Make remote publish locks generation-safe

internal/stage/publish.go

@@ -231,6 +231,9 @@ func (publishStage) Run(ctx context.Context, env *Env, m *manifest.Manifest) (*S
 	if err != nil {
 		return nil, fmt.Errorf("publish: upload immutable commit %q: %w", commitKey, err)
 	}
+	if err := revalidatePublishCommitLocks(ctx, env, publishOutputs); err != nil {
+		return nil, fmt.Errorf("publish: revalidate locks before current commit selection: %w", err)
+	}
 	pointerData, err := artifacts.EncodeCurrentCommitPointer(artifacts.CurrentCommitPointer{
 		FormatVersion:    artifacts.RemoteCommitFormatVersion,
 		Campaign:         commit.Campaign,
@@ -271,6 +274,23 @@ func (publishStage) Run(ctx context.Context, env *Env, m *manifest.Manifest) (*S
 	}, nil
 }
 
+func revalidatePublishCommitLocks(ctx context.Context, env *Env, outputs []publishOutput) error {
+	if env == nil || env.RevalidatePublishLocks == nil || len(outputs) == 0 {
+		return nil
+	}
+	locks, err := env.RevalidatePublishLocks(ctx)
+	if err != nil {
+		return err
+	}
+	lockSet := publishLockSet(locks)
+	for _, output := range outputs {
+		if lock, locked := lockSet[output.Source]; locked {
+			return fmt.Errorf("source %q is locked: %s", output.Source, strings.TrimSpace(lock.Reason))
+		}
+	}
+	return nil
+}
+
 type publishOutput struct {
 	Source     string
 	Dest       string