Release v2.0.0

scripts/prepare-release.ps1

@@ -8,6 +8,7 @@
   [switch]$PlanOnly,
   [switch]$Publish,
   [switch]$Resume,
+  [switch]$Replace,
   [switch]$Force
 )
 
@@ -373,12 +374,19 @@ function New-ReleaseDirectory {
   $releaseDir = Join-Path $root "proxywarden-v$TargetVersion"
 
   if (Test-Path -LiteralPath $releaseDir) {
-    if ($Publish -or -not $Force) { throw "Release directory already exists: $releaseDir. Use -Resume for a failed push, or choose another version." }
+    if (-not $Replace -and ($Publish -or -not $Force)) { throw "Release directory already exists: $releaseDir. Use -Version $TargetVersion -Replace to rebuild an unreleased version, or -Resume to retry its push." }
     if (-not (Test-IsSubPath -Parent $root -Child $releaseDir)) {
-      throw "Refusing to remove release directory outside OutputRoot: $releaseDir"
+      throw "Refusing to replace release directory outside OutputRoot: $releaseDir"
+    }
+    if ($Replace) {
+      $backupDir = "$releaseDir-replaced-$(Get-Date -Format 'yyyyMMdd-HHmmss')-$([guid]::NewGuid().ToString('N').Substring(0, 8))"
+      if (-not (Test-IsSubPath -Parent $root -Child $backupDir)) { throw 'Release backup must stay inside OutputRoot.' }
+      Move-Item -LiteralPath $releaseDir -Destination $backupDir
+      Write-Host "Предыдущая сборка сохранена: $backupDir"
+    } else {
+      Write-Host "Replacing existing release directory: $releaseDir"
+      Remove-Item -LiteralPath $releaseDir -Recurse -Force
     }
-    Write-Host "Replacing existing release directory: $releaseDir"
-    Remove-Item -LiteralPath $releaseDir -Recurse -Force
   }
 
   New-Item -ItemType Directory -Path (Join-Path $releaseDir "artifacts") -Force | Out-Null
@@ -654,16 +662,18 @@ function Get-ReleaseGitContext {
   Invoke-Git @('var', 'GIT_COMMITTER_IDENT') | Out-Null
   $remote = Invoke-Git @('remote', 'get-url', '--push', 'origin')
   $tag = "v$TargetVersion"
-  if (-not $Resume -and (Test-GitTag $tag)) { throw "Tag $tag already exists. Use -Version $TargetVersion -Resume for a failed push, or choose another version." }
-  $remoteTag = Invoke-Git @('ls-remote', '--tags', 'origin', "refs/tags/$tag", "refs/tags/$tag^{}")
-  if (-not $Resume -and $remoteTag) { throw "Remote tag $tag already exists. Choose another version." }
+  $localTag = if (Test-GitTag $tag) { Invoke-Git @('rev-parse', "refs/tags/$tag") } else { '' }
+  if (-not $Resume -and -not $Replace -and $localTag) { throw "Tag $tag already exists. Use -Version $TargetVersion -Replace to rebuild an unreleased version, -Resume to retry its push, or choose another version." }
+  $remoteTag = Invoke-Git @('ls-remote', '--refs', '--tags', 'origin', "refs/tags/$tag")
+  if (-not $Resume -and -not $Replace -and $remoteTag) { throw "Remote tag $tag already exists. Use -Version $TargetVersion -Replace to rebuild an unreleased version, or choose another version." }
+  $remoteTagId = if ($remoteTag) { ($remoteTag -split '\s+')[0] } else { '' }
   $remoteBranch = Invoke-Git @('ls-remote', '--heads', 'origin', "refs/heads/$branch")
   if ($remoteBranch) {
     Invoke-Git @('fetch', '--no-tags', 'origin', "refs/heads/$branch") | Out-Null
     & git merge-base --is-ancestor FETCH_HEAD HEAD
     if ($LASTEXITCODE -ne 0) { throw "The origin/$branch branch has changes not in HEAD. Integrate them before releasing; automatic merge is not performed." }
   }
-  return @{ branch = $branch; head = $headCommit; remote = $remote; tag = $tag }
+  return @{ branch = $branch; head = $headCommit; remote = $remote; tag = $tag; replace = [bool]$Replace; previousLocalTag = $localTag; previousRemoteTag = $remoteTagId }
 }
 
 function Complete-ReleaseGit {
@@ -692,13 +702,27 @@ function Push-Release {
       (Invoke-Git @('remote', 'get-url', '--push', 'origin')) -ne $Context.remote) {
     throw 'HEAD, branch or origin changed before push.'
   }
-  if (Test-GitTag $Context.tag) {
-    if ((Invoke-Git @('rev-parse', "$($Context.tag)^{commit}")) -ne $Commit) { throw 'Existing tag points to another commit.' }
+  $localTag = if (Test-GitTag $Context.tag) { Invoke-Git @('rev-parse', "refs/tags/$($Context.tag)") } else { '' }
+  if ($Context.replace -and $localTag -ne $Context.previousLocalTag -and
+      (-not $Resume -or -not $localTag -or (Invoke-Git @('rev-parse', "$($Context.tag)^{commit}")) -ne $Commit)) {
+    throw 'Local version tag changed during the release. Replacement refused.'
+  }
+  if ($localTag) {
+    if ((Invoke-Git @('rev-parse', "$($Context.tag)^{commit}")) -ne $Commit) {
+      if (-not $Context.replace) { throw 'Existing tag points to another commit.' }
+      Invoke-Git @('tag', '-a', '-f', $Context.tag, $Commit, '-m', "ProxyWarden $($Context.tag)") | Out-Null
+    }
   } else {
     Invoke-Git @('tag', '-a', $Context.tag, $Commit, '-m', "ProxyWarden $($Context.tag)") | Out-Null
   }
-  # One atomic push; never force or push unrelated tags. A failure leaves a resumable local release.
-  Invoke-Git @('push', '--atomic', 'origin', "${Commit}:refs/heads/$($Context.branch)", "refs/tags/$($Context.tag):refs/tags/$($Context.tag)") | Write-Host
+  $tagObject = Invoke-Git @('rev-parse', "refs/tags/$($Context.tag)")
+  $pushArgs = @('push', '--atomic')
+  if ($Context.replace) {
+    # Lease only this tag, never the branch. Keep the original expectation across Resume.
+    $pushArgs += "--force-with-lease=refs/tags/$($Context.tag):$($Context.previousRemoteTag)"
+  }
+  $pushArgs += @('origin', "${Commit}:refs/heads/$($Context.branch)", "${tagObject}:refs/tags/$($Context.tag)")
+  Invoke-Git $pushArgs | Write-Host
 }
 
