Preserve evidence when local tag inspection fails

publish_test.go

@@ -353,6 +353,57 @@ func TestPublishRedactsCredentialsInEndpointMismatch(t *testing.T) {
 	}
 }
 
+func TestPublishRetainsEvidenceWhenCreatedTagInspectionFails(t *testing.T) {
+	for _, test := range []struct {
+		name, failingCommand string
+		wantObject           bool
+	}{
+		{"type inspection", "cat-file -t refs/tags/v1.2.3", false},
+		{"peeled commit inspection", "rev-parse --verify refs/tags/v1.2.3^{}", true},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			repo := newPublishFixture(t)
+			realGit := mustLookPath(t, "git")
+			bin := t.TempDir()
+			pushMarker := filepath.Join(t.TempDir(), "push")
+			script := fmt.Sprintf(`#!/bin/sh
+case " $* " in
+  *" %s "*) echo "inspection failed" >&2; exit 77 ;;
+  *" push "*) : > %s ;;
+esac
+exec %s "$@"
+`, test.failingCommand, shellQuote(pushMarker), shellQuote(realGit))
+			if err := os.WriteFile(filepath.Join(bin, "git"), []byte(script), 0o700); err != nil {
+				t.Fatal(err)
+			}
+			t.Setenv("PATH", bin+string(os.PathListSeparator)+os.Getenv("PATH"))
+			result, err := releasekit.Publish(context.Background(), releasekit.ReleaseRequest{
+				RepositoryDir: repo.work, Product: "Sample App", Version: "v1.2.3",
+			})
+			var exit *exec.ExitError
+			if !errors.As(err, &exit) || exit.ExitCode() != 77 || result.State != releasekit.PublicationNotPublished || result.Phase != releasekit.PublicationTagCreation {
+				t.Fatalf("publication = %#v, error = %v", result, err)
+			}
+			if !strings.Contains(err.Error(), "refs/tags/v1.2.3") || !strings.Contains(err.Error(), "may remain") {
+				t.Fatalf("missing local ref evidence: %v", err)
+			}
+			actual, readErr := exec.Command(realGit, "-C", repo.work, "rev-parse", "--verify", "refs/tags/v1.2.3").Output()
+			if readErr != nil {
+				t.Fatal(readErr)
+			}
+			if test.wantObject && result.TagObject != strings.TrimSpace(string(actual)) || !test.wantObject && result.TagObject != "" {
+				t.Fatalf("tag object = %q, local ref = %q", result.TagObject, actual)
+			}
+			if _, err := os.Stat(pushMarker); !errors.Is(err, os.ErrNotExist) {
+				t.Fatalf("unexpected push marker: %v", err)
+			}
+			if err := exec.Command(realGit, "-C", repo.bare, "show-ref", "--verify", "--quiet", "refs/tags/v1.2.3").Run(); err == nil {
+				t.Fatal("remote tag was published")
+			}
+		})
+	}
+}
+
 func TestPublishComparesExpectedURLWithResolvedInsteadOfDestination(t *testing.T) {
 	repo := newPublishFixture(t)
 	alias := "releasekit-expected-push:"