From 43ba72f3fd5b717f0cac3d5d50ad41f3ab9583a1 Mon Sep 17 00:00:00 2001
From: wangzhizhou <824219521@qq.com>
Date: Mon, 9 Nov 2026 11:49:26 +0800
Subject: [PATCH] fix: fetch the annotated tag object before verifying its
 signature

checkout turns a tag push into a lightweight ref, so the verification step saw a commit object and
failed with 'cannot verify a non-tag object of type commit'.

Signed-off-by: wangzhizhou <824219521@qq.com>
---
 .github/workflows/release.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index aba33ab7..cdf42e0d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -55,6 +55,9 @@ jobs:
             echo "::warning::签名 tag 校验尚未启用（缺少 ${signers}）；提交允许的签名者公钥后自动生效。"
             exit 0
           fi
+          # actions/checkout 在 tag push 上会把 refs/tags/<tag> 直接指向提交（轻量引用），
+          # 这样 git tag -v 会报 "cannot verify a non-tag object of type commit"。先取回注解 tag 对象。
+          git fetch --force origin "+refs/tags/${tag}:refs/tags/${tag}"
           git config gpg.format ssh
           git config gpg.ssh.allowedSignersFile "$signers"
           git tag -v "$tag"