Enforce monotonic household releases and staged APK integrity

docker/tv_release.py

@@ -37,16 +37,40 @@ def validate_inputs(version: str, code: int) -> str:
         raise ValueError(
             "Release source must be clean, including the version-code ledger"
         )
-    used = [
-        int(line.split()[0])
-        for line in (ROOT / "docker/tv-version-codes").read_text().splitlines()
-        if line and not line.startswith("#")
-    ]
+    commit = run("git", "rev-parse", "HEAD")
+    run(
+        "git",
+        "fetch",
+        "--no-tags",
+        "origin",
+        "refs/heads/main:refs/remotes/origin/main",
+    )
+    used = []
+    for reference in (commit, "refs/remotes/origin/main"):
+        if run("git", "ls-tree", "--name-only", reference, "docker/tv-version-codes"):
+            ledger = run("git", "show", f"{reference}:docker/tv-version-codes")
+            used.extend(
+                int(line.split()[0])
+                for line in ledger.splitlines()
+                if line and not line.startswith("#")
+            )
+    reservations = run(
+        "git",
+        "for-each-ref",
+        "--format=%(refname:strip=3)",
+        "refs/wolfskin-tv/version-codes/",
+    )
+    used.extend(int(value) for value in reservations.splitlines())
     if code <= max(used):
-        raise ValueError(f"VERSION_CODE must exceed ledger maximum {max(used)}")
+        raise ValueError(f"VERSION_CODE must exceed reserved maximum {max(used)}")
     if list((ROOT / "app/libs").glob("*.aar")):
         raise ValueError("Local AAR overrides are forbidden for household releases")
-    return run("git", "rev-parse", "HEAD")
+    return commit
+
+
+def reserve_code(code: int, commit: str) -> None:
+    """Keep a consumed code reserved even if its working-tree ledger append is discarded."""
+    run("git", "update-ref", f"refs/wolfskin-tv/version-codes/{code}", commit, "")
 
 
 def inspect_apk(path: Path, version: str, code: int, abi: str, proof: Path) -> int:
@@ -130,6 +154,7 @@ def release(version: str, code: int, output: Path, dry_run: bool) -> None:
     existing = run("git", "tag", "--list", tag)
     if existing and run("git", "rev-parse", f"{tag}^{{commit}}") != commit:
         raise ValueError("Source tag already identifies another commit")
+    reserve_code(code, commit)
     output.mkdir(parents=True)
     private = output / "private"
     private.mkdir(mode=0o700)