fix preflight

build/release/cli.py

@@ -34,7 +34,11 @@ def _cmd_preflight(argv: list[str]) -> int:
     parser.add_argument("--skip-tests", action="store_true", help="skip pytest (recorded in the report)")
     parser.add_argument("--longrun", action="store_true", help="include the slow long-run stability test")
     parser.add_argument("--allow-dirty", action="store_true", help="allow a dirty working tree")
-    parser.add_argument("--force", action="store_true", help="allow re-staging an existing SDK/<version>")
+    parser.add_argument(
+        "--force",
+        action="store_true",
+        help="accept a version that a git tag already marks as released",
+    )
     parser.add_argument("--check-pypi", action="store_true", help="read PyPI and fail if the version exists")
     parser.add_argument(
         "--all-wheel-pythons",

build/release/preflight.py

@@ -209,23 +209,43 @@ class Preflight:
         return Step("version-consistency", not problems, detail, data=data)
 
     def _duplicate_guard(self) -> Step:
+        """Fail only when this version has already been *released*.
+
+        A populated ``SDK/<version>/`` is the normal input to preflight (it is
+        what gets verified), so it is reported, not blocked. What must not happen
+        silently is re-releasing a version that is already out: that is detected
+        offline through git tags and, opt-in, against PyPI.
+        """
         problems: list[str] = []
         lines: list[str] = []
 
         existing = version_mod.sdk_wheels(self.repo_root, self.version)
         if existing:
+            lines.append(
+                f"SDK/{self.version}/ holds {len(existing)} staged wheel(s) to verify: "
+                f"{[w.name for w in existing]}"
+            )
+        else:
+            lines.append(
+                f"SDK/{self.version}/ is empty; nothing is staged yet "
+                "(build with `python build/run.py wheel-win` / `manylinux`)"
+            )
+
+        tags = version_mod.git_tags(self.repo_root)
+        tag_hits = version_mod.released_tags_for(self.version, tags)
+        if tag_hits:
+            message = f"git tag(s) {tag_hits} already mark {self.version} as released"
             if self.options.force:
-                lines.append(
-                    f"SDK/{self.version}/ already holds {len(existing)} wheel(s); "
-                    "overwriting because --force was passed"
-                )
+                lines.append(message + " (accepted via --force)")
             else:
                 problems.append(
-                    f"SDK/{self.version}/ already holds {len(existing)} wheel(s): "
-                    f"{[w.name for w in existing]}. Pass --force to rebuild over them."
+                    message + "; pass --force to re-verify or intentionally re-release"
                 )
         else:
-            lines.append(f"SDK/{self.version}/ is empty (no wheel has been staged yet)")
+            lines.append(
+                f"no local git tag marks {self.version} as released "
+                f"({len(tags)} tag(s) checked in this repo and {version_mod.RELEASE_REPO_DIRNAME})"
+            )
 
         if self.options.check_pypi:
             versions, error = version_mod.pypi_released_versions()
@@ -240,7 +260,7 @@ class Preflight:
                 )
             else:
                 lines.append(
-                    f"PyPI has no {self.version}; published versions: " + (", ".join(versions) or "none")
+                    f"PyPI has no {self.version}; published: " + (", ".join(versions) or "none")
                 )
         else:
             lines.append("PyPI existence check skipped (pass --check-pypi to enable)")

build/release/version.py

@@ -5,12 +5,16 @@ from __future__ import annotations
 import json
 import os
 import re
+import subprocess
 import urllib.error
 import urllib.request
 from pathlib import Path
 
 PYPI_JSON_URL = "https://pypi.org/pypi/orisys/json"
 
+# Sibling repository that carries the public GitHub releases and their tags.
+RELEASE_REPO_DIRNAME = "orisys-sdk-release"
+
 # orisys-<version>-<pytag>-<abitag>-<platformtag>.whl
 _WHEEL_NAME_RE = re.compile(r"^orisys-(?P<version>[^-]+)-[^-]+-[^-]+-.+\.whl$")
 
@@ -103,6 +107,42 @@ def _version_sort_key(name: str):
     return ([int(part) for part in parts] or [0], name)
 
 
+def git_tags(repo_root: Path) -> list[str]:
+    """Local git tags from this repo and the sibling release repo.
+
+    Tags are the only offline evidence that a version was already released
+    (``v0.5.1`` in ``orisys-sdk-release`` marks a published GitHub release), so
+    the duplicate guard works without network access.
+    """
+    roots = [Path(repo_root)]
+    sibling = Path(repo_root).parent / RELEASE_REPO_DIRNAME
+    if sibling.is_dir():
+        roots.append(sibling)
+
+    tags: set[str] = set()
+    for root in roots:
+        try:
+            completed = subprocess.run(
+                ["git", "-C", str(root), "tag", "--list"],
+                capture_output=True,
+                text=True,
+                check=False,
+            )
+        except OSError:
+            continue
+        if completed.returncode != 0:
+            continue
+        tags.update(
+            line.strip() for line in (completed.stdout or "").splitlines() if line.strip()
+        )
+    return sorted(tags)
+
+
+def released_tags_for(version: str, tags: list[str]) -> list[str]:
+    """Tag spellings that mark ``version`` as already released."""
+    return sorted({version, f"v{version}"} & set(tags))
+
+
 def conda_envs_root() -> Path | None:
     """Locate the conda envs directory the same way build/wheel/win.bat does."""
     override = os.getenv("CONDA_ENVS_ROOT")