From 0d1f63e77fbc48da206c8818586c1223bfb57296 Mon Sep 17 00:00:00 2001
From: Hermes Agent <gb+hermes@rfc1437.de>
Date: Fri, 14 Aug 2026 10:44:13 +0000
Subject: [PATCH] Handle explicit release rebuilds.

---
 .gitea/workflows/release.yml            |  1 +
 crates/bds-release/src/gitea.rs         | 19 ++++++++++++++++++-
 crates/bds-ui/tests/packaging_assets.rs |  1 +
 3 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 00e4161..067b047 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -39,6 +39,7 @@ jobs:
           GITEA_SERVER_URL: ${{ gitea.server_url }}
           GITEA_SHA: ${{ gitea.sha }}
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          REBUILD_PUBLISHED_RELEASE: "true"
         run: cargo +${RUST_TOOLCHAIN} run --locked --package bds-release -- prepare
 
   build-macos:
diff --git a/crates/bds-release/src/gitea.rs b/crates/bds-release/src/gitea.rs
index 88829ad..2303d7b 100644
--- a/crates/bds-release/src/gitea.rs
+++ b/crates/bds-release/src/gitea.rs
@@ -208,9 +208,14 @@ pub(crate) fn prepare() -> Result<(), Box<dyn Error>> {
     };
 
     let release = if let Some(existing) = gitea.release_for_tag(&tag)? {
-        if !existing.draft {
+        if !existing.draft
+            && !replace_published_release(env::var("REBUILD_PUBLISHED_RELEASE").ok().as_deref())
+        {
             return Err(format!("release {tag} is already published").into());
         }
+        if !existing.draft {
+            gitea.update_release(existing.id, &serde_json::json!({ "draft": true }))?;
+        }
         for asset in existing.assets.unwrap_or_default() {
             gitea.delete_asset(existing.id, asset.id)?;
         }
@@ -247,6 +252,10 @@ pub(crate) fn publish() -> Result<(), Box<dyn Error>> {
     Ok(())
 }
 
+fn replace_published_release(value: Option<&str>) -> bool {
+    value == Some("true")
+}
+
 fn required_env(name: &str) -> Result<String, Box<dyn Error>> {
     env::var(name).map_err(|_| format!("required environment variable {name} is missing").into())
 }
@@ -421,4 +430,12 @@ mod tests {
     fn release_tag_is_encoded_as_one_api_path_segment() {
         assert_eq!(percent_encode("release/1+beta"), "release%2F1%2Bbeta");
     }
+
+    #[test]
+    fn published_release_replacement_requires_explicit_opt_in() {
+        assert!(!replace_published_release(None));
+        assert!(!replace_published_release(Some("false")));
+        assert!(!replace_published_release(Some("TRUE")));
+        assert!(replace_published_release(Some("true")));
+    }
 }
diff --git a/crates/bds-ui/tests/packaging_assets.rs b/crates/bds-ui/tests/packaging_assets.rs
index 57fd629..93ad0aa 100644
--- a/crates/bds-ui/tests/packaging_assets.rs
+++ b/crates/bds-ui/tests/packaging_assets.rs
@@ -127,6 +127,7 @@ fn tagged_releases_are_built_and_packaged_with_rust_tools() {
         "apt-get install --no-install-recommends --yes nasm",
         "x86_64-pc-windows-msvc",
         "bds-release",
+        "REBUILD_PUBLISHED_RELEASE: \"true\"",
         "prepare",
         "package",
         "publish",