Fail early when worktree dirty

action.yml

@@ -112,7 +112,7 @@ runs:
     - name: Run Primary Build
       shell: bash
       working-directory: ${{ inputs.work_dir }}
-      run: $RUN_CLI build
+      run: $RUN_CLI build -clean -json
 
     # Upload Primary Build
     - name: Upload Primary Zip
@@ -127,7 +127,7 @@ runs:
       if: inputs.reproducible == 'assert' || inputs.reproducible == 'report'
       shell: bash
       working-directory: ${{ inputs.work_dir }}
-      run: $RUN_CLI build -verification
+      run: $RUN_CLI build -clean -json -verification
 
     # Upload Local Verification Build
     - name: Upload Local Verification Zip

e2e/test.bats

@@ -0,0 +1,25 @@
+#!/usr/bin/env bats
+
+set -Eeuo pipefail
+
+# This tests that we get the same verification zip path when we run the commands:
+#
+# - config
+# - inspect -build-config -verification
+# - build -verification
+@test "verification output paths match" {
+	rm -rf dist/ out/
+	CONFIG="$(actions-go-build config | grep ZIP_PATH_VERIFICATION | grep -Eo '/.*$')"
+	BUILDENV="$(actions-go-build inspect --build-config --verification | jq -r .Paths.ZipPath)"
+	actions-go-build build -q
+	BUILD="$(actions-go-build build -q -verification -json | jq -r .Config.Paths.ZipPath)"
+
+	echo "$CONFIG"
+	echo "$BUILDENV"
+	echo "$BUILD"
+
+	diff <(echo "$CONFIG") <(echo "$BUILDENV")
+	diff <(echo "$CONFIG") <(echo "$BUILD")
+
+	[[ "$CONFIG" == "$BUILDENV" ]]
+}