Fix the merge artifact issue

[agrasth]

• All tests passed. If this feature is not already covered by the tests, I added new tests.
• All static analysis checks passed.
• This pull request is on the dev branch.
• I used gofmt for formatting the code before submitting the pull request.
• Appropriate label is added to the PR for auto generate release notes.

---

Fix Maven SNAPSHOT artifact duplicate entries in build info

Problem

When running jf mvn install followed by jf mvn deploy with the same build name/number, Maven SNAPSHOT artifacts (especially WARs) appeared as duplicates in build info, causing Release Bundle v2 creation to fail:

422 Unprocessable Entity: Unresolvable build artifact: multi3-3.7-SNAPSHOT.war

Root Cause

mergeArtifacts() compared artifacts only by SHA1. Maven SNAPSHOT WARs get new SHA1s on each rebuild (timestamps, bundled dependencies), so the merge logic treated them as different artifacts.

Solution

Updated mergeArtifacts() with a two-priority strategy:

Priority 1: SHA1 Match → Skip

• Same checksum = same file, already exists
• Works for deterministic builds (Go, NPM, Gradle reproducible)

Priority 2: Name + Path Match → Replace

• Controlled by JFROG_CLI_MERGE_BUILD_INFO_ARTIFACTS_BY_NAME env var (default: enabled)
• If names match AND isSameLogicalArtifact() confirms same directory/repo → replace with newer artifact
• Handles non-deterministic builds (Maven SNAPSHOTs, Docker images)

No Match → Add as New

• Different SHA1 and different name/path → add as separate artifact

New Functions

Function	Purpose
isSameLogicalArtifact(existing, new)	Returns true if same directory and same repo
extractPathDir(path)	Extracts directory portion from artifact path

Disable name-based merging (SHA1 only)

export JFROG_CLI_MERGE_BUILD_INFO_ARTIFACTS_BY_NAME=FALSE

[bhanurp]

isnt !exists redundant since whenever it is set to true immediately it is set to break. WDYT?

[agrasth]

I think without !exists, we'd always check by name, even after finding a SHA1 match, which would cause incorrect double-merging.

[bhanurp]

is this mixing information between 2 different objects? If yes we should only pick either one of them instead copying data from one to another object same goes to path as well.

[fluxxBot]

isn't it concerning that sha1 is not present?
should we atleast warn?
can we identify those scenarios where this fields will be empty?

[agrasth]

Good point, we have added a WARN, Thanks!