fi

evidence_dir="$RUNNER_TEMP/release-postpublish-evidence"

mkdir -p "$evidence_dir"

if ! gh_with_retry release download "$evidence_source_tag" --repo "$GITHUB_REPOSITORY" \

--pattern "$evidence_asset" --pattern "$evidence_checksum_asset" --dir "$evidence_dir"; then

gh_with_retry release download "$evidence_source_tag" --repo "$GITHUB_REPOSITORY" \

--pattern "$evidence_asset" --pattern "$evidence_checksum_asset" --dir "$evidence_dir" || true

evidence_path="$evidence_dir/$evidence_asset"

evidence_checksum_path="$evidence_dir/$evidence_checksum_asset"

if [[ ! -f "$evidence_path" || ! -f "$evidence_checksum_path" ]]; then

if [[ "$EVENT_NAME" == "push" ]]; then

echo "Stable closeout skipped: $evidence_source_tag predates immutable postpublish evidence." >&2

echo "should_closeout=false" >> "$GITHUB_OUTPUT"

echo "Stable closeout is required for $tag, but immutable postpublish evidence from $evidence_source_tag is missing." >&2

exit 1

fi

evidence_path="$evidence_dir/$evidence_asset"

if ! (

cd "$evidence_dir"

sha256sum --strict --status -c "$evidence_checksum_asset"

local asset_name="$2"

local existing_dir="$CLOSEOUT_DIR/existing-${asset_name}"

mkdir -p "$existing_dir"

if gh_with_retry release download "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" \

--pattern "$asset_name" --dir "$existing_dir"; then

gh_with_retry release download "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" \

--pattern "$asset_name" --dir "$existing_dir" || true

if [[ -f "$existing_dir/$asset_name" ]]; then

cmp --silent "$source_path" "$existing_dir/$asset_name" || {

echo "Existing release asset $asset_name differs from closeout evidence." >&2

exit 1