fix(release): complete publication evidence contract

scripts/image_release.py

@@ -109,6 +109,14 @@ def validate_publication_trigger(event_name: str, ref: str) -> str:
     return ref.removeprefix("refs/tags/")
 
 
+def verify_checkout(commit: str, runner: Runner) -> str:
+    expected = validate_commit(commit)
+    actual = runner.run(["git", "rev-parse", "HEAD"]).stdout.strip()
+    if actual != expected:
+        raise ValueError("checked out HEAD does not match source commit")
+    return actual
+
+
 def release_tags(commit: str, event_name: str, ref: str) -> list[str]:
     validate_commit(commit)
     release = validate_publication_trigger(event_name, ref)
@@ -368,6 +376,7 @@ def publish_image(
     summary_path: Path | None = None,
 ) -> str:
     tags = release_tags(commit, event_name, ref)
+    version_tag = validate_publication_trigger(event_name, ref)
     verify_checksum(archive, checksum)
     expected_image_id = read_image_id(image_id)
     loaded = runner.run(["docker", "load", "--input", str(archive)])
@@ -407,13 +416,17 @@ def publish_image(
 
     digest = digests[0]
     reference = f"{IMAGE}@{digest}"
-    _append(output_path, f"image={reference}\ndigest={digest}\nsource_commit={commit}\n")
+    _append(
+        output_path,
+        f"image={reference}\ndigest={digest}\nsource_commit={commit}\nversion_tag={version_tag}\n",
+    )
     _append(
         summary_path,
         "## Published trex-core image\n\n"
         f"- Image: `{reference}`\n"
         f"- Digest: `{digest}`\n"
-        f"- Source commit: `{commit}`\n",
+        f"- Source commit: `{commit}`\n"
+        f"- Version tag: `{version_tag}`\n",
     )
     return digest
 
@@ -426,6 +439,9 @@ def _parser() -> argparse.ArgumentParser:
     smoke.add_argument("--image", required=True)
     smoke.add_argument("--timeout", type=int, default=30)
 
+    verify_checkout_parser = commands.add_parser("verify-checkout")
+    verify_checkout_parser.add_argument("--commit", required=True)
+
     scan = commands.add_parser("scan")
     scan.add_argument("--image", required=True)
     scan.add_argument("--archive", type=Path, required=True)
@@ -461,6 +477,8 @@ def main(argv: Sequence[str] | None = None) -> int:
     runner = SubprocessRunner()
     if args.command == "smoke":
         smoke_image(args.image, runner, args.timeout)
+    elif args.command == "verify-checkout":
+        verify_checkout(args.commit, runner)
     elif args.command == "scan":
         scan_image(args.image, args.archive, runner)
     elif args.command == "checksum":