Guard README-only post-release publication without moving signed tags

deployment/geranas/nginx.conf.in

@@ -16,6 +16,10 @@ http {
     uwsgi_temp_path /run/framebridge-publisher/uwsgi;
     scgi_temp_path /run/framebridge-publisher/scgi;
     map $http_upgrade $connection_upgrade { default upgrade; '' close; }
+    map "$host|$http_x_forwarded_proto" $framebridge_https_redirect {
+        default 0;
+        "framebridge.betancourt.one|http" 1;
+    }
     server {
         listen 127.0.0.1:8088;
         listen @GERANAS_LAN_IP@:8088;
@@ -23,6 +27,7 @@ http {
         allow @CLOUD_LAN_IP@;
         deny all;
         server_name framebridge.betancourt.one;
+        if ($framebridge_https_redirect) { return 301 https://framebridge.betancourt.one$request_uri; }
         root /run/framebridge-publisher/site;
         index index.html;
         autoindex off;
@@ -46,6 +51,7 @@ http {
             proxy_set_header X-Forwarded-Proto https;
             proxy_read_timeout 120s;
             proxy_request_buffering off;
+            proxy_buffering off;
             add_header X-Content-Type-Options nosniff always;
             add_header Referrer-Policy strict-origin-when-cross-origin always;
         }

tools/publish_gitea.py

@@ -50,12 +50,26 @@ def check_bundle(args, source):
     resolved = run(["git", "--git-dir", source, "rev-parse", args.tag + "^{}"]).stdout.decode().strip()
     require(resolved == args.commit, "Release tag does not point to reviewed commit")
     refs = remote_refs()
-    require(refs.get("refs/heads/main") == args.old_commit, "Canonical main changed; review before publishing")
-    require("refs/tags/" + args.tag not in refs, "Release tag already exists; never overwrite")
+    if args.ops_update_from:
+        require(args.ops_branch and re.fullmatch(r"[a-f0-9]{40}", args.ops_update_from), "Explicit operations update guard required")
+        require(refs.get("refs/heads/main") == args.commit, "Published release main changed")
+        require(refs.get("refs/tags/" + args.tag + "^{}") == args.commit, "Published signed tag changed")
+        require(refs.get("refs/heads/" + args.ops_branch) == args.ops_update_from, "Operations branch changed")
+        run(["git", "--git-dir", source, "merge-base", "--is-ancestor", args.ops_update_from, "refs/heads/" + args.ops_branch])
+    else:
+        require(refs.get("refs/heads/main") == args.old_commit, "Canonical main changed; review before publishing")
+        require("refs/tags/" + args.tag not in refs, "Release tag already exists; never overwrite")
     if args.ops_branch:
         require(re.fullmatch(r"ops/[a-z0-9][a-z0-9/-]*", args.ops_branch), "Invalid operations branch")
-        require("refs/heads/" + args.ops_branch not in refs, "Operations branch already exists; do not overwrite")
+        if not args.ops_update_from:
+            require("refs/heads/" + args.ops_branch not in refs, "Operations branch already exists; do not overwrite")
         run(["git", "--git-dir", source, "merge-base", "--is-ancestor", args.commit, "refs/heads/" + args.ops_branch])
+    if args.docs_branch:
+        require(args.ops_update_from and re.fullmatch(r"docs/[a-z0-9][a-z0-9/-]*", args.docs_branch), "Explicit guarded documentation update required")
+        docs_ref = "refs/heads/" + args.docs_branch
+        run(["git", "--git-dir", source, "merge-base", "--is-ancestor", args.commit, docs_ref])
+        changed = run(["git", "--git-dir", source, "diff", "--name-only", args.commit, docs_ref]).stdout.decode().splitlines()
+        require(changed == ["README.md"], "Documentation update must change README.md only")
     return refs
 
 def record(path, state):
@@ -132,7 +146,8 @@ def publish(args):
         before = check_bundle(args, source)
         state = {"schema": 1, "repository": "gerardo/framebridge", "old_commit": args.old_commit,
                  "commit": args.commit, "tag": args.tag, "bundle_sha256": args.bundle_sha256,
-                 "phase": "CHECKED", "push_performed": False, "token_revoked": False}
+                 "phase": "CHECKED", "push_performed": False, "token_revoked": False,
+                 "ops_update_from": args.ops_update_from}
         if not args.apply:
             print(json.dumps(state, sort_keys=True))
             return
@@ -169,7 +184,9 @@ def publish(args):
             server, stop, thread, client = askpass_server(directory, token)
             env = dict(os.environ, GIT_ASKPASS=str(client), GIT_TERMINAL_PROMPT="0", LC_ALL="C")
             # No force flag. The normal receive-pack checks and Gitea hooks run.
-            refspecs = [args.commit + ":refs/heads/main", "refs/tags/" + args.tag]
+            refspecs = [] if args.ops_update_from else [args.commit + ":refs/heads/main", "refs/tags/" + args.tag]
+            if args.docs_branch:
+                refspecs.append("refs/heads/" + args.docs_branch + ":refs/heads/main")
             if args.ops_branch:
                 refspecs.append("refs/heads/" + args.ops_branch + ":refs/heads/" + args.ops_branch)
             run(["git", "--git-dir", source, "-c", "credential.helper=", "push", "--atomic",
@@ -177,7 +194,11 @@ def publish(args):
             state["push_performed"] = True
             state["phase"] = "PUSH_COMPLETED"
             after = remote_refs()
-            require(after.get("refs/heads/main") == args.commit, "Main ref readback mismatch")
+            expected_main = (run(["git", "--git-dir", source, "rev-parse", "refs/heads/" + args.docs_branch]).stdout.decode().strip()
+                             if args.docs_branch else args.commit)
+            require(after.get("refs/heads/main") == expected_main, "Main ref readback mismatch")
+            state["main_commit"] = expected_main
+            state["documentation_only_main_update"] = bool(args.docs_branch)
             resolved_tag = after.get("refs/tags/" + args.tag + "^{}", after.get("refs/tags/" + args.tag))
             require(resolved_tag == args.commit, "Release tag readback mismatch")
             if args.ops_branch:
@@ -232,6 +253,8 @@ def main():
     parser.add_argument("--old-commit", required=True)
     parser.add_argument("--tag", required=True)
     parser.add_argument("--ops-branch", help="Publish one new operations branch atomically with the release")
+    parser.add_argument("--ops-update-from", help="Fast-forward only operations from this exact old commit; preserve published main and tag")
+    parser.add_argument("--docs-branch", help="Include one README-only fast-forward while preserving the signed release tag")
     parser.add_argument("--journal", type=Path)
     parser.add_argument("--apply", action="store_true")
     args = parser.parse_args()