release: refetch the annotated tag object that checkout replaces

.gitea/workflows/release.yml

@@ -171,6 +171,13 @@ jobs:
         run: |
           set -euo pipefail
 
+          # actions/checkout on a tag ref fetches the *commit* SHA into
+          # refs/tags/<tag>, silently replacing the annotated tag object with a
+          # lightweight tag. Without this refetch, every signed tag reads as
+          # unannotated and the check below refuses it. --force because that
+          # wrong local ref already exists.
+          git fetch --force --no-tags origin "refs/tags/$TAG:refs/tags/$TAG"
+
           if [ "$(git cat-file -t "refs/tags/$TAG")" != "tag" ]; then
             echo "refusing '$TAG': not an annotated tag, so it carries no signature"
             exit 1
@@ -491,6 +498,11 @@ jobs:
             exit 1
           fi
 
+          # Same refetch as the guard: checkout replaced the annotated tag
+          # object with a lightweight one, and the tagger date below needs the
+          # real object.
+          git fetch --force --no-tags origin "refs/tags/$TAG:refs/tags/$TAG"
+
           version="${TAG#v}"
           tag_commit=$(git rev-parse "refs/tags/$TAG^{commit}")
           epoch=$(git for-each-ref --format='%(taggerdate:unix)' "refs/tags/$TAG")