Read delivery tokens from files and check selected paths before release

internal/validation/untracked_files.go

@@ -0,0 +1,24 @@
+package validation
+
+import (
+	"path"
+	"strings"
+)
+
+func checkUntrackedFiles(tree *CandidateTree, names []string) error {
+	var findings []Finding
+	for _, name := range names {
+		clean := path.Clean(name)
+		if name == "" || path.IsAbs(name) || clean == "." || clean == ".." || strings.HasPrefix(clean, "../") {
+			findings = append(findings, Finding{Path: name, Message: "expected a repository-relative file path"})
+			continue
+		}
+		if _, exists := tree.Entry(clean); exists {
+			findings = append(findings, Finding{Path: clean, Message: "file must be absent from the committed candidate"})
+		}
+	}
+	if len(findings) == 0 {
+		return nil
+	}
+	return &Failure{Check: UntrackedFiles, Findings: findings}
+}