Run cron at 04:00 GMT+8; verify the full artifact set, not just the image

- Cron moved to 20:00 UTC (= 04:00 Asia/Shanghai); Actions cron is UTC.
- Add scripts/registry-has-all.sh: a (version, arch) counts as published only
  when the kernel image, the meta-package at that EXACT version, bbrv3-config,
  and (amd64) the headers are all present. A partial previous upload now
  rebuilds instead of being treated as done.
- Use it in all three registry checks: preflight, per-arch pre-build, and the
  pre-publish recheck.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/workflows/build.yml

@@ -9,8 +9,9 @@ name: 构建带有BBRv3的内核
 on:
   workflow_dispatch:
   schedule:
-    # Daily automatic kernel refresh. BBRv3 itself stays pinned to the repo patch.
+    # Daily kernel refresh at 20:00 UTC = 04:00 Asia/Shanghai (GMT+8). Gitea/GitHub
-    - cron: "17 3 * * *"
+    # Actions cron is evaluated in UTC. BBRv3 itself stays pinned to the repo patch.
+    - cron: "0 20 * * *"
 
 env:
   # Gitea Debian package registry for this owner, e.g.
@@ -51,30 +52,24 @@ jobs:
           echo "Selected stable kernel: $version"
           echo "kernel_version=$version" >> "$GITHUB_OUTPUT"
 
-          # Already-published check against the registry's apt index (per arch).
+          # Build unless BOTH arches already have their COMPLETE artifact set
-          pkg_present() {
+          # (kernel image + meta@version + config, plus headers on amd64). A partial
-            local debarch="$1"
+          # previous upload counts as incomplete and triggers a rebuild.
-            curl -fsSL ${PKG_TOKEN:+--user "$PKG_USER:$PKG_TOKEN"} \
-              "$PKG_REGISTRY/dists/stable/main/binary-$debarch/Packages" 2>/dev/null \
-              | grep -q "^Package: linux-image-$version-bbrv3$"
-          }
-
           missing=0
           for da in amd64 arm64; do
-            if pkg_present "$da"; then
+            if bash scripts/registry-has-all.sh "$PKG_REGISTRY" stable main "$version" "$da"; then
-              echo "linux-image-$version-bbrv3 ($da) already in registry."
+              echo "All artifacts for $version ($da) already in registry."
             else
-              echo "linux-image-$version-bbrv3 ($da) missing."
               missing=1
             fi
           done
 
           if [ "$missing" -eq 1 ]; then
             echo "build_needed=true" >> "$GITHUB_OUTPUT"
-            echo "At least one arch for $version is missing; build will continue."
+            echo "At least one arch for $version is incomplete; build will continue."
           else
             echo "build_needed=false" >> "$GITHUB_OUTPUT"
-            echo "All arches for $version already published; ending before build."
+            echo "All arches for $version fully published; ending before build."
           fi
 
   build:
@@ -111,14 +106,12 @@ jobs:
         id: check_present
         run: |
           set -euo pipefail
-          if curl -fsSL ${PKG_TOKEN:+--user "$PKG_USER:$PKG_TOKEN"} \
+          if bash scripts/registry-has-all.sh "$PKG_REGISTRY" stable main "$KERNEL_VERSION" "$DEB_ARCH"; then
-               "$PKG_REGISTRY/dists/stable/main/binary-$DEB_ARCH/Packages" 2>/dev/null \
-               | grep -q "^Package: linux-image-$KERNEL_VERSION-bbrv3$"; then
             echo "BUILD_NEEDED=false" >> "$GITHUB_ENV"
-            echo "linux-image-$KERNEL_VERSION-bbrv3 ($DEB_ARCH) already published; skipping."
+            echo "Full artifact set for $KERNEL_VERSION ($DEB_ARCH) present; skipping."
           else
             echo "BUILD_NEEDED=true" >> "$GITHUB_ENV"
-            echo "linux-image-$KERNEL_VERSION-bbrv3 ($DEB_ARCH) missing; building."
+            echo "Artifact set for $KERNEL_VERSION ($DEB_ARCH) incomplete; building."
           fi
 
