allow an explicit git ref to be passed so we can checkout any ref regardless of the git url

git/git.go

@@ -34,6 +34,7 @@ type CloneRepoOptions struct {
 
 	RepoURL      string
 	RepoAuth     transport.AuthMethod
+	GitRef       string
 	Progress     sideband.Progress
 	Insecure     bool
 	SingleBranch bool
@@ -84,6 +85,8 @@ func CloneRepo(ctx context.Context, logf func(string, ...any), opts CloneRepoOpt
 	reference := parsed.Fragment
 	if reference == "" && opts.SingleBranch {
 		reference = "refs/heads/main"
+	} else if reference == "" && opts.GitRef != "" {
+		reference = opts.GitRef
 	}
 	parsed.RawFragment = ""
 	parsed.Fragment = ""
@@ -343,6 +346,7 @@ func CloneOptionsFromOptions(logf func(string, ...any), options options.Options)
 
 	cloneOpts := CloneRepoOptions{
 		RepoURL:      options.GitURL,
+		GitRef:       options.GitRef,
 		Path:         options.WorkspaceFolder,
 		Storage:      options.Filesystem,
 		Insecure:     options.Insecure,

options/options.go

@@ -120,6 +120,8 @@ type Options struct {
 	GitSSHPrivateKeyBase64 string
 	// GitHTTPProxyURL is the URL for the HTTP proxy. This is optional.
 	GitHTTPProxyURL string
+	// GitRef is the git ref to checkout after clone. This is optional.
+	GitRef string
 	// WorkspaceFolder is the path to the workspace folder that will be built.
 	// This is optional.
 	WorkspaceFolder string
@@ -383,6 +385,12 @@ func (o *Options) CLI() serpent.OptionSet {
 			Value:       serpent.StringOf(&o.GitPassword),
 			Description: "The password to use for Git authentication. This is optional.",
 		},
+		{
+			Flag:        "git-ref",
+			Env:         WithEnvPrefix("GIT_REF"),
+			Value:       serpent.StringOf(&o.GitRef),
+			Description: "The git ref to checkout for Git repositories. This is optional.",
+		},
 		{
 			Flag:  "git-ssh-private-key-path",
 			Env:   WithEnvPrefix("GIT_SSH_PRIVATE_KEY_PATH"),