Check commit SHA after checking out repository

sethmlarson · sethmlarson · commit 7bb7fd359aaf · 2023-10-04T14:26:20.000-05:00
diff --git a/windows-release/azure-pipelines.yml b/windows-release/azure-pipelines.yml
@@ -19,6 +19,10 @@ parameters:
   displayName: "Git tag"
   type: string
   default: main
+- name: SourceCommit
+  displayName: "Git commit (empty to disable commit SHA check)"
+  type: string
+  default: ''
 - name: DoPublish
   displayName: "Publish release"
   type: boolean
@@ -90,6 +94,7 @@ variables:
   ${{ else }}:
     GitRemote: ${{ parameters.GitRemote_Other }}
   SourceTag: ${{ parameters.SourceTag }}
+  SourceCommit: ${{ parameters.SourceCommit }}
   ${{ if ne(parameters.SigningCertificate, 'Unsigned') }}:
     SigningCertificate: ${{ parameters.SigningCertificate }}
   SigningDescription: ${{ parameters.SigningDescription }}
diff --git a/windows-release/checkout.yml b/windows-release/checkout.yml
@@ -19,3 +19,11 @@ steps:
 - script: git clone --progress -v --depth ${{ parameters.depth }} --branch $(Build.SourceBranchName) --single-branch $(Build.Repository.Uri) .
   displayName: 'git clone'
   condition: and(succeeded(), and(not(variables['GitRemote']), not(variables['SourceTag'])))
+
+- powershell: |
+    $checkout_commit = (git rev-parse HEAD)
+    if ($checkout_commit -ne $GitCommit) {
+        throw "Expected git commit '$(GitCommit)' didn't match tagged commit '$(checkout_commit)'"
+    }
+  displayName: "Verify CPython commit matches tag"
+  condition: and(succeeded(), and(variables['GitCommit']))
