cicd: ensure tag object is fetched for signature verification

Author: 0xCyr

.github/workflows/release.yml

@@ -1,9 +1,12 @@
 name: Create Release
 
 on:
-  push:
-    tags:
-      - 'v*'  # Trigger on any tag starting with 'v'
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Git tag to release (e.g., v1.2.3)'
+        required: true
+        type: string
 
 jobs:
   verify-and-release:
@@ -13,22 +16,70 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          fetch-tags: true
+
+      - name: Validate tag format
+        run: |
+          TAG="${{ github.event.inputs.tag }}"
+          if [[ ! $TAG =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "❌ Invalid tag format. Expected format: v1.2.3"
+            exit 1
+          fi
+          echo "✅ Tag format is valid: $TAG"
+
+      - name: Verify tag exists
+        run: |
+          TAG="${{ github.event.inputs.tag }}"
+          if ! git rev-parse --verify "refs/tags/$TAG" >/dev/null 2>&1; then
+            echo "❌ Tag '$TAG' does not exist in the repository"
+            echo "Available tags:"
+            git tag --sort=-version:refname | head -10
+            exit 1
+          fi
+          echo "✅ Tag '$TAG' exists"
+
+      - name: Checkout specific tag
+        run: |
+          git checkout ${{ github.event.inputs.tag }}
 
       - name: Verify GPG signature on tag
         run: |
+          TAG="${{ github.event.inputs.tag }}"
+          
+          # Force fetch the complete tag object (not just commit reference)
+          echo "=== Fetching Tag Object ==="
+          git fetch origin tag $TAG --force
+          
+          # Debug: Show what type of object we have
+          echo "=== Tag Object Debug ==="
+          git cat-file -t $TAG
+          echo "Tag points to commit: $(git rev-parse $TAG^{})"
+          echo "Tag object hash: $(git rev-parse $TAG)"
+          echo "=== End Tag Debug ==="
+          
           # Import public key for verification
-          echo "${{ secrets.GPG_PUBLIC_KEY }}" | gpg --import
+          echo "=== Importing GPG Key ==="
+          echo '${{ secrets.GPG_PUBLIC_KEY }}' > /tmp/pubkey.asc
+          head -3 /tmp/pubkey.asc
+          gpg --import /tmp/pubkey.asc
+          echo "=== GPG Key Imported ==="
           
           # Verify the tag is properly signed
-          git tag -v ${{ github.ref_name }}
+          echo "=== Verifying Tag Signature ==="
+          git tag -v $TAG
           
           echo "✅ Tag signature verified"
+          
+          # Cleanup
+          rm /tmp/pubkey.asc
 
       - name: Get version from tag
         id: get_version
         run: |
-          VERSION=${GITHUB_REF#refs/tags/v}
+          TAG="${{ github.event.inputs.tag }}"
+          VERSION=${TAG#v}
           echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "tag=$TAG" >> $GITHUB_OUTPUT
 
       - name: Package repository
         run: |
@@ -55,17 +106,18 @@ jobs:
       - name: Extract release notes from tag
         id: release_notes
         run: |
+          TAG="${{ github.event.inputs.tag }}"
           # Extract release notes from signed tag message
-          NOTES=$(git tag -l --format='%(contents)' ${{ github.ref_name }})
+          NOTES=$(git tag -l --format='%(contents)' $TAG)
           echo "notes<<EOF" >> $GITHUB_OUTPUT
           echo "$NOTES" >> $GITHUB_OUTPUT
           echo "EOF" >> $GITHUB_OUTPUT
 
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v2.2.2
         with:
-          tag_name: ${{ github.ref_name }}
-          name: Fractum ${{ github.ref_name }}
+          tag_name: ${{ steps.get_version.outputs.tag }}
+          name: Fractum ${{ steps.get_version.outputs.tag }}
           body: |
             ## 🔐 Security Verification
             
@@ -80,7 +132,7 @@ jobs:
             gpg --import fractum-signing-key.asc
             
             # Verify tag signature
-            git tag -v ${{ github.ref_name }}
+            git tag -v ${{ steps.get_version.outputs.tag }}
             
             # Verify package checksum
             sha256sum -c checksums.txt
@@ -104,5 +156,5 @@ jobs:
       - name: Update website release info
         run: |
           echo "🚀 Released Fractum ${{ steps.get_version.outputs.version }}"
-          echo "Tag: ${{ github.ref_name }}"
+          echo "Tag: ${{ steps.get_version.outputs.tag }}"
           echo "Signature verified: ✅"