Restore the tag object before checking that it is annotated

[wtgee]

The v0.5.0 release run failed with "v0.5.0 is a lightweight tag". The tag is not lightweight — the guard was reading a ref actions/checkout had replaced.

The tag is annotated

7125729b034ebe5e43f97133e53528168d996288	refs/tags/v0.5.0
48f226630f6e6c04a3d1ceda6b7d0f14a22da34f	refs/tags/v0.5.0^{}

A tag object dereferencing to 48f2266 — the same shape as v0.4.0. A lightweight tag has no ^{} line.

What the runner sees instead

For a tag push, actions/checkout fetches the commit SHA into the tag ref — +<sha>:refs/tags/<name> — so the checkout holds a lightweight tag whatever the remote carries. Reproduced against this repository:

$ git fetch --no-tags --depth=1 origin +48f226630f6e6c04a3d1ceda6b7d0f14a22da34f:refs/tags/v0.5.0
 * [new ref]  48f2266... -> v0.5.0

$ git cat-file -t v0.5.0
commit

$ git tag --list --format='%(contents)' v0.5.0
Cut 0.5.0 (#36)

Rolls the Unreleased section under a version heading. …

%(contents) returns the squash commit's subject. That is precisely the failure the guard was written for, so it was right to stop — it just attributed the cause to the tag rather than to the checkout.

The fix

Re-fetch the tag ref before the check. Verified on the same clone:

$ git fetch --force origin refs/tags/v0.5.0:refs/tags/v0.5.0
 t [tag update]  v0.5.0 -> v0.5.0

$ git cat-file -t v0.5.0
tag

$ git tag --list --format='%(contents)' v0.5.0
panoptes-data 0.5.0

This release moves the package onto the documents `panoptes-pipeline` writes …

The guard itself is unchanged. It is the only reason a commit subject did not ship as the 0.5.0 release notes, and it should keep failing a genuinely lightweight tag.

Retagging is required

A tag push runs the workflow from the tagged commit, so v0.5.0 still carries the old file and re-running its job will fail the same way. Once this is on main:

git push origin --delete v0.5.0
git tag -d v0.5.0
git fetch origin && git checkout main && git pull
git tag -a v0.5.0 -F <notes-file>          # the notes are unchanged
git push origin v0.5.0

Nothing was published, so deleting the tag costs nothing — the run failed at the first step, before the build and well before the PyPI upload. That ordering was deliberate.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AnfKKSA7RyCwvsWhzyZ8zj

---

Generated by Claude Code