ci(binaries): never replace an archive that is already published

.github/workflows/binaries.yml

@@ -181,14 +181,32 @@ jobs:
           echo "ARCHIVE=$archive" >> "$GITHUB_ENV"
           echo "ALIAS=$alias" >> "$GITHUB_ENV"
 
+      # Uploaded only if absent, never clobbered. A published archive is
+      # immutable: Rust builds are not bit-for-bit reproducible, so rebuilding
+      # a tag produces a *different* archive with a different checksum, and
+      # replacing it would invalidate every checksum anyone had recorded --
+      # including the one in the Homebrew formula, and including one somebody
+      # wrote down to verify a download with.
+      #
+      # This workflow exists to be re-run, so that had to be settled: a re-run
+      # now fills in what is missing and leaves what is there alone, which is
+      # exactly the case it was built for. Replacing a genuinely corrupt asset
+      # means deleting it first, and that friction is the point.
       - name: Attach to the release
         shell: bash
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          gh release upload "$TAG" \
-            "$ARCHIVE" "${ARCHIVE}.sha256" \
-            "$ALIAS" "${ALIAS}.sha256" --clobber
+          set -euo pipefail
+          published="$(gh release view "$TAG" --json assets --jq '.assets[].name')"
+          for file in "$ARCHIVE" "${ARCHIVE}.sha256" "$ALIAS" "${ALIAS}.sha256"; do
+            if printf '%s\n' "$published" | grep -qxF "$file"; then
+              echo "already published, left alone: $file"
+            else
+              gh release upload "$TAG" "$file"
+              echo "uploaded: $file"
+            fi
+          done
 
   # Regenerate the Homebrew formula from the archives just uploaded.
   #

CHANGELOG.md

@@ -22,6 +22,20 @@ listed under a **Changed** or **Removed** heading.
 
 ### Fixed
 
+- **A release's archives are never replaced once published.** The upload
+  clobbered, so re-running the artifact build for an existing tag rebuilt and
+  overwrote them — and Rust builds are not bit-for-bit reproducible, so the
+  replacements had different checksums. Every checksum anyone had recorded
+  became wrong, including the Homebrew formula's and including one somebody
+  had written down to verify a download with.
+
+  Found by re-running the workflow: the formula job reported "tap updated"
+  where nothing should have changed, and the diff was four checksums.
+
+  A re-run now fills in what is missing and leaves what is there alone, which
+  is the case the workflow was built for. Replacing a genuinely corrupt asset
+  means deleting it first, and that friction is deliberate.
+
 - **The Intel-Mac binary is cross-compiled from Apple silicon** rather than
   built on a `macos-13` runner. Xcode's toolchain and SDK are universal, so an
   arm64 Mac produces an x86-64 binary with nothing but `rustup target add` —