KiCad - the KiCad Bridge

@@ -130,17 +130,56 @@ def promote(version: str, because: str):         print(f"REFUSING: public is already at {pub}; {version} would be a downgrade.\n"               "    To roll back, edit the public manifest deliberately - not through promote.")         return 1-    # The promote is a manifest edit: copy the insiders document to the public+    # The promote is a manifest edit: the document of the REQUESTED version becomes the public     # manifest. Same zip, same sha, same URL - only the pointer moves.+    #+    # Until 2026-09-21 this copied the CURRENT insiders document whatever version was asked for.+    # Every promotion before then was of the newest build, so nobody noticed; "promote 1.0.37" with+    # insiders at 1.0.39 put 1.0.39, a build the human had NOT approved, on the public tier and+    # printed "PROMOTED 1.0.37". So: take the insiders document only when it IS the requested+    # version, otherwise the manifest the build tool committed for that version; check the zip's+    # hash; and read the public manifest back after the push.     src = subprocess.run(["adom-wiki", "repo", "show", INSIDERS_REF, INSIDERS_PATH],                          capture_output=True, text=True, timeout=60)     doc = json.loads(src.stdout)+    if str(doc.get("version")) != version:+        doc = None+        log = subprocess.run(["git", "-C", ROOT, "log", "--format=%H", "--", PUBLIC_MANIFEST],+                             capture_output=True, text=True).stdout.split()+        for sha in log:+            shown = subprocess.run(["git", "-C", ROOT, "show", f"{sha}:{PUBLIC_MANIFEST}"],+                                   capture_output=True, text=True).stdout+            try:+                cand = json.loads(shown)+            except Exception:+                continue+            if str(cand.get("version")) == version:+                doc = cand+                break+        if doc is None:+            print(f"REFUSING: no manifest for {version} in this repo's history, and insiders is at {ins}.")+            return 1+    import hashlib+    try:+        req = urllib.request.Request(doc["url"], headers={"User-Agent": "adom-kicad-bridge promote"})+        with urllib.request.urlopen(req, timeout=180) as r:+            blob = r.read()+    except Exception as e:+        print(f"REFUSING: could not download {doc.get('url')}: {type(e).__name__}")+        return 1+    if hashlib.sha256(blob).hexdigest() != doc.get("sha256") or len(blob) != doc.get("size"):+        print(f"REFUSING: the zip at {doc['url']} does not match the manifest's sha256/size.")+        return 1     doc.pop("tier", None)     open(os.path.join(ROOT, PUBLIC_MANIFEST), "w", encoding="utf-8").write(         json.dumps(doc, indent=2) + "\n")     subprocess.run(["adom-wiki", "repo", "push", REF, "-m",                     f"promote {version} to public: {because}",                     "--files", PUBLIC_MANIFEST], check=False)+    now_public, _ = _tier_versions()+    if str(now_public) != version:+        print(f"PROMOTION DID NOT LAND: asked for {version}, the public manifest says {now_public}. Fix this now.")+        return 1     print(f"PROMOTED {version} to the public tier.")     print(f"  attestation: {because}")     print("  The zip did not change; the public manifest now points at what insiders ran.")