ci: retain top disk acceptance archive (#7812)

.github/workflows/connect-top-disk-acceptance.yml

@@ -111,7 +111,8 @@ jobs:
         run: |
           set -euo pipefail
           scripts/ci/check_connect_top_disk_artifact.sh \
-            binary/rustfs "$SOURCE_SHA" "$BINARY_SHA256" top-disk-runtime-evidence.json
+            binary/rustfs "$SOURCE_SHA" "$BINARY_SHA256" \
+            top-disk-runtime-evidence.json top-disk.zip
 
       - name: Bind workflow and artifact provenance
         shell: bash
@@ -134,6 +135,8 @@ jobs:
         uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: connect-top-disk-evidence-${{ github.run_id }}
-          path: top-disk-runtime-evidence.json
+          path: |
+            top-disk-runtime-evidence.json
+            top-disk.zip
           retention-days: 14
           if-no-files-found: error

scripts/ci/check_connect_top_disk_artifact.sh

@@ -15,8 +15,8 @@
 
 set -euo pipefail
 
-if [[ $# -ne 4 ]]; then
-  echo "usage: $0 <rustfs-binary> <source-sha> <binary-sha256> <evidence-json>" >&2
+if [[ $# -ne 5 ]]; then
+  echo "usage: $0 <rustfs-binary> <source-sha> <binary-sha256> <evidence-json> <archive-output>" >&2
   exit 2
 fi
 
@@ -24,6 +24,7 @@ binary=$(realpath "$1")
 expected_source_sha=$2
 expected_binary_sha256=$3
 evidence_json=$4
+archive_output=$5
 work_dir=$(mktemp -d)
 trap 'rm -rf "$work_dir"' EXIT
 
@@ -163,6 +164,12 @@ if find "$work_dir" -name '*.partial' -print -quit | grep -q .; then
   exit 1
 fi
 
+if [[ -e "$archive_output" ]]; then
+  echo "refusing to replace existing archive output: $archive_output" >&2
+  exit 1
+fi
+cp -- "$output" "$archive_output"
+
 jq -n \
   --arg sourceSha "$expected_source_sha" \
   --arg binarySha256 "$actual_binary_sha256" \