Function resolve_git_kernel 

pub fn resolve_git_kernel(
    url: &str,
    git_ref: &str,
    ref_kind: GitRefKind,
    cli_label: &str,
    mp: Option<&FetchProgress>,
    force: bool,
    clean: bool,
    cpu_cap: Option<CpuCap>,
    extra_kconfig: Option<&str>,
) -> Result<PathBuf>

Resolve a git+URL#tag=/#branch=/#sha= kernel spec to a cache-entry directory.

Mirrors download_and_cache_version for the git source path. To avoid an unconditional fetch, it FIRST resolves git_ref to its commit via a KIND-directed ls-remote (a Sha resolves offline; a Tag/Branch matches its fully-qualified ref so a tag never aliases a same-named branch — see crate::fetch::resolve_ref_commit) and probes the cache for the key that resolution produces (crate::fetch::git_cache_key); on a hit it returns the cached entry WITHOUT any download.

On a cache miss the fetch is routed by source:

• GitHub (github.com/OWNER/REPO, via crate::fetch::github_archive_url): a codeload tar.gz snapshot of the RESOLVED COMMIT (crate::fetch::download_github_archive) — no clone, and the exact-commit snapshot matches the cache key even if a branch tip advances between the ls-remote probe and the GET.
• Non-GitHub, or a ref whose ls-remote resolution failed: a kind-directed shallow clone into a temp directory (crate::fetch::git_clone_kinded → git_clone_tag for a tag, git_clone for a branch; a sha is unsupported off GitHub). The clone resolves the tip authoritatively, catching a hit the ls-remote probe missed.

On a final miss it delegates to kernel_build_pipeline for configure/build/validate/cache. Returns the cache entry directory path — the same shape download_and_cache_version returns and callers feed into the crate::KTSTR_KERNEL_ENV export.

The cache key embeds git_ref verbatim (/ and .. sanitized — see crate::fetch::git_cache_key) alongside the resolved commit’s full 40-hex hash, so two invocations with identical-sha-different-git_ref spellings remain distinct cache entries (collapsing those to one is separate future work — see crate::kernel_path::KernelId::Git).

cli_label matches the contract the sibling helpers (download_and_cache_version, resolve_kernel_dir) use: it prefixes diagnostic status output and is threaded into kernel_build_pipeline.

mp is the progress group the download/clone bar is added to (the parallel resolve’s shared group). Forwarded to the codeload download and the clone; None disables the bar.

Build flags shared with cargo ktstr kernel build --kernel git+…: force skips both cache probes so the ref is refetched and rebuilt; clean, cpu_cap, and extra_kconfig thread into kernel_build_pipeline (an extra_kconfig fragment also appends its -xkc{hash} suffix to the cache key so an extras build lands a distinct slot). The auto-discovery test path passes false / None for all four; only kernel build populates them.