Use prepared checkouts in root workflows

cmd/releasekit/woodpecker_test.go

@@ -140,7 +140,7 @@ func TestWoodpeckerTagDeliveryTemplate(t *testing.T) {
 			t.Fatalf("template error = %v, want propagated exit 37; output=%q", err, output)
 		}
 		args := readWoodpeckerFixtureFile(t, toolArgs)
-		for _, expected := range []string{"<ci-deliver>", "<--repo>", "<" + repository + ">", "<--commit>", "<" + strings.ToUpper(commit) + ">", "<v1.2.3>"} {
+		for _, expected := range []string{"<ci-deliver>", "<--repo>", "<" + repository + ">", "<--prepared>", "<--commit>", "<" + strings.ToUpper(commit) + ">", "<v1.2.3>"} {
 			if !strings.Contains(args, expected) {
 				t.Errorf("selected executable arguments %q omit %q", args, expected)
 			}
@@ -284,7 +284,7 @@ func TestWoodpeckerSourceDeliveryTemplateSelfBootstraps(t *testing.T) {
 	if proxyRequests.Load() == 0 {
 		t.Fatal("self-bootstrap did not prepare its dependency from the local proxy")
 	}
-	if !strings.Contains(output, `"ci-deliver"`) || !strings.Contains(output, `"`+repository+`"`) || !strings.Contains(output, `"v1.2.3"`) {
+	if !strings.Contains(output, `"ci-deliver"`) || !strings.Contains(output, `"`+repository+`"`) || !strings.Contains(output, `"--prepared"`) || !strings.Contains(output, `"v1.2.3"`) {
 		t.Fatalf("self-bootstrapped command arguments = %q", output)
 	}
 	log := readWoodpeckerFixtureFile(t, goLog)

docs/consumers/delivery.md

@@ -193,13 +193,15 @@ invokes that executable with `CI_WORKSPACE`, `CI_COMMIT_SHA`, and
 
 Tool bootstrap and application artifact preparation are separate. The bootstrap
 resolves and builds ReleaseKit from the tagged consumer's module configuration.
-Afterward, `ci-deliver` loads the profile and downloads application dependencies
+After the workflow verifies and checks out the event tag, the resulting CLI uses
-only when build targets are selected; it builds and delivers those targets with
+`ci-deliver --prepared` to repeat the tag, commit, HEAD, and cleanliness checks
-the note page. Source-only profiles skip application dependency downloads and
+without another fetch or checkout. It loads the tagged profile and downloads
-binary work. Dependency preparation for binaries may use the network and may
+application dependencies only when build targets are selected; it builds and
-update an uncommitted checksum file in the checkout. A retry still uses the
+delivers those targets with the note page. Source-only profiles skip application
-same immutable tag and that tag's module settings, even after the default branch
+dependency downloads and binary work. Dependency preparation for binaries may
-selects a newer ReleaseKit version.
+use the network and may update an uncommitted checksum file in the checkout. A
+retry still uses the same immutable tag and that tag's module settings, even
+after the default branch selects a newer ReleaseKit version.
 
 If the application does not declare ReleaseKit as a module dependency, install
 the executable separately and invoke the same `ci-deliver` command. For

docs/roadmap/implementation.md

@@ -622,6 +622,14 @@ the original tagged module after the default branch changes. Confirm subsequent
 delivery performs read-only checks without repeating checkout preparation.
 Use local remotes/proxies and temporary `GOMODCACHE`, never live CI or credentials.
 
+**Completed:** Both maintained root Woodpecker templates now verify and detach
+the exact event tag before invoking `ci-deliver --prepared`, so delivery repeats
+the source checks without fetching or changing checkout state. Updated workflow
+tests assert the prepared flag while retaining local proxy coverage for the
+tagged ReleaseKit selection, self-bootstrap, retry behavior, and source-only and
+binary delivery. Verified the root profile and compiled API boundaries, the
+maintained workflow harnesses, `go test ./...`, and `git diff --check`.
+
 ## Stage 13: Add a shared multi-module declaration and local launcher example
 
 **Outcome:** Consumers select modules through small declarations with one maintained

examples/woodpecker/releasekit-source-delivery.yml

@@ -29,5 +29,6 @@ steps:
         go build -mod=readonly -o "$${bootstrap_dir}/releasekit" ./cmd/releasekit
         "$${bootstrap_dir}/releasekit" ci-deliver \
           --repo "$${CI_WORKSPACE}" \
+          --prepared \
           --commit "$${CI_COMMIT_SHA}" \
           "$${CI_COMMIT_TAG}"

examples/woodpecker/tag-delivery.yml

@@ -45,5 +45,6 @@ steps:
           -o "$${bootstrap_dir}/releasekit" "$${releasekit_module}/cmd/releasekit"
         "$${bootstrap_dir}/releasekit" ci-deliver \
           --repo "$${CI_WORKSPACE}" \
+          --prepared \
           --commit "$${CI_COMMIT_SHA}" \
           "$${CI_COMMIT_TAG}"