From 999e863c6420a8ff2277b9c21233045c87ef6558 Mon Sep 17 00:00:00 2001
From: Nene7ko_ <1604009816@qq.com>
Date: Mon, 17 Aug 2026 19:31:59 +0800
Subject: [PATCH] fix: preserve annotated release tag verification

---
 .github/workflows/release.yml | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 04aee4e..138fbc3 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -26,8 +26,11 @@ jobs:
             echo 'release tag must be a stable semantic version such as v0.1.0' >&2
             exit 1
           fi
-          test "$(git cat-file -t "refs/tags/$GITHUB_REF_NAME")" = tag
-          test "$(git rev-list -n 1 "refs/tags/$GITHUB_REF_NAME")" = "$GITHUB_SHA"
+          release_verify_ref="refs/tags/release-verify"
+          git fetch --force --no-tags origin "refs/tags/$GITHUB_REF_NAME:$release_verify_ref"
+          test "$(git cat-file -t "$release_verify_ref")" = tag
+          test "$(git rev-list -n 1 "$release_verify_ref")" = "$GITHUB_SHA"
+          test "$(git rev-parse HEAD)" = "$GITHUB_SHA"
 
       - name: Authenticate to GHCR
         shell: bash