fix (reproducibility): always enforce tag check regardless of --apk

Author: basantagoswami

reproducibility/verify_build.sh

@@ -92,10 +92,7 @@ if [[ -z "$appVersion" && -z "$apkPath" ]]; then
     exit 1
 fi
 
-# When verifying a GitHub release, the repo must be at the matching tag so the
-# Docker build uses the same source (and thus the same SOURCE_DATE_EPOCH).
-# When --apk is provided the caller controls both APKs, so this check is skipped.
-if [[ -z "$apkPath" ]]; then
+if [[ -n "$appVersion" ]]; then
     expectedTag="v${appVersion}"
     localTag=$(git -C "$REPO_ROOT" tag --points-at HEAD 2>/dev/null | grep -x "$expectedTag" || true)
     if [[ -z "$localTag" ]]; then
@@ -167,6 +164,14 @@ if [[ -z "$appVersion" ]]; then
         exit 1
     fi
     echo "Version (from APK): $appVersion"
+    expectedTag="v${appVersion}"
+    localTag=$(git -C "$REPO_ROOT" tag --points-at HEAD 2>/dev/null | grep -x "$expectedTag" || true)
+    if [[ -z "$localTag" ]]; then
+        currentRef=$(git -C "$REPO_ROOT" describe --tags --always 2>/dev/null || echo "unknown")
+        echo -e "${RED}Error: local repo is not at tag $expectedTag (currently at: $currentRef)${NC}"
+        echo "Run: git checkout $expectedTag"
+        exit 1
+    fi
 fi
 
 # Setup workspace
@@ -420,7 +425,7 @@ else
     echo -e "verdict:        ${RED}$verdict${NC}"
     echo ""
     echo "Differences (excluding META-INF):"
-    echo "$diff_output" | head -30
+    { echo "$diff_output" | head -30; } || true
     [[ $(echo "$diff_output" | wc -l) -gt 30 ]] && echo "... (truncated, see $workDir/)"
     exitCode=1
 fi