[M3gA-Mind]

Summary

Artifacts::publish for an older file version checks that the stored file is still the one that version recorded, because later versions can replace a file: it compares the stored file's size with the recorded size, and refuses with FileChanged when they differ or when the host has no file store to check. That branch had no test, so a refactor could drop it and share a changed file under an old version's name. This adds a test only.

Related issue

None.

API or behavior changes

None (tests only).

Validation

• rustfmt --edition 2021 --check on the new file
• cargo clippy --all-targets --all-features -- -D warnings: clean
• N/A: cargo build --all-targets --all-features: left to CI
• N/A: cargo test --all-features: only the new test ran locally (below); CI runs the suite

CARGO_INCREMENTAL=0 cargo test -p tiny-artifacts --all-features --test publish_file_changed

• As is: ok. 1 passed; 0 failed.
• With the FileChanged refusal disabled on purpose: FAILED. 0 passed; 1 failed (at the no-file-store refusal).
• With only the size comparison dropped (any stored file accepted): FAILED. 0 passed; 1 failed (at the replaced-file refusal).
• The source was restored after each break.

Tests

New tests/publish_file_changed.rs (separate file; tests/service.rs is already long). It creates a file artifact, revises it, then:

• publishes v1 while its stored file is unchanged (allowed);
• publishes v1 from a host with no file store (FileChanged);
• replaces the stored v1 file with bytes of a different length and publishes v1 (FileChanged);
• publishes the newest version (allowed).

The size-only compare is a known ceiling: a same-length replacement is not detected, because FileRef records no digest.

Documentation

Not needed (tests only).

Checklist

• The change is focused on one logical change
• No new #[allow(...)], #[ignore], or relaxed lints (the new file carries the same unwrap_used/expect_used allow as tests/service.rs)
• No secrets, tokens, or .env contents in the diff or the description

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 0198b8e4-147f-470e-b309-25f0b46e810b

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[tinysweeper]

Tiny Sweeper review

Reviewed head: 916f8f6a0819d978d62e1a73d758758233f285a4

Verdict: Ready for maintainer review · Priority: none
Coverage: Reviewed 1 of 1 files.
Pull request purpose (title): test(publish): pin t…

Diagnostics and supporting details

Full summary

Pull request purpose (title): test(publish): pin the stale-file check for older versions. Tiny Sweeper completed its review; deterministic results follow.

Review snapshot

Change surface	Files	Review signal	Count
Production	0	Active findings	0
Tests	1	Noted findings	0
Documentation	0	Resolved findings	0
Configuration	0	Pending checks/questions	0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

What changed

Adds a new integration test that creates a file artifact, revises it so a newer version replaces the file, then exercises publishing of the older version under three conditions: publishing v1 while its stored file still matches the recorded size succeeds; publishing v1 from a host with no file store is refused with `ArtifactsError::FileChanged`; and after the stored v1 bytes are replaced with a longer payload of the same key, publishing v1 is refused with `FileChanged` while the newest version still publishes. The description notes the size-only comparison is a known ceiling, since `FileRef` records no digest.

Features

• Added — Stale-file publish check pinned by integration test: Locks in the publish-time verification that an older file version's stored file is still the one that version recorded, guarding against a refactor silently sharing a changed file under an old version's name. Test-only; no production surface changes. (crates/tiny-artifacts/tests/publish_file_changed.rs)

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

No active actionable findings.

Before merge

None.

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Critique lane found the test self-consistent with the service's publish path and reported no defect in the file.
• Lane summary: The new integration test is self-consistent with the service's publish path: the first publish targets version 1 while v2 is newest and the stored object still matches v1's recorded size, the no-file-store host is refused via `FileChanged` (file_store is `None`), and replacing the stored bytes with a longer payload keeps the same key but changes its size so the browser is refused while the newest version still publishes. I found no defect in this file. _The code index is behind this pull request (indexed at `f322ccbbe450`), so retrieved context may be out of date._

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Security lane found no production surface, no meaningful attacker-controlled sinks, and no rule violations, matching sibling test style.
• Lane summary: This is a new integration test file that exercises publish-time file verification: it creates a file artifact, revises it, publishes an older version, and asserts that a missing or changed stored file yields `ArtifactsError::FileChanged`. It has no production surface, no attacker-controlled sinks beyond temp-dir writes with fixed names, and no rule violations from the repository instructions I can see; it also matches the style of the sibling tests (MemStore, LinkPublisher, workdir). No findings. _The code index is behind this pull request (indexed at `f322ccbbe450`), so retrieved context may be out of date._

tests

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No behavioural change: nothing outside documentation, configuration and tests.

commits

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Commits lane found no sensitive content in committed files.
• Lane summary: No sensitive content in committed files. _The code index is behind this pull request (indexed at `f322ccbbe450`), so retrieved context may be out of date._

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Description lane confirmed the PR description matches what the test does, including the acknowledged size-only comparison ceiling, with no description defects.
• Lane summary: The PR adds a single integration test in `tests/publish_file_changed.rs` that exercises the `FileChanged` branch of `Artifacts::publish`, and its description matches what the test does, including the acknowledged size-only comparison ceiling. I found no description defects and no reportable defects in the test code. _The code index is behind this pull request (indexed at `f322ccbbe450`), so retrieved context may be out of date._

Evidence and run details

• Models: ladder/vectors-oai3, deepseek-v4.1-flash
• Spend: $0.000287
• Tokens: 105045 input · 2171 output · 26112 cached · 224 embedding
• Updated: 2026-10-23T00:26:22Z

Head	State	Pass summary
916f8f6a0819	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-10-23T00:26:22Z)

[tinysweeper]

tinysweeper found nothing blocking. Approving.

Diagnostics

Total spend: $0.0003