fix(publish): force-with-lease when re-publishing a rebuilt bundle (#108)

The new-PR path builds the contribution with `checkout -B <branch> origin/<base>`
→ apply → commit → `git push -u origin <branch>` (a plain push). After
`signoff --iterate-do` rebuilds Do off the current base, that fresh commit is a
sibling of the previous attempt already on the PR branch, not a fast-forward, so the
plain push is rejected ("non-fast-forward") — the bundle is left COMPLETE but NOT
published, and the operator must force-push by hand.

Push with `--force-with-lease`. A deliberately-rebuilt branch is exactly when a force
update is intended; the lease keeps it safe — the preceding `git fetch` refreshes
`origin/<branch>`, so the push refuses if the remote moved unexpectedly, and it still
creates the branch on a first publish (verified: force-with-lease on an absent remote
ref is a normal create). Stack mode is untouched: it appends `HEAD:<branch>`, a
fast-forward, so its plain push is correct.

Regression test (real git, bare origin + clone): two publishes of distinct fixes off
the same base — the second is non-ff; it was rejected (rc=1) before this change and
now force-updates the PR branch to the rebuilt commit. Full offline suite: 165 OK.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Eduard Ralph <15236434+eduralph@users.noreply.github.com>

Author: eduralph

template/src/pdca_harness/publish.py

@@ -151,7 +151,14 @@ def publish(
         # target checkout, so a DCO-gated host accepts the PR by construction; harmless
         # on non-DCO hosts (issue #81).
         git("commit", "-s", "-F", str((d / COMMIT_MSG).resolve())),
-        git("push", "-u", "origin", branch),
+        # `--force-with-lease`, not a plain push: re-publishing a rebuilt bundle (after
+        # `signoff --iterate-do`) commits a FRESH `checkout -B branch origin/<base>` off
+        # the current base, which is not a fast-forward of the previous attempt already on
+        # the PR branch — a plain push is rejected and the re-Done bundle never publishes
+        # (#108). The lease is safe: `fetch` above refreshed `origin/<branch>`, so the
+        # force refuses if the remote moved unexpectedly, and it still creates the branch
+        # on a first publish.
+        git("push", "--force-with-lease", "-u", "origin", branch),
     ]
     # A fork-based PR's --head must be OWNER:BRANCH — `gh` resolves a bare branch name
     # against the *base* repo (where the fork branch doesn't exist) and fails with

template/tests/test_publish_slice.py

@@ -229,6 +229,45 @@ def test_publish_succeeds_with_dirty_target_tree(self) -> None:
                       capture_output=True, text=True).stdout
         self.assertIn("fix/DIRTY-my-fix", refs)
 
+    def test_republish_force_updates_existing_pr_branch(self) -> None:
+        # iterate-do (#108): re-publishing a rebuilt bundle commits a FRESH branch off the
+        # current base and pushes it to the EXISTING PR branch — not a fast-forward of the
+        # prior attempt. A plain push is rejected (the re-Done bundle never publishes);
+        # publish must force-with-lease so the branch is updated to the rebuilt commit.
+        import subprocess as sp
+        repo = self.tmp / "checkout"
+        origin = self.tmp / "origin.git"
+        sp.run(["git", "init", "-q", "--bare", str(origin)], check=True)
+        sp.run(["git", "clone", "-q", str(origin), str(repo)], check=True)
+        run = lambda *a: sp.run(["git", "-C", str(repo), *a], check=True, capture_output=True)
+        run("config", "user.email", "t@example.com")
+        run("config", "user.name", "T")
+        run("config", "commit.gpgsign", "false")
+        (repo / "file.txt").write_text("base\n", encoding="utf-8")
+        run("add", "-A"); run("commit", "-q", "-m", "base")
+        run("branch", "-M", "main"); run("push", "-q", "-u", "origin", "main")
+
+        self.cfg.base_remote = "origin"
+        self.cfg.repo_checkouts = {"example-org/example-repo": str(repo)}
+        d = _bundle(self.cfg, "REDO", brief_body=_FIX_BRIEF, accepted=True)
+
+        def publish_fix(line: str) -> str:
+            # A distinct fix off the same base → a sibling (non-ff) commit on re-publish.
+            (d / "patch.diff").write_text(
+                "diff --git a/file.txt b/file.txt\n--- a/file.txt\n+++ b/file.txt\n"
+                f"@@ -1 +1,2 @@\n base\n+{line}\n", encoding="utf-8")
+            buf = io.StringIO()
+            with redirect_stdout(buf), redirect_stderr(buf):
+                rc = publish.publish(self.cfg, "REDO", open_pr=False, by="T", today="2026-06-05")
+            self.assertEqual(rc, 0, buf.getvalue())
+            return sp.run(["git", "-C", str(repo), "ls-remote", "origin", "fix/REDO-my-fix"],
+                          capture_output=True, text=True).stdout.split()[0]
+
+        tip1 = publish_fix("first fix")
+        tip2 = publish_fix("second fix")   # was rejected (non-fast-forward) before #108
+        self.assertTrue(tip1 and tip2)
+        self.assertNotEqual(tip1, tip2)    # the PR branch was force-updated to the rebuild
+
     def test_pr_head_is_fork_owner_qualified(self) -> None:
         """Regression (#23b): a fork-based PR's --head must be OWNER:BRANCH, else gh
         resolves the branch against the base repo and fails 'Head ref must be a