Support full-tag prepared CI delivery

internal/git/prepare.go

@@ -29,12 +29,30 @@ func PrepareTaggedCheckout(ctx context.Context, repositoryDir, tag, remote, expe
 	if _, err := run(ctx, repositoryDir, nil, "checkout", "--detach", source.TagCommit); err != nil {
 		return fmt.Errorf("check out tag %s at %s: %w", tag, source.TagCommit, err)
 	}
-	head, err := run(ctx, repositoryDir, nil, "rev-parse", "--verify", "HEAD^{commit}")
-	if err != nil {
-		return fmt.Errorf("verify prepared checkout HEAD: %w", err)
+	return VerifyTaggedCheckout(ctx, repositoryDir, tag, expectedCommit)
+}
+
+// VerifyTaggedCheckout confirms that the existing local tag, HEAD, and clean
+// worktree all identify the expected commit. It does not fetch or check out.
+func VerifyTaggedCheckout(ctx context.Context, repositoryDir, tag, expectedCommit string) error {
+	if err := checkTagRef(ctx, repositoryDir, tag); err != nil {
+		return err
 	}
-	if !strings.EqualFold(strings.TrimSpace(head), expectedCommit) {
-		return fmt.Errorf("prepared checkout HEAD is %s, expected %s", strings.TrimSpace(head), expectedCommit)
+	if !validObjectID(expectedCommit) {
+		return fmt.Errorf("invalid tagged checkout commit %q for tag %q", expectedCommit, tag)
+	}
+	source, err := InspectTaggedSource(ctx, repositoryDir, tag)
+	if err != nil {
+		return err
+	}
+	if source.Status != "" {
+		return fmt.Errorf("tagged checkout must be clean:\n%s", source.Status)
+	}
+	if !strings.EqualFold(source.TagCommit, expectedCommit) {
+		return fmt.Errorf("tag %s resolves to commit %s, expected %s", tag, source.TagCommit, expectedCommit)
+	}
+	if !strings.EqualFold(source.Head, expectedCommit) {
+		return fmt.Errorf("checkout HEAD is %s, expected %s", source.Head, expectedCommit)
 	}
 	return nil
 }

internal/preparation/preparation.go

@@ -16,23 +16,29 @@ import (
 
 type TaggedCheckoutRequest struct {
 	RepositoryDir  string
-	Version        string
+	Tag            string
 	Remote         string
 	ExpectedCommit string
+	VerifyOnly     bool
 }
 
 func PrepareTaggedCheckout(ctx context.Context, request TaggedCheckoutRequest) error {
-	if !versioncontract.ValidStableVersion(request.Version) {
-		return fmt.Errorf("%w: %q", candidate.ErrInvalidVersion, request.Version)
+	lastSlash := strings.LastIndex(request.Tag, "/")
+	version := request.Tag[lastSlash+1:]
+	if !versioncontract.ValidStableVersion(version) {
+		return fmt.Errorf("%w: tag %q must end in a stable semantic version", candidate.ErrInvalidVersion, request.Tag)
 	}
 	if strings.TrimSpace(request.ExpectedCommit) == "" {
 		return errors.New("expected commit is required")
 	}
+	if request.VerifyOnly {
+		return git.VerifyTaggedCheckout(ctx, request.RepositoryDir, request.Tag, request.ExpectedCommit)
+	}
 	remote := request.Remote
 	if remote == "" {
 		remote = "origin"
 	}
-	return git.PrepareTaggedCheckout(ctx, request.RepositoryDir, request.Version, remote, request.ExpectedCommit)
+	return git.PrepareTaggedCheckout(ctx, request.RepositoryDir, request.Tag, remote, request.ExpectedCommit)
 }
 
 func PrepareBuildDependencies(ctx context.Context, moduleDir string) error {