deploy.validate_route_migrations(cfg, previous)
-        renamed = copy.deepcopy(cfg)
-        artifact = next(item for item in renamed["artifacts"] if item["name"] == "distributions")
-        artifact["name"] = "downloads"
-        route = next(item for item in renamed["routes"] if item["artifact"] == "distributions")
-        route["artifact"] = "downloads"
-        with self.assertRaisesRegex(RuntimeError, "cannot become public while reusing protected"):
-            deploy.validate_route_migrations(renamed, previous)
-        previous = {"retired-protected-bucket": previous["baseline-dist"]}
+        previous["distributions"]["bucket"] = "retired-protected-bucket"
         deploy.validate_route_migrations(cfg, previous)
 
     def test_later_route_immutable_failure_stops_all_mutable_publication(self):