fix(repo):统一发布健康与只读质量门禁

internal/api/cdn.go

@@ -50,16 +50,20 @@ func (s *Server) serveCDN(w http.ResponseWriter, r *http.Request) {
 			http.Error(w, "resource root not ready", http.StatusServiceUnavailable)
 			return
 		}
-		resourceRoot = idx.ResourceRoot
-		if s.cfg.RequireIndexed {
-			entry, hasEntry = idx.Lookup(rel)
-		}
-	}
-	if explicitRelease || s.cfg.RequireIndexed {
-		if !hasEntry || !entry.Present || !entry.SizeMatch {
-			http.NotFound(w, r)
+		summary := idx.Summary()
+		if !summary.Ready {
+			// The cached health fact covers the whole current release. A
+			// locally present target is not enough to serve it as a healthy
+			// immutable artifact.
+			http.Error(w, "current release is not distributable", http.StatusServiceUnavailable)
 			return
 		}
+		resourceRoot = idx.ResourceRoot
+		entry, hasEntry = idx.Lookup(rel)
+	}
+	if !hasEntry || !entry.Present || !entry.SizeMatch {
+		http.NotFound(w, r)
+		return
 	}
 
 	abs, err := ResolveUnderRoot(resourceRoot, rel, true)
@@ -76,11 +80,9 @@ func (s *Server) serveCDN(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "size mismatch with release index", http.StatusConflict)
 		return
 	}
-	if !explicitRelease && s.cfg.RequireIndexed && s.cfg.VerifySize {
-		if hasEntry && entry.Bytes > 0 && uint64(info.Size()) != entry.Bytes {
-			http.Error(w, "size mismatch with release index", http.StatusConflict)
-			return
-		}
+	if !explicitRelease && entry.Bytes > 0 && uint64(info.Size()) != entry.Bytes {
+		http.Error(w, "size mismatch with release index", http.StatusConflict)
+		return
 	}
 
 	file, err := os.Open(abs)
@@ -88,7 +90,7 @@ func (s *Server) serveCDN(w http.ResponseWriter, r *http.Request) {
 		http.NotFound(w, r)
 		return
 	}
-	defer file.Close()
+	defer func() { _ = file.Close() }()
 
 	w.Header().Set("Cache-Control", "public, max-age=31536000, immutable")
 	w.Header().Set("ETag", cdnETag(entry, hasEntry, info))