better artifact testing for cd

.github/workflows/cd.yml

@@ -8,7 +8,7 @@ jobs:
   cd:
     runs-on: ubuntu-latest
     outputs:
-      HAS_SECRETS: ${{ secrets.AWS_S3_CACHE != '' }}
+      HAS_ARTIFACTS: ${{ env.HAS_ARTIFACTS }}
     steps:
       - uses: actions/checkout@v3
       - run: >
@@ -17,16 +17,28 @@ jobs:
           jq -sc . |
           curl https://app.tea.xyz/api/receiveWatcherProjects --fail -X PUT \
             -H "content-type: application/json" -H "authorization: bearer ${{ secrets.TEA_API_TOKEN }}" -d @-
+      - uses: teaxyz/setup@v0
+      - uses: actions/checkout@v3
+        name: co core
+        with:
+          path: pantry.core
+          repository: teaxyz/pantry.core
+      - run: ./scripts/has-artifacts.ts ${{ github.repository }} ${{ github.sha }} >>$GITHUB_ENV
+        working-directory: pantry.core
+        env:
+          GITHUB_TOKEN: ${{github.token}}
+          AWS_S3_CACHE: ${{ secrets.AWS_S3_CACHE }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
   bottle-pr:
     needs: [cd]
-    #FIXME: will fail (harmlessly) on non-merge/non-new-version runs, and won't work on 3rd-party PRs
-    if: ${{ needs.cd.outputs.HAS_SECRETS }}
+    if: ${{ needs.cd.outputs.HAS_ARTIFACTS == 'true' }}
     uses: teaxyz/pantry.core/.github/workflows/bottle.yml@main
     secrets: inherit
   bottle-standalone:
     runs-on: ubuntu-latest
     needs: [cd]
-    if: ${{ ! needs.cd.outputs.HAS_SECRETS }}
+    if: ${{ needs.cd.outputs.HAS_ARTIFACTS == 'false' }}
     steps:
       - uses: actions/checkout@v3
       - uses: technote-space/get-diff-action@v6