Reconcile uncertain tag pushes

internal/git/tag.go

@@ -92,6 +92,34 @@ func InspectLocalTag(ctx context.Context, repositoryDir, version, expectedObject
 	return nil
 }
 
+// QueryTag reads one exact authoritative version tag and its peeled commit.
+// Failed reads are unreadable and never interpreted as absence.
+func (endpoint Endpoint) QueryTag(ctx context.Context, repositoryDir, version string) (RemoteRef, error) {
+	if !validVersionRef(version) {
+		return RemoteRef{}, fmt.Errorf("invalid version tag name %q", version)
+	}
+	ref := "refs/tags/" + version
+	peeledRef := ref + "^{}"
+	output, err := run(ctx, repositoryDir, endpoint.scopedConfig(), "ls-remote", endpoint.ScopedName, ref, peeledRef)
+	if err != nil {
+		return RemoteRef{State: RefUnreadable}, fmt.Errorf("%w: query authoritative tag %s at %s: %w", ErrRemoteStateUnreadable, version, endpoint.PushURL, err)
+	}
+	remoteTag := RemoteRef{State: RefAbsent}
+	for _, line := range outputLines(output) {
+		object, name, ok := strings.Cut(line, "\t")
+		if !ok || !validObjectID(object) {
+			return RemoteRef{State: RefUnreadable}, fmt.Errorf("%w: malformed ls-remote output %q", ErrRemoteStateUnreadable, line)
+		}
+		switch name {
+		case ref:
+			remoteTag = mergeRef(remoteTag, object, false)
+		case peeledRef:
+			remoteTag = mergeRef(remoteTag, object, true)
+		}
+	}
+	return remoteTag, nil
+}
+
 // PushTag publishes only the captured tag object to its exact tag ref.
 func (endpoint Endpoint) PushTag(ctx context.Context, repositoryDir, version, tagObject string) error {
 	if !validVersionRef(version) || !validObjectID(tagObject) {