Publish the captured release tag

internal/git/tag.go

@@ -0,0 +1,105 @@
+package git
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"os"
+	"strings"
+)
+
+// CreateAnnotatedTag records the captured note as an unsigned annotated tag
+// on the captured commit and returns the tag object's ID.
+func CreateAnnotatedTag(ctx context.Context, repositoryDir, version, commit string, note []byte) (string, error) {
+	if !validVersionRef(version) {
+		return "", fmt.Errorf("invalid version tag name %q", version)
+	}
+	if !validObjectID(commit) {
+		return "", fmt.Errorf("invalid candidate commit object ID %q", commit)
+	}
+	message, err := os.CreateTemp("", "releasekit-tag-message-*")
+	if err != nil {
+		return "", fmt.Errorf("create temporary release note: %w", err)
+	}
+	messagePath := message.Name()
+	defer os.Remove(messagePath)
+	if _, err := message.Write(note); err != nil {
+		_ = message.Close()
+		return "", fmt.Errorf("write temporary release note: %w", err)
+	}
+	if err := message.Close(); err != nil {
+		return "", fmt.Errorf("close temporary release note: %w", err)
+	}
+	if _, err := run(ctx, repositoryDir, []string{"tag.gpgSign=false"}, "tag", "--annotate", "--cleanup=verbatim", "--file", messagePath, version, commit); err != nil {
+		return "", fmt.Errorf("create annotated tag %s: %w", version, err)
+	}
+
+	ref := "refs/tags/" + version
+	tagType, err := run(ctx, repositoryDir, nil, "cat-file", "-t", ref)
+	if err != nil {
+		return "", fmt.Errorf("inspect created tag %s: %w", version, err)
+	}
+	if strings.TrimSpace(tagType) != "tag" {
+		return "", fmt.Errorf("created tag %s has object type %q, want tag", version, strings.TrimSpace(tagType))
+	}
+	tagObject, err := run(ctx, repositoryDir, nil, "rev-parse", "--verify", ref)
+	if err != nil {
+		return "", fmt.Errorf("read created tag object %s: %w", version, err)
+	}
+	tagObject = strings.TrimSpace(tagObject)
+	if !validObjectID(tagObject) {
+		return "", fmt.Errorf("created tag %s has invalid object ID %q", version, tagObject)
+	}
+	peeled, err := run(ctx, repositoryDir, nil, "rev-parse", "--verify", ref+"^{}")
+	if err != nil {
+		return "", fmt.Errorf("read peeled commit for tag %s: %w", version, err)
+	}
+	if strings.TrimSpace(peeled) != commit {
+		return "", fmt.Errorf("created tag %s peels to %s, want candidate %s", version, strings.TrimSpace(peeled), commit)
+	}
+	tagContents, err := run(ctx, repositoryDir, nil, "cat-file", "tag", ref)
+	if err != nil {
+		return "", fmt.Errorf("read annotated tag %s: %w", version, err)
+	}
+	separator := bytes.Index([]byte(tagContents), []byte("\n\n"))
+	if separator < 0 || !bytes.Equal([]byte(tagContents[separator+2:]), note) {
+		return "", fmt.Errorf("annotated tag %s message does not match the captured release note", version)
+	}
+	return tagObject, nil
+}
+
+// InspectLocalTag confirms the selected tag still points to the exact
+// annotated tag object captured before publication.
+func InspectLocalTag(ctx context.Context, repositoryDir, version, expectedObject string) error {
+	if !validVersionRef(version) || !validObjectID(expectedObject) {
+		return fmt.Errorf("invalid expected tag identity %q at %q", expectedObject, version)
+	}
+	ref := "refs/tags/" + version
+	tagType, err := run(ctx, repositoryDir, nil, "cat-file", "-t", ref)
+	if err != nil {
+		return fmt.Errorf("inspect local tag %s: %w", version, err)
+	}
+	if strings.TrimSpace(tagType) != "tag" {
+		return fmt.Errorf("local tag %s has type %q, want annotated tag", version, strings.TrimSpace(tagType))
+	}
+	object, err := run(ctx, repositoryDir, nil, "rev-parse", "--verify", ref)
+	if err != nil {
+		return fmt.Errorf("read local tag %s: %w", version, err)
+	}
+	if strings.TrimSpace(object) != expectedObject {
+		return fmt.Errorf("local tag %s identifies %s, want %s", version, strings.TrimSpace(object), expectedObject)
+	}
+	return nil
+}
+
+// PushTag publishes only the captured tag object to its exact tag ref.
+func (endpoint Endpoint) PushTag(ctx context.Context, repositoryDir, version, tagObject string) error {
+	if !validVersionRef(version) || !validObjectID(tagObject) {
+		return fmt.Errorf("invalid tag publication identity %q at %q", tagObject, version)
+	}
+	refspec := tagObject + ":refs/tags/" + version
+	if _, err := run(ctx, repositoryDir, endpoint.scopedConfig(), "push", "--no-follow-tags", "--porcelain", endpoint.ScopedName, refspec); err != nil {
+		return fmt.Errorf("push annotated tag %s to %s: %w", version, endpoint.PushURL, err)
+	}
+	return nil
+}