Resolve staging manifest from actual artifacts

frontend/tests/staging-backend-workflows.test.ts

@@ -445,10 +445,8 @@ test("Gitea deploy and migration consume the exact successful gate artifact", ()
     assert.match(workflow, /\.head_branch == "staging"/);
     assert.match(workflow, /\.event == "push"/);
     assert.match(workflow, /\.conclusion == "success"/);
-    assert.match(workflow, /\.run_attempt \/\/ 0/);
-    assert.match(workflow, /\[\[ "\$gate_run_attempt" =~ \^\[0-9\]\+\$ \]\]/);
     assert.match(workflow, /sort_by\(\.id\) \| reverse \| first/);
-    assert.match(workflow, /actions\/runs\/\$GATE_RUN_ID\/artifacts\?name=\$artifact_name/);
+    assert.match(workflow, /actions\/runs\/\$GATE_RUN_ID\/artifacts\?limit=100/);
     assert.match(workflow, /actions\/artifacts\/\$artifact_id\/zip/);
     assert.match(workflow, /node frontend\/scripts\/staging-image-manifest\.mjs/);
     assert.match(workflow, /name: Checkout trusted main controller/);
@@ -460,6 +458,34 @@ test("Gitea deploy and migration consume the exact successful gate artifact", ()
   }
 });
 
+test("Gitea staging mutations resolve the manifest from actual gate-run artifacts", () => {
+  for (const workflow of [read(giteaDeployWorkflow), read(giteaMigrationWorkflow)]) {
+    assert.match(
+      workflow,
+      /artifact_prefix="staging-image-manifest-\$DEPLOY_SHA-"/,
+    );
+    assert.match(workflow, /\.expired == false/);
+    assert.match(workflow, /\.name \| startswith\(\$prefix\)/);
+    assert.match(workflow, /\.name \| ltrimstr\(\$prefix\)/);
+    assert.match(workflow, /tonumber\?/);
+    assert.match(workflow, /sort_by\(\.attempt, \.id\) \| reverse \| first/);
+    assert.match(workflow, /artifact_name="\$\(jq -er '\.name'/);
+    assert.match(workflow, /artifact_id="\$\(jq -er '\.id'/);
+    assert.match(workflow, /artifact_attempt="\$\{artifact_name#"\$artifact_prefix"\}"/);
+    assert.match(workflow, /\[\[ "\$artifact_name" == "\$artifact_prefix"\* \]\]/);
+    assert.match(workflow, /\[\[ "\$artifact_attempt" =~ \^\[1-9\]\[0-9\]\*\$ \]\]/);
+    assertOrder(workflow, [
+      'artifact_prefix="staging-image-manifest-$DEPLOY_SHA-"',
+      'actions/runs/$GATE_RUN_ID/artifacts?limit=100',
+      'sort_by(.attempt, .id) | reverse | first',
+      'artifact_name="$(jq -er',
+      'actions/artifacts/$artifact_id/zip',
+    ]);
+    assert.doesNotMatch(workflow, /run_attempt/i);
+    assert.doesNotMatch(workflow, /staging-image-manifest-\$DEPLOY_SHA-1/);
+  }
+});
+
 test("Gitea deployment follows only a successful staging push gate and keeps rollback manual", () => {
   const workflow = read(giteaDeployWorkflow);