 function Resume-Release {
@@ -723,6 +747,11 @@ function Resume-Release {
     if (-not (Test-IsSubPath $releaseDir $path) -or
         (Get-FileHash -LiteralPath $path -Algorithm SHA256).Hash -ne $artifact.sha256) { throw 'Release artifact checksum mismatch.' }
   }
+  if ($manifest.gitRelease.PSObject.Properties['replace'] -and $manifest.gitRelease.replace) {
+    $Context.replace = $true
+    $Context.previousLocalTag = $manifest.gitRelease.previousLocalTag
+    $Context.previousRemoteTag = $manifest.gitRelease.previousRemoteTag
+  }
   Push-Release -Context $Context -Commit $manifest.gitCommit
   $manifest.gitRelease.status = 'pushed'
   Write-JsonFile -Path $manifestPath -Value $manifest
@@ -813,6 +842,7 @@ function New-PlanResult {
       skipBuild = [bool]$SkipBuild
       publish = [bool]$Publish
       resume = [bool]$Resume
+      replace = [bool]$Replace
       git = [ordered]@{
         branch = Get-GitValue @('symbolic-ref', '--quiet', '--short', 'HEAD')
         remote = 'origin'
@@ -820,6 +850,8 @@ function New-PlanResult {
         includedChanges = Get-GitValue @('status', '--short')
         commitAfterSuccessfulBuild = [bool]$Publish
         atomicPush = [bool]$Publish
+        replaceOnlyVersionTagWithLease = [bool]$Replace
+        preservePreviousReleaseDirectory = [bool]$Replace
       }
       manifests = @(
         $PackageJsonPath,
@@ -845,6 +877,7 @@ try {
   Push-Location $RepoRoot
 
   if ($Resume -and (-not $Publish -or -not $Version -or $Bump)) { throw '-Resume requires -Publish -Version X.Y.Z.' }
+  if ($Replace -and (-not $Publish -or -not $Version -or $Bump -or $Resume)) { throw '-Replace requires -Publish -Version X.Y.Z and cannot be combined with -Resume or -Bump.' }
   if ($Version -and $Bump) { throw 'Use either -Version or -Bump.' }
   if ($Publish -and -not $PlanOnly -and ($SkipTests -or $SkipBuild -or $Force)) { throw 'A published release requires checks and a fresh build; SkipTests, SkipBuild and Force are not allowed.' }
   if ($Publish -and -not $PlanOnly -and -not $Resume) {
@@ -869,6 +902,7 @@ try {
   Write-Host ""
   Write-Host "Preparing ProxyWarden release $targetVersion..."
   Write-Host "Repository: $RepoRoot"
+  if ($Replace) { Write-Host "Пересборка невыпущенного релиза v$targetVersion с заменой тега. Предыдущая папка будет сохранена рядом." }
 
   $gitContext = $null
   if ($Publish) {
@@ -876,8 +910,8 @@ try {
     if ($Resume) { Resume-Release -TargetVersion $targetVersion -Context $gitContext; return }
   }
   $releasePath = Get-ReleasePath $targetVersion
-  if ((Test-Path -LiteralPath $releasePath) -and ($Publish -or -not $Force)) {
-    throw "Release directory already exists: $releasePath. Use -Resume for a failed push, or choose another version."
+  if ((Test-Path -LiteralPath $releasePath) -and -not $Replace -and ($Publish -or -not $Force)) {
+    throw "Release directory already exists: $releasePath. Use -Version $targetVersion -Replace to rebuild an unreleased version, or -Resume to retry its push."
   }
   if ($Publish -and (Test-IsSubPath $RepoRoot $releasePath)) {
     & git check-ignore --quiet -- (Join-Path $releasePath 'release-manifest.json')
@@ -907,7 +941,7 @@ try {
 
   if ($Publish) {
     $commit = Complete-ReleaseGit -Context $gitContext -SourceTree $sourceTree -TargetVersion $targetVersion
-    $gitRelease = [ordered]@{ branch = $gitContext.branch; remote = $gitContext.remote; tag = $gitContext.tag; sourceTree = $sourceTree; status = 'pending-push' }
+    $gitRelease = [ordered]@{ branch = $gitContext.branch; remote = $gitContext.remote; tag = $gitContext.tag; sourceTree = $sourceTree; status = 'pending-push'; replace = $gitContext.replace; previousLocalTag = $gitContext.previousLocalTag; previousRemoteTag = $gitContext.previousRemoteTag }
     Write-ReleaseMetadata -ReleaseDir $releaseDir -TargetVersion $targetVersion -Artifacts $artifacts -GitRelease $gitRelease
     try { Push-Release -Context $gitContext -Commit $commit }
     catch { throw "Push failed; local release is preserved. Retry: .\release.cmd -Version $targetVersion -Resume. $($_.Exception.Message)" }