fix: make release deployment safely repeatable

scripts/build-test-bundle.mjs

@@ -25,7 +25,10 @@ if (gateway.protocol !== "https:" || gateway.pathname !== "/mcp" || gateway.sear
 }
 const artifactNames = [...new Set(Object.values(manifest.artifacts ?? {}).map((item) => basename(String(item.url))))];
 const members = ["SHA256SUMS", "install.md", "manifest.json", "manifest.sig", ...artifactNames];
-execFileSync("tar", ["-czf", bundle, "-C", releaseDir, ...members]);
+execFileSync("tar", [
+  "--sort=name", "--mtime=@0", "--owner=0", "--group=0", "--numeric-owner", "--format=ustar",
+  "-czf", bundle, "-C", releaseDir, ...members,
+]);
 const digest = createHash("sha256").update(readFileSync(bundle)).digest("hex");
 let prompt = readFileSync(resolve("distribution/agent-test.template.md"), "utf8");
 prompt = prompt.replaceAll("{{BUNDLE_URL}}", bundleUrl).replaceAll("{{BUNDLE_SHA256}}", digest);

scripts/release-tag-exists.mjs

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+
+const tag = process.argv[2];
+if (!tag) {
+  console.error("用法：release-tag-exists.mjs <tag>");
+  process.exit(2);
+}
+
+let body = "";
+for await (const chunk of process.stdin) body += chunk;
+
+let value;
+try {
+  value = JSON.parse(body);
+} catch {
+  console.error("无法解析 Gitea Release 列表 JSON");
+  process.exit(2);
+}
+
+const rows = Array.isArray(value)
+  ? value
+  : Array.isArray(value?.data)
+    ? value.data
+    : Array.isArray(value?.releases)
+      ? value.releases
+      : undefined;
+if (!rows) {
+  console.error("Gitea Release 列表 JSON 结构不受支持");
+  process.exit(2);
+}
+
+const found = rows.some((row) => row && typeof row === "object" && Object.entries(row).some(([key, entry]) => {
+  const normalizedKey = key.toLowerCase().replace(/[^a-z]/g, "");
+  return (normalizedKey === "tag" || normalizedKey === "tagname") && entry === tag;
+}));
+process.exit(found ? 0 : 1);