Check expected publication push URL

internal/publish/publish.go

@@ -36,11 +36,16 @@ const (
 
 const recoveryTimeout = 30 * time.Second
 
+// ErrUnexpectedPushURL reports that the resolved push URL differs from the
+// caller's expected publication destination.
+var ErrUnexpectedPushURL = errors.New("unexpected publication push URL")
+
 type Request struct {
 	RepositoryDir    string
 	Product          string
 	Version          string
 	Remote           string
+	ExpectedPushURL  string
 	Validation       validation.Settings
 	AdditionalChecks func(context.Context, candidate.Candidate) error
 	AfterValidate    func(context.Context, candidate.Candidate) error
@@ -56,8 +61,9 @@ type Result struct {
 	State           State
 }
 
-// Publish validates one captured candidate and pushes only its annotated tag
-// object. It runs one standard Go suite, with the selected settings, then
+// Publish captures a candidate, resolves and checks the optional expected push
+// URL, then validates the candidate and pushes only its annotated tag object.
+// It runs one standard Go suite, with the selected settings, then
 // AdditionalChecks when supplied.
 // A failed push receives one bounded authoritative tag query. Exact
 // object equality confirms publication; absence and conflict are classified,
@@ -87,6 +93,9 @@ func Publish(ctx context.Context, request Request) (Result, error) {
 		return result, fmt.Errorf("resolve publication endpoint: %w", err)
 	}
 	result.Endpoint = endpoint.PushURL
+	if request.ExpectedPushURL != "" && request.ExpectedPushURL != endpoint.PushURL {
+		return result, fmt.Errorf("%w: expected %q, resolved %q", ErrUnexpectedPushURL, request.ExpectedPushURL, endpoint.PushURL)
+	}
 	if err := endpoint.Recheck(ctx, captured.RepositoryDir); err != nil {
 		return result, fmt.Errorf("pre-validation endpoint guard: %w", err)
 	}