lwmacct/Verify Tag Ref

Verify a checked-out release tag, optional SHA, checkout HEAD, and base reachability

Trust Signals

name	description	required	default
tag	Release tag to validate.	yes	—
sha	Optional expected commit SHA. When empty, the tag target commit is used.	no	—
base-ref	Branch or ref that the release commit must be reachable from.	no	main
repository-path	Path to the checked-out git repository.	no	.
remote	Git remote used when fetching tag and base-ref.	no	origin
fetch	Set to true to fetch tag and base-ref before validation.	no	true
validate-checkout	Set to true to require repository HEAD to equal the release commit.	no	true
validate-reachable	Set to true to require the release commit to be reachable from base-ref.	no	true
tag-pattern	Optional glob pattern that tag must match, for example v*.	no	—
summary	Set to true to write a GitHub step summary.	no	true

name	description
tag	Validated tag.
sha	Resolved trusted release commit SHA.
tag-sha	Commit SHA resolved from the tag.
head-sha	Checked-out HEAD SHA.
base-ref	Local base ref used for reachability validation.
base-sha	Commit SHA resolved from base-ref.
repository-path	Checked repository path.