Read delivery tokens from files and check selected paths before release

check.go

@@ -59,6 +59,8 @@ type ReleaseRequest struct {
 // module and shared-file inputs. Independent nested modules form automatic
 // input boundaries; vendored files remain included. Referenced destinations
 // remain available for targeted inspection without expanding the input set.
+// UntrackedFiles checks explicitly selected repository paths independently of
+// those file inputs.
 type ValidationSpec struct {
 	// SharedFiles adds repository-relative committed files to optional file
 	// checks. Nil selects the optional root COPYRIGHT, LICENSE, and
@@ -66,7 +68,11 @@ type ValidationSpec struct {
 	// Explicit files replace the defaults and must exist even when file checks
 	// are off.
 	SharedFiles []string
-	Go          GoValidationSpec
+	// UntrackedFiles lists literal repository-relative file paths that must be
+	// absent from the captured commit, independently of module/shared inputs.
+	// An empty list disables the check. File contents and history are not read.
+	UntrackedFiles []string
+	Go             GoValidationSpec
 	// GoFormat checks the formatting of committed regular Go source files. It
 	// does not modify repository contents and is disabled when false.
 	GoFormat bool
@@ -137,6 +143,8 @@ type GoValidationSpec struct {
 // of test-time vet, and Validation.Go.CompileTargets compiles all packages for
 // each selected GOOS/GOARCH pair after tests and vet with cgo disabled. Package
 // compilation produces no artifacts and does not execute target binaries.
+// Validation.UntrackedFiles checks that selected repository-relative files are
+// absent from the captured commit after Go checks and before other file checks.
 // Validation.GoFormat checks regular committed Go source after those selected
 // Go checks and before AdditionalChecks. Its zero value disables formatting.
 // Validation.ModuleDistribution.WorkspaceFiles rejects committed workspace
@@ -189,6 +197,7 @@ func candidateRequest(request ReleaseRequest) candidate.Request {
 			FullVet:        request.Validation.Go.FullVet,
 			CompileTargets: make([]validation.Target, len(request.Validation.Go.CompileTargets)),
 			SharedFiles:    copyStringSlice(request.Validation.SharedFiles),
+			UntrackedFiles: copyStringSlice(request.Validation.UntrackedFiles),
 			GoFormat:       request.Validation.GoFormat,
 			Markdown:       internalMarkdownSettings(request.Validation.Markdown),
 			ModuleDistribution: validation.ModuleDistributionSettings{