fix(release): refresh published XBPS assets

.gitea/workflows/release.yml

@@ -330,7 +330,8 @@ jobs:
             "https://git.bongbetic.com/api/v1/repos/xavierk/Fenris/releases/tags/v${VERSION}")
           RELEASE_ID=$(printf '%s' "${RELEASE_JSON}" \
             | python3 -c "import sys,json; print(json.load(sys.stdin)['id'])")
-          # Attach deb, rpm, clearsigned checksums, and XBPS artifacts once.
+          PUBLISH_XBPS="${{ steps.formats.outputs.xbps_published }}"
+          # Attach package artifacts; refresh XBPS assets after publication.
           ARTIFACTS=(
             "dist/fenris_${VERSION}_amd64.deb"
             "dist/fenris-${VERSION}-1.x86_64.rpm"
@@ -348,14 +349,22 @@ jobs:
           fi
           for FILE in "${ARTIFACTS[@]}"; do
             ASSET_NAME="${FILE##*/}"
-            if python3 -c 'import json,sys; name=sys.argv[1]; sys.exit(0 if any(a.get("name") == name for a in json.load(sys.stdin).get("assets", [])) else 1)' "${ASSET_NAME}" <<<"${RELEASE_JSON}"; then
-              echo "${ASSET_NAME}: already attached"
-            else
-              curl --fail --silent --show-error -X POST \
-                -H "Authorization: token ${GITEA_PUBLISH_TOKEN}" \
-                -F "attachment=@${FILE}" \
-                "https://git.bongbetic.com/api/v1/repos/xavierk/Fenris/releases/${RELEASE_ID}/assets"
+            EXISTING_ASSET_ID=$(python3 -c 'import json,sys; name=sys.argv[1]; print(next((a["id"] for a in json.load(sys.stdin).get("assets", []) if a.get("name") == name), ""))' \
+              "${ASSET_NAME}" <<<"${RELEASE_JSON}")
+            if [ -n "${EXISTING_ASSET_ID}" ]; then
+              if [ "${PUBLISH_XBPS}" = "true" ] && [[ "${ASSET_NAME}" = "${XBPS_FILE}" || "${ASSET_NAME}" = "${XBPS_FILE}.sig2" ]]; then
+                curl --fail --silent --show-error -X DELETE \
+                  -H "Authorization: token ${GITEA_PUBLISH_TOKEN}" \
+                  "https://git.bongbetic.com/api/v1/repos/xavierk/Fenris/releases/${RELEASE_ID}/assets/${EXISTING_ASSET_ID}"
+              else
+                echo "${ASSET_NAME}: already attached"
+                continue
+              fi
             fi
+            curl --fail --silent --show-error -X POST \
+              -H "Authorization: token ${GITEA_PUBLISH_TOKEN}" \
+              -F "attachment=@${FILE}" \
+              "https://git.bongbetic.com/api/v1/repos/xavierk/Fenris/releases/${RELEASE_ID}/assets"
           done
 
       - name: Remove XBPS signing key