[content-init] Make 'GitInitializer.realizeCloneTarget' always checko…

…ut the correct revision, even for older clones (e.g. incremental prebuild)

We previously assumed that a prebuild snapshot holds the latest commits,
but this changes with incremental prebuilds (where an older prebuild
doesn't have the latest commits, but 'origin' does).

Fixes #4167 (comment)

components/content-service/pkg/initializer/git.go

@@ -93,21 +93,25 @@ func (ws *GitInitializer) realizeCloneTarget(ctx context.Context) (err error) {
 
 	// checkout branch
 	if ws.TargetMode == RemoteBranch {
-		// create local branch based on remote
+		// create local branch based on specific remote branch
 		if err := ws.Git(ctx, "checkout", "-B", ws.CloneTarget, "origin/"+ws.CloneTarget); err != nil {
 			return err
 		}
 	} else if ws.TargetMode == LocalBranch {
-		if err := ws.Git(ctx, "checkout", "-b", ws.CloneTarget); err != nil {
+		// checkout local branch based on remote HEAD
+		if err := ws.Git(ctx, "checkout", "-B", ws.CloneTarget, "origin/HEAD"); err != nil {
 			return err
 		}
 	} else if ws.TargetMode == RemoteCommit {
 		// checkout specific commit
 		if err := ws.Git(ctx, "checkout", ws.CloneTarget); err != nil {
 			return err
 		}
-	} else { //nolint:staticcheck
-		// nothing to do - we're already on the remote branch
+	} else {
+		// update to remote HEAD
+		if err := ws.Git(ctx, "reset", "--hard", "origin/HEAD"); err != nil {
+			return err
+		}
 	}
 	return nil
 }