Add branch prefix to scope labels, use signed tags

- Prefix "branch " to scope labels in issues, metrics, reportcard, and
  vulnerabilities commands so output reads "branch main" instead of "main"
- Switch deploy tags from annotated (-a) to signed (-s) in justfile

Author: jai-deepsource

command/issues/issues.go

@@ -474,13 +474,13 @@ func (opts *IssuesOptions) scopeLabel() string {
 	switch {
 	case opts.autoDetectedBranch != "":
 		if opts.CommitOid == "" {
-			return opts.autoDetectedBranch
+			return "branch " + opts.autoDetectedBranch
 		}
 		short := opts.CommitOid
 		if len(short) > 8 {
 			short = short[:8]
 		}
-		return opts.autoDetectedBranch + " (" + short + ")"
+		return "branch " + opts.autoDetectedBranch + " (" + short + ")"
 	case opts.CommitOid != "":
 		short := opts.CommitOid
 		if len(short) > 8 {

command/metrics/metrics.go

@@ -292,13 +292,13 @@ func (opts *MetricsOptions) scopeLabel() string {
 	switch {
 	case opts.autoDetectedBranch != "":
 		if opts.CommitOid == "" {
-			return opts.autoDetectedBranch
+			return "branch " + opts.autoDetectedBranch
 		}
 		commitShort := opts.CommitOid
 		if len(commitShort) > 8 {
 			commitShort = commitShort[:8]
 		}
-		return fmt.Sprintf("%s (%s)", opts.autoDetectedBranch, commitShort)
+		return fmt.Sprintf("branch %s (%s)", opts.autoDetectedBranch, commitShort)
 	case opts.runMetrics != nil:
 		commitShort := opts.runMetrics.CommitOid
 		if len(commitShort) > 7 {

command/reportcard/reportcard.go

@@ -300,7 +300,7 @@ func (opts *ReportCardOptions) scopeLabel() string {
 		if len(commitShort) > 8 {
 			commitShort = commitShort[:8]
 		}
-		return fmt.Sprintf("%s (%s)", opts.branchName, commitShort)
+		return fmt.Sprintf("branch %s (%s)", opts.branchName, commitShort)
 	case opts.CommitOid != "":
 		commitShort := opts.CommitOid
 		if len(commitShort) > 8 {

command/vulnerabilities/vulnerabilities.go

@@ -304,13 +304,13 @@ func (opts *VulnerabilitiesOptions) scopeLabel() string {
 	switch {
 	case opts.autoDetectedBranch != "":
 		if opts.CommitOid == "" {
-			return opts.autoDetectedBranch
+			return "branch " + opts.autoDetectedBranch
 		}
 		commitShort := opts.CommitOid
 		if len(commitShort) > 8 {
 			commitShort = commitShort[:8]
 		}
-		return fmt.Sprintf("%s (%s)", opts.autoDetectedBranch, commitShort)
+		return fmt.Sprintf("branch %s (%s)", opts.autoDetectedBranch, commitShort)
 	case opts.runVulns != nil:
 		commitShort := opts.runVulns.CommitOid
 		if len(commitShort) > 7 {

justfile

@@ -69,7 +69,7 @@ deploy-prod:
 	version=$(cat VERSION)
 	tag="v${version}"
 	echo "Creating tag ${tag}..."
-	git tag -a "${tag}" -m "Release ${tag}"
+	git tag -s "${tag}" -m "Release ${tag}"
 	git push origin "${tag}"
 	echo "Pushed ${tag} — build-and-deploy workflow triggered"
 
@@ -81,6 +81,6 @@ deploy-dev:
 	hash=$(git rev-parse --short HEAD)
 	tag="v${version}-${hash}"
 	echo "Creating dev tag ${tag}..."
-	git tag -a "${tag}" -m "Dev release ${tag}"
+	git tag -s "${tag}" -m "Dev release ${tag}"
 	git push origin "${tag}"
 	echo "Pushed ${tag} — dev build-and-deploy workflow triggered"