       - name: 安装依赖项
@@ -232,14 +225,12 @@ jobs:
         if: env.BUILD_NEEDED == 'true'
         run: |
           set -euo pipefail
-          if curl -fsSL ${PKG_TOKEN:+--user "$PKG_USER:$PKG_TOKEN"} \
+          if bash scripts/registry-has-all.sh "$PKG_REGISTRY" stable main "$KERNEL_VERSION" "$DEB_ARCH"; then
-               "$PKG_REGISTRY/dists/stable/main/binary-$DEB_ARCH/Packages" 2>/dev/null \
-               | grep -q "^Package: linux-image-$KERNEL_VERSION-bbrv3$"; then
             echo "PUBLISH_NEEDED=false" >> "$GITHUB_ENV"
-            echo "Published while this job was running; skipping upload."
+            echo "Full set published while this job was running; skipping upload."
           else
             echo "PUBLISH_NEEDED=true" >> "$GITHUB_ENV"
-            echo "Still missing; publishing this build."
+            echo "Set still incomplete; publishing this build."
           fi
 
       - name: 发布到 Gitea Debian registry

scripts/registry-has-all.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+# Exit 0 only when EVERY artifact a complete publish should contain for the given
+# kernel version + Debian architecture is already in the registry's apt index.
+# Otherwise list what's missing on stderr and exit 1, so CI rebuilds and fills the
+# gap instead of treating a partial upload as "already done".
+#
+# Should-have set per (version, arch):
+#   - linux-image-<version>-bbrv3       the kernel image (checked by name)
+#   - linux-image-bbrv3  == <version>   meta-package tracking THIS version
+#   - bbrv3-config                      Architecture: all sysctl defaults
+#   - linux-headers-<version>-bbrv3     amd64 only (arm64 cross build omits headers)
+#
+# Architecture: all packages (bbrv3-config) appear in every binary-<arch> index,
+# so reading the single binary-<arch>/Packages file covers the whole set.
+#
+# Reads optional PKG_USER / PKG_TOKEN from the environment for authenticated reads.
+set -euo pipefail
+
+base=${1:?usage: registry-has-all.sh <registry_base> <dist> <comp> <version> <deb_arch>}
+dist=${2:?missing dist}
+comp=${3:?missing component}
+version=${4:?missing kernel version}
+arch=${5:?missing deb arch}
+
+idx=$(curl -fsSL ${PKG_TOKEN:+--user "${PKG_USER:-}:$PKG_TOKEN"} \
+  "$base/dists/$dist/$comp/binary-$arch/Packages" 2>/dev/null || true)
+
+# Emit one "name|version" line per stanza in the Packages index.
+present=$(printf '%s\n' "$idx" | awk '
+  /^Package:/ { pkg=$2 }
+  /^Version:/ { ver=$2 }
+  /^[[:space:]]*$/ { if (pkg != "") print pkg "|" ver; pkg=""; ver="" }
+  END { if (pkg != "") print pkg "|" ver }
+')
+
+has_name()     { printf '%s\n' "$present" | awk -F'|' -v n="$1"           '$1==n{f=1} END{exit !f}'; }
+has_name_ver() { printf '%s\n' "$present" | awk -F'|' -v n="$1" -v v="$2" '$1==n && $2==v{f=1} END{exit !f}'; }
+
+missing=()
+has_name     "linux-image-$version-bbrv3"   || missing+=("linux-image-$version-bbrv3")
+has_name_ver "linux-image-bbrv3" "$version"  || missing+=("linux-image-bbrv3=$version")
+has_name     "bbrv3-config"                  || missing+=("bbrv3-config")
+if [ "$arch" = "amd64" ]; then
+  has_name   "linux-headers-$version-bbrv3"  || missing+=("linux-headers-$version-bbrv3")
+fi
+
+if [ ${#missing[@]} -eq 0 ]; then
+  echo "Complete artifact set for $version ($arch)."
+  exit 0
+fi
+
+echo "Incomplete for $version ($arch); missing: ${missing[*]}" >&2
+exit 1