check github_ref tag and sha are checked out on parse

__tests__/fs-helper.test.ts

@@ -212,3 +212,50 @@ describe('readFileContents', () => {
     expect(fsHelper.readFileContents(tempFile).toString()).toEqual(fileContent)
   })
 })
+
+describe('ensureCorrectShaCheckedOut', () => {
+  let dir: string
+  let commit1: string
+  let commit2: string
+  const tag1 = 'tag1'
+  const tag2 = 'tag2'
+
+  beforeEach(() => {
+    dir = fsHelper.createTempDir(tmpFileDir, 'subdir')
+
+    // Set up a git repository with two commits
+    execSync('git init', { cwd: dir })
+    execSync('git commit --allow-empty -m "test"', { cwd: dir })
+    execSync('git commit --allow-empty -m "test"', { cwd: dir })
+
+    // Grab the two commits
+    commit1 = execSync('git rev-parse HEAD~1', { cwd: dir }).toString().trim()
+    commit2 = execSync('git rev-parse HEAD', { cwd: dir }).toString().trim()
+
+    // Create a tag for each commit
+    execSync(`git tag ${tag1} ${commit1}`, { cwd: dir })
+    execSync(`git tag ${tag2} ${commit2}`, { cwd: dir })
+  })
+
+  afterEach(() => {
+    fs.rmSync(dir, { recursive: true })
+  })
+
+  it('does not throw an error if the correct SHA is checked out', async () => {
+    await expect(
+      fsHelper.ensureCorrectShaCheckedOut(`refs/tags/${tag2}`, commit2, dir)
+    ).resolves.toBeUndefined()
+  })
+
+  it('throws an error if the correct SHA is not checked out', async () => {
+    await expect(
+      fsHelper.ensureCorrectShaCheckedOut(`refs/tags/${tag1}`, commit1, dir)
+    ).rejects.toThrow()
+  })
+
+  it('throws an error if the sha of the tag does not match expected sha', async () => {
+    await expect(async () =>
+      fsHelper.ensureCorrectShaCheckedOut(`refs/tags/${tag1}`, commit2, dir)
+    ).rejects.toThrow()
+  })
+})

__tests__/main.test.ts

@@ -23,6 +23,7 @@ let setOutputMock: jest.SpyInstance
 let createTempDirMock: jest.SpyInstance
 let createArchivesMock: jest.SpyInstance
 let stageActionFilesMock: jest.SpyInstance
+let ensureCorrectShaCheckedOutMock: jest.SpyInstance
 let publishOCIArtifactMock: jest.SpyInstance
 
 // Mock the config resolution
@@ -49,6 +50,9 @@ describe('run', () => {
     stageActionFilesMock = jest
       .spyOn(fsHelper, 'stageActionFiles')
       .mockImplementation()
+    ensureCorrectShaCheckedOutMock = jest
+      .spyOn(fsHelper, 'ensureCorrectShaCheckedOut')
+      .mockImplementation()
 
     // GHCR Client mocks
     publishOCIArtifactMock = jest
@@ -93,9 +97,24 @@ describe('run', () => {
     }
   })
 
+  it('fails if ensuring the correct SHA is checked out errors', async () => {
+    resolvePublishActionOptionsMock.mockReturnValue(baseOptions())
+
+    ensureCorrectShaCheckedOutMock.mockImplementation(() => {
+      throw new Error('Something went wrong')
+    })
+
+    // Run the action
+    await main.run()
+
+    // Check the results
+    expect(setFailedMock).toHaveBeenCalledWith('Something went wrong')
+  })
+
   it('fails if creating staging temp directory fails', async () => {
     resolvePublishActionOptionsMock.mockReturnValue(baseOptions())
 
+    ensureCorrectShaCheckedOutMock.mockImplementation(() => {})
     createTempDirMock.mockImplementation(() => {
       throw new Error('Something went wrong')
     })
@@ -110,6 +129,8 @@ describe('run', () => {
   it('fails if staging files fails', async () => {
     resolvePublishActionOptionsMock.mockReturnValue(baseOptions())
 
+    ensureCorrectShaCheckedOutMock.mockImplementation(() => {})
+
     createTempDirMock.mockImplementation(() => {
       return 'tmpDir/staging'
     })
@@ -128,6 +149,8 @@ describe('run', () => {
   it('fails if creating archives temp directory fails', async () => {
     resolvePublishActionOptionsMock.mockReturnValue(baseOptions())
 
+    ensureCorrectShaCheckedOutMock.mockImplementation(() => {})
+
     createTempDirMock.mockImplementation((_, path: string) => {
       if (path === 'staging') {
         return 'staging'
@@ -147,6 +170,8 @@ describe('run', () => {
   it('fails if creating archives fails', async () => {
     resolvePublishActionOptionsMock.mockReturnValue(baseOptions())
 
+    ensureCorrectShaCheckedOutMock.mockImplementation(() => {})
+
     createTempDirMock.mockImplementation(() => {
       return 'stagingOrArchivesDir'
     })
@@ -167,6 +192,8 @@ describe('run', () => {
   it('fails if publishing OCI artifact fails', async () => {
     resolvePublishActionOptionsMock.mockReturnValue(baseOptions())
 
+    ensureCorrectShaCheckedOutMock.mockImplementation(() => {})
+
     createTempDirMock.mockImplementation(() => {
       return 'stagingOrArchivesDir'
     })
@@ -202,6 +229,8 @@ describe('run', () => {
   it('fails if creating attestation fails', async () => {
     resolvePublishActionOptionsMock.mockReturnValue(baseOptions())
 
+    ensureCorrectShaCheckedOutMock.mockImplementation(() => {})
+
     createTempDirMock.mockImplementation(() => {
       return 'stagingOrArchivesDir'
     })
@@ -246,6 +275,8 @@ describe('run', () => {
     options.isEnterprise = true
     resolvePublishActionOptionsMock.mockReturnValue(options)
 
+    ensureCorrectShaCheckedOutMock.mockImplementation(() => {})
+
     createTempDirMock.mockImplementation(() => {
       return 'stagingOrArchivesDir'
     })
@@ -302,6 +333,8 @@ describe('run', () => {
   it('uploads the artifact, returns package metadata from GHCR, and creates an attestation in non-enterprise for public repo', async () => {
     resolvePublishActionOptionsMock.mockReturnValue(baseOptions())
 
+    ensureCorrectShaCheckedOutMock.mockImplementation(() => {})
+
     createTempDirMock.mockImplementation(() => {
       return 'stagingOrArchivesDir'
     })
@@ -383,6 +416,8 @@ describe('run', () => {
 
     resolvePublishActionOptionsMock.mockReturnValue(opts)
 
+    ensureCorrectShaCheckedOutMock.mockImplementation(() => {})
+
     createTempDirMock.mockImplementation(() => {
       return 'stagingOrArchivesDir'
     })