fix(admin): refuse a published profile identity early; code profile 0.6.3; version 0.6.4

Cargo.toml

@@ -31,7 +31,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.6.3"
+version = "0.6.4"
 edition = "2021"
 rust-version = "1.91"
 license = "Apache-2.0"

build_system/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "capsem-builder"
-version = "0.6.3"
+version = "0.6.4"
 readme = "README.md"
 requires-python = ">=3.11"
 dependencies = [

build_system/tests/test_project_boundary.py

@@ -17,4 +17,4 @@ def test_editable_install_maps_the_direct_source_directory() -> None:
 
 
 def test_installed_distribution_uses_the_reserved_builder_name() -> None:
-    assert version("capsem-builder") == "0.6.3"
+    assert version("capsem-builder") == "0.6.4"

config/gate.toml

@@ -1099,7 +1099,7 @@ must_stay_below_lines = 3000
 [boundary.rust.oversized_line_counts]
 "crates/capsem-admin/src/assets_channel_render.rs" = 1719
 "crates/capsem-admin/src/assets_channel_validation.rs" = 1412
-"crates/capsem-admin/src/main.rs" = 2182
+"crates/capsem-admin/src/main.rs" = 2144
 "crates/capsem-admin/src/profile_images.rs" = 2188
 "crates/capsem-admin/src/release_graph.rs" = 1089
 "crates/capsem-admin/src/release_graph/tests.rs" = 1323

config/profiles/code/profile.toml

@@ -8,7 +8,7 @@ id = "code"
 name = "Code"
 description = "Optimized for coding and long-running agents."
 icon_svg = "<svg viewBox=\"0 0 16 16\" aria-hidden=\"true\"><path d=\"M5.5 3 1.5 8l4 5 1.2-1-3.2-4 3.2-4L5.5 3Zm5 0-1.2 1 3.2 4-3.2 4 1.2 1 4-5-4-5Z\"/></svg>"
-revision = "0.6.2"
+revision = "0.6.3"
 refresh_policy = "24h"
 # The runtimes this profile is the default for; the gateway publishes both in
 # GET /status so no client compiles a profile name into itself. Today one

crates/capsem-admin/src/main.rs

@@ -4,7 +4,6 @@ use std::{
     io::Read,
     path::{Path, PathBuf},
     process::{Command, Stdio},
-    thread,
 };
 
 use anyhow::{anyhow, Context, Result};
@@ -26,6 +25,7 @@ mod channel_bootstrap;
 mod manifest_generation;
 mod package_inspection;
 mod profile_images;
+mod release_github;
 #[allow(dead_code)]
 mod release_graph;
 mod source_commit;
@@ -37,6 +37,7 @@ use manifest_generation::*;
 use profile_images::*;
 
 use package_inspection::binary_files_from_artifacts;
+use release_github::{ensure_publication_identity_is_free, GhProfileWorkflowRunner, ProfileWorkflowRunner};
 use source_commit::SourceCommit;
 
 #[derive(Debug, Parser)]
@@ -629,47 +630,6 @@ struct ProfileWorkflowRun {
     conclusion: String,
 }
 
-trait ProfileWorkflowRunner {
-    fn run(&mut self, args: &[String]) -> Result<()>;
-    fn output(&mut self, args: &[String]) -> Result<String>;
-    fn wait_before_poll(&mut self);
-}
-
-struct GhProfileWorkflowRunner;
-
-impl ProfileWorkflowRunner for GhProfileWorkflowRunner {
-    fn run(&mut self, args: &[String]) -> Result<()> {
-        let status = Command::new("gh")
-            .args(args)
-            .status()
-            .with_context(|| format!("run gh {}", args.join(" ")))?;
-        if !status.success() {
-            return Err(anyhow!("gh {} failed with {}", args.join(" "), status));
-        }
-        Ok(())
-    }
-
-    fn output(&mut self, args: &[String]) -> Result<String> {
-        let output = Command::new("gh")
-            .args(args)
-            .output()
-            .with_context(|| format!("run gh {}", args.join(" ")))?;
-        if !output.status.success() {
-            return Err(anyhow!(
-                "gh {} failed with {}: {}",
-                args.join(" "),
-                output.status,
-                String::from_utf8_lossy(&output.stderr).trim()
-            ));
-        }
-        String::from_utf8(output.stdout).context("gh workflow listing was not UTF-8")
-    }
-
-    fn wait_before_poll(&mut self) {
-        thread::sleep(std::time::Duration::from_secs(2));
-    }
-}
-
 fn dispatch_profile_workflow<R: ProfileWorkflowRunner>(
     runner: &mut R,
     workflow: &str,
@@ -1376,6 +1336,8 @@ fn release_command(args: ReleaseArgs) -> Result<()> {
     let run_id = if args.dry_run {
         None
     } else {
+        let identity = &selection.publication_identity;
+        ensure_publication_identity_is_free(&mut GhProfileWorkflowRunner, identity, &args.source_commit)?;
         let dispatch_id = format!(
             "capsem-admin-{}-{}",
             std::process::id(),