fix(release): complete publication evidence contract

tests/release/test_image_contracts.py

@@ -40,6 +40,22 @@ def test_workflow_rejects_non_strict_version_events_before_checkout_and_build():
     assert _step_index(steps, guard["name"]) < _step_index(steps, "Build source image once")
 
 
+def test_workflow_reverifies_exact_checked_out_commit_before_repository_or_registry_work():
+    workflow = _workflow()
+    verify_steps = workflow["jobs"]["verify"]["steps"]
+    publish_steps = workflow["jobs"]["publish"]["steps"]
+    checkout_index = _step_index(verify_steps, "Check out exact source commit")
+    reverify_index = _step_index(verify_steps, "Reverify exact checked out commit")
+
+    assert checkout_index < reverify_index < _step_index(verify_steps, "Install repository checks")
+    assert verify_steps[reverify_index]["run"] == (
+        'python scripts/image_release.py verify-checkout --commit "${GITHUB_SHA}"'
+    )
+    assert reverify_index < _step_index(verify_steps, "Build source image once")
+    assert all("REGISTRY_TOKEN" not in str(step) for step in verify_steps[: reverify_index + 1])
+    assert _step_index(publish_steps, "Verify, load, and publish without rebuilding") > 0
+
+
 def test_publish_is_gated_and_has_the_only_package_write_permission():
     workflow = _workflow()
     verify = workflow["jobs"]["verify"]
@@ -51,6 +67,16 @@ def test_publish_is_gated_and_has_the_only_package_write_permission():
     assert "packages" not in verify["permissions"]
 
 
+def test_publish_job_exposes_selected_version_tag_with_other_release_evidence():
+    outputs = _workflow()["jobs"]["publish"]["outputs"]
+    assert outputs == {
+        "image": "${{ steps.publish.outputs.image }}",
+        "digest": "${{ steps.publish.outputs.digest }}",
+        "source_commit": "${{ steps.publish.outputs.source_commit }}",
+        "version_tag": "${{ steps.publish.outputs.version_tag }}",
+    }
+
+
 def test_verify_canary_build_smoke_export_scan_checksum_upload_contract():
     steps = _workflow()["jobs"]["verify"]["steps"]
     names = [step["name"] for step in steps]