Check expected publication push URL

publish.go

@@ -48,21 +48,24 @@ type PublicationResult struct {
 	State           PublicationState // publication outcome for this invocation
 }
 
-// Publish always runs one offline Go test suite for the captured candidate.
-// Validation.Go.Race enables the race detector for that suite, and
+// After publication preflight succeeds, Publish runs one offline Go test suite
+// for the captured candidate.
+// Validation.Go.Race enables the race detector for that suite,
 // Validation.Go.FullVet runs go vet afterward instead of test-time vet, and
 // Validation.Go.CompileTargets compiles all packages for each selected target
 // with cgo disabled after tests and vet. Compilation produces no artifacts and
-// does not execute target binaries. It then calls AdditionalChecks when
-// supplied. It optionally builds selected
-// targets in temporary storage outside the worktree and pushes the exact
-// annotated tag object to the selected remote. It returns a result with errors: preflight
-// failures are not_attempted, failed authoritative guards are conflict, and
-// errors after local tag creation but before push are not_published. A failed
-// push gets one bounded authoritative tag query: an exact object match confirms
-// publication, absence is not_published, a different object is conflict, and
-// an unreadable result is unknown. A nil error means publication is confirmed
-// by the successful push or exact remote object match.
+// does not execute target binaries. ExpectedPushURL, when nonempty, is compared
+// exactly with the resolved effective push URL before validation; a mismatch
+// returns ErrUnexpectedPushURL. It then calls AdditionalChecks when supplied.
+// It optionally builds selected targets in temporary storage outside the
+// worktree and pushes the exact annotated tag object to the selected remote.
+// It returns a result with errors: preflight failures are not_attempted, failed
+// authoritative guards are conflict, and errors after local tag creation but
+// before push are not_published. A failed push gets one bounded authoritative
+// tag query: an exact object match confirms publication, absence is
+// not_published, a different object is conflict, and an unreadable result is
+// unknown. A nil error means publication is confirmed by the successful push
+// or exact remote object match.
 func Publish(ctx context.Context, request ReleaseRequest) (PublicationResult, error) {
 	candidateInput := candidateRequest(request)
 	result, err := publish.Publish(ctx, publish.Request{
@@ -70,6 +73,7 @@ func Publish(ctx context.Context, request ReleaseRequest) (PublicationResult, er
 		Product:          candidateInput.Product,
 		Version:          candidateInput.Version,
 		Remote:           request.Remote,
+		ExpectedPushURL:  request.ExpectedPushURL,
 		Validation:       candidateInput.Validation,
 		AdditionalChecks: candidateInput.AdditionalChecks,
 		AfterValidate:    candidateInput.AfterValidate,