ci: close the gaps that turned source failures into green runs

- key the reusable workflow's concurrency on the source: one shared group made the matrix
  legs cancel each other, defeating the parallelism
- resolve action versions at write time on the jobs this change adds (checkout v7,
  setup-python v7, upload-artifact v7, download-artifact v8) and add the missing
  workflow concurrency block and job-level permissions
- stage each leg's outputs into one directory so every artifact has the same root; two
  search paths moved the root to the common ancestor for some legs only, and the FAA CSV
  and zip then matched nothing downstream
- fail a leg that produced no CSV, and split the unknown-source guard out of the tolerated
  step so a matrix typo goes red
- write continue-on-error as an explicit comparison rather than relying on ! coercion
- gate the join on success rather than always, and rename its artifact so the download
  pattern cannot re-ingest it on a re-run
- delete the previous release only when it exists, so a 403 stops the run instead of
  leaving two assets that the next run reads as an ambiguous base

Generated-by: Claude Opus 5 <noreply@anthropic.com>

.github/workflows/registry-source.yaml

@@ -24,47 +24,73 @@ on:
         type: boolean
         default: false
 
+# Keyed on the source: without it every matrix leg shares one group and the legs cancel
+# each other, which is the opposite of running them in parallel.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}-${{ inputs.source }}
+  cancel-in-progress: false
+
 jobs:
   build:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 30
+    permissions:
+      contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          fetch-depth: 0
+        uses: actions/checkout@v7
 
       - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: ${{ inputs.python-version }}
+          cache: 'pip'
+          cache-dependency-path: requirements.txt
 
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
           pip install -r requirements.txt
 
-      - name: Build ${{ inputs.source }} registry
-        continue-on-error: ${{ !inputs.required }}
+      # Deliberately outside the tolerated step below: a typo in the matrix is a config
+      # error, and must go red even for an optional source.
+      - name: Check the source has a build script
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SOURCE: ${{ inputs.source }}
-          RUN_DATE: ${{ inputs.date }}
         run: |
           script="src/create_daily_${SOURCE}_release.py"
           if [ ! -f "$script" ]; then
             echo "::error title=Unknown registry source::$script does not exist"
             exit 1
           fi
-          python "$script" ${RUN_DATE:+--date "$RUN_DATE"}
-          ls -lah data/openairframes
+
+      - name: Build ${{ inputs.source }} registry
+        continue-on-error: ${{ inputs.required == false }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SOURCE: ${{ inputs.source }}
+          RUN_DATE: ${{ inputs.date }}
+        run: |
+          python "src/create_daily_${SOURCE}_release.py" ${RUN_DATE:+--date "$RUN_DATE"}
+          # Stage into one directory so every leg's artifact has the same root; a second
+          # search path would move the root to the common ancestor for some legs only.
+          shopt -s nullglob
+          built=(data/openairframes/openairframes_"${SOURCE}"_*.csv)
+          if [ ${#built[@]} -ne 1 ]; then
+            echo "::error title=${SOURCE} produced no registry CSV::expected one openairframes_${SOURCE}_*.csv, found ${#built[@]}"
+            exit 1
+          fi
+          # Stage into one directory so every leg's artifact has the same root; a second
+          # search path would move the root to the common ancestor for some legs only.
+          mkdir -p data/registry-out
+          cp "${built[@]}" data/registry-out/
+          cp data/faa_releasable/ReleasableAircraft_*.zip data/registry-out/ 2>/dev/null || true
+          ls -lah data/registry-out
 
       - name: Upload ${{ inputs.source }} registry
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: registry-${{ inputs.source }}
-          path: |
-            data/openairframes/openairframes_${{ inputs.source }}_*.csv
-            data/faa_releasable/ReleasableAircraft_*.zip
+          path: data/registry-out
           retention-days: 1
-          if-no-files-found: ignore
+          if-no-files-found: error