From 9ab95cc1f623dc8206bd23cd91ad846e8e651ec7 Mon Sep 17 00:00:00 2001
From: Jean-Emmanuel BAILLAT <baillatjean-emmanuel@hotmail.com>
Date: Sun, 2 Aug 2026 18:35:50 +0200
Subject: [PATCH] fix: refresh canonical release tags

---
 .github/workflows/publish.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 18fca0b..7675688 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -42,7 +42,10 @@ jobs:
           SOURCE_REF: ${{ github.event.inputs.source_ref }}
         run: |
           git fetch --no-tags origin '+refs/heads/*:refs/remotes/origin/*'
-          git fetch --tags origin
+          # actions/checkout can materialize an annotated trigger tag as a local ref
+          # targeting the peeled commit. Refresh from the immutable remote tag object
+          # so provenance checks compare the canonical annotation and target.
+          git fetch --force --tags origin
 
           if [[ "${{ github.event_name }}" == "workflow_dispatch" && -n "$SOURCE_REF" ]]; then
             if RESOLVED_SHA=$(git rev-parse --verify --end-of-options "${SOURCE_REF}^{commit}" 2>/dev/null); then