fix(release): repair Snap uploads and retry published releases (#1691)

* fix(release): allow Snapcraft scratch extraction and retry public releases

* test(release): detect local Snap permission test prerequisites

.github/workflows/publish-snap.yaml

@@ -1,6 +1,12 @@
 name: Publish Snap after public release
 
 on:
+    workflow_dispatch:
+        inputs:
+            tag:
+                description: Existing public stable release tag to retry (for example v0.24.0)
+                required: true
+                type: string
     release:
         types:
             - published
@@ -11,7 +17,7 @@ permissions:
 jobs:
     verify-snap:
         name: Verify public-release Snap assets
-        if: ${{ startsWith(github.event.release.tag_name, 'v') && github.event.release.draft == false }}
+        if: ${{ (github.event_name == 'release' && startsWith(github.event.release.tag_name, 'v') && github.event.release.draft == false) || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/master') }}
         runs-on: ubuntu-latest
         timeout-minutes: 45
         env:
@@ -20,10 +26,34 @@ jobs:
             receipt-sha256: ${{ steps.bind-transfer.outputs.receipt-sha256 }}
 
         steps:
+            - name: Resolve public release
+              id: resolve-release
+              shell: bash
+              env:
+                  GH_TOKEN: ${{ github.token }}
+                  REQUESTED_TAG: ${{ inputs.tag || github.event.release.tag_name }}
+                  EVENT_RELEASE_ID: ${{ github.event.release.id }}
+              run: |
+                  set -euo pipefail
+
+                  [[ "${REQUESTED_TAG}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]
+                  RELEASE_JSON="${RUNNER_TEMP}/snap-public-release.json"
+                  gh api "repos/${GITHUB_REPOSITORY}/releases/tags/${REQUESTED_TAG}" > "${RELEASE_JSON}"
+                  /usr/bin/jq --exit-status --arg tag "${REQUESTED_TAG}" '
+                      .tag_name == $tag and .draft == false and .prerelease == false and
+                      (.published_at | type == "string" and length > 0) and
+                      (.id | type == "number" and . > 0 and . == floor)
+                  ' "${RELEASE_JSON}" > /dev/null
+                  RELEASE_ID="$(/usr/bin/jq --raw-output '.id' "${RELEASE_JSON}")"
+                  if [[ -n "${EVENT_RELEASE_ID}" ]]; then
+                      test "${RELEASE_ID}" = "${EVENT_RELEASE_ID}"
+                  fi
+                  printf 'tag=%s\nrelease-id=%s\n' "${REQUESTED_TAG}" "${RELEASE_ID}" >> "${GITHUB_OUTPUT}"
+
             - name: Checkout released tooling
               uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
               with:
-                  ref: ${{ github.event.release.tag_name }}
+                  ref: refs/tags/${{ steps.resolve-release.outputs.tag }}
                   persist-credentials: false
 
             - name: Install release source verifier
@@ -41,13 +71,14 @@ jobs:
               shell: bash
               env:
                   GH_TOKEN: ${{ github.token }}
+                  RELEASE_ID: ${{ steps.resolve-release.outputs.release-id }}
               run: |
                   set -euo pipefail
 
                   gh api \
                       --paginate \
                       --slurp \
-                      "repos/${GITHUB_REPOSITORY}/releases/${{ github.event.release.id }}/assets?per_page=100" \
+                      "repos/${GITHUB_REPOSITORY}/releases/${RELEASE_ID}/assets?per_page=100" \
                       > "${RUNNER_TEMP}/snap-release-assets.json"
                   node tools/packaging/release-snap-assets.cjs select \
                       --assets-json "${RUNNER_TEMP}/snap-release-assets.json" \
@@ -133,7 +164,7 @@ jobs:
     publish-snap:
         name: Publish verified public-release Snap to edge
         needs: verify-snap
-        if: ${{ needs.verify-snap.result == 'success' && startsWith(github.event.release.tag_name, 'v') && github.event.release.draft == false }}
+        if: ${{ needs.verify-snap.result == 'success' }}
         runs-on: ubuntu-latest
         timeout-minutes: 20
 
@@ -238,6 +269,26 @@ jobs:
                   sudo find "${SEALED_ASSET_DIRECTORY}" -type f -exec chmod 0444 {} +
                   sudo chmod 0555 "${SEALED_ASSET_PARENT}"
 
+            - name: Prepare Snapcraft upload workspace
+              shell: bash
+              run: |
+                  set -euo pipefail
+
+                  VERIFIED_ASSET_DIRECTORY="/var/lib/iptvnator-snap-release/assets"
+                  UPLOAD_DIRECTORY="/var/lib/iptvnator-snap-upload"
+                  sudo test ! -e "${UPLOAD_DIRECTORY}"
+                  sudo install -d -m 0700 -o root -g root "${UPLOAD_DIRECTORY}"
+                  shopt -s nullglob dotglob
+                  SNAP_FILES=("${VERIFIED_ASSET_DIRECTORY}"/*.snap)
+                  test "${#SNAP_FILES[@]}" -gt 0
+                  for SNAP_FILE in "${SNAP_FILES[@]}"; do
+                      sudo ln -- "${SNAP_FILE}" "${UPLOAD_DIRECTORY}/${SNAP_FILE##*/}"
+                  done
+                  # Snapcraft extracts metadata beside the input file. Root-owned
+                  # hard links remain read-only; the sticky bit prevents replacement.
+                  sudo chmod 1777 "${UPLOAD_DIRECTORY}"
+                  shopt -u nullglob dotglob
+
             - name: Install Snapcraft
               shell: bash
               run: |
@@ -253,6 +304,7 @@ jobs:
                   set -euo pipefail
 
                   VERIFIED_ASSET_DIRECTORY="/var/lib/iptvnator-snap-release/assets"
+                  UPLOAD_DIRECTORY="/var/lib/iptvnator-snap-upload"
                   STORE_CREDENTIALS="${SNAPCRAFT_STORE_CREDENTIALS}"
                   unset SNAPCRAFT_STORE_CREDENTIALS
                   shopt -s nullglob dotglob
@@ -263,7 +315,7 @@ jobs:
                       echo "Publishing public release asset: ${SNAP_NAME}"
                       # Candidate/stable promotion is manual after installed-Snap frame-copy and missing-runtime fallback smoke.
                       # GitHub Actions never promotes automatically.
-                      SNAPCRAFT_STORE_CREDENTIALS="${STORE_CREDENTIALS}" /snap/bin/snapcraft upload --release=edge "${SNAP_FILE}"
+                      SNAPCRAFT_STORE_CREDENTIALS="${STORE_CREDENTIALS}" /snap/bin/snapcraft upload --release=edge "${UPLOAD_DIRECTORY}/${SNAP_NAME}"
                   done
                   unset STORE_CREDENTIALS
                   shopt -u nullglob dotglob