feat: verify refreshed snapshots before publishing

[gacevicljubisa]

Adds a verify subcommand and wires it into the Batch Sync workflow as a regression gate: no snapshot reaches a commit or a tag in ethersphere/batch-archive unless it provably extends the archive file it is about to replace.

Why

The workflow resumes the archive snapshot, exports newer entries onto it, then commits and tags the result. Nothing checked that the refreshed file still held everything the old one did — a regression in the resume or gzip-append path could silently drop, mutate, or reorder historical entries and publish that as the new latest version.

What it does

• batch-export verify --old <file> --new <file> proves the new snapshot strictly extends the old one: the old file's clean content must appear byte for byte at the start of the new file, and every appended entry must parse and advance the (blockNumber, logIndex) order past the old cursor. An empty tail is valid. Plain NDJSON and gzip are detected by content, in any combination.
• On success it prints only the decimal last block number to stdout and exits 0; on failure stdout is empty and the exit code is non-zero. All logging goes to stderr.
• The workflow gains a Verify snapshot step between Export and Publish, whose last_block output supplies the commit title. That replaces a gunzip | tail | sed regex which duplicated knowledge of the on-disk JSON format in shell, where a format change would have passed every Go test and broken only in CI.
• pkg/verify leans on pkg/resume instead of re-deriving the format: ReadLine, ParseEntry, Cursor.Before and Cursor.OpenClean are exported, so the line reader, the entry parser and the (blockNumber, logIndex) ordering rule each exist in one place.

--old points at batch-archive/archive/export.ndjson.gzip — the file Publish overwrites — rather than the resumed tag's file. Those are the same bytes whenever the resumed tag is main's tip, and when an operator resumes an older tag it is the stricter check: it is the archive file a regression would actually destroy.

Also here

• make test now runs ./... instead of ./pkg/.... The tests pinning the stdout contract (and the pre-existing cmd/export_test.go) were never running in CI.
• The Publish step's git diff --quiet guard is documented as unable to fire: a resumed gzip export always appends a member, so the file always differs. Behaviour unchanged.

Testing

go test ./..., go vet ./... and golangci-lint are green; actionlint reports only the pre-existing custom bee runner-label warning. pkg/verify covers identical files, a proper superset, a corrupted prefix, a dropped entry, a short file, a duplicate cursor entry, out-of-order and malformed appended lines, an old file with a truncated tail, and all four plain/gzip combinations. The real binary was exercised end to end: stdout is exactly 3\n on success, empty with exit 1 on failure and on a missing required flag.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LqPjhcvFr2LLuBdhyjQwCe