ci(release): require root-owned tags

Signed-off-by: Danil Silantyev <danilsilantyevwork@gmail.com>

Author: rldyourmnd

.github/workflows/release.yml

@@ -7,7 +7,7 @@ on:
   workflow_dispatch:
     inputs:
       version:
-        description: "Version to release from VERSION (numeric SemVer X.Y.Z). Creates the tag when dispatching manually."
+        description: "Numeric SemVer X.Y.Z; manual dispatch only verifies an existing tag."
         required: true
         type: string
 
@@ -34,13 +34,16 @@ jobs:
           egress-policy: audit
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
       - name: Set up Python
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.13"
       - name: Install validation dependencies
         run: python3 -m pip install --user "pytest==9.1.1" "pytest-cov==7.1.0"
-      - name: Resolve release version
+      - name: Resolve existing release tag
         env:
           INPUT_VERSION: ${{ inputs.version }}
           EVENT_NAME: ${{ github.event_name }}
@@ -49,6 +52,7 @@ jobs:
           set -euo pipefail
           if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
             version="$INPUT_VERSION"
+            echo "manual dispatch only verifies an existing tag"
           else
             version="$REF_NAME"
           fi
@@ -61,19 +65,41 @@ jobs:
             echo "release version '$version' does not match VERSION '$file_version'" >&2
             exit 1
           fi
+
+          remote_ref="refs/tags/${version}"
+          remote_match="$(git ls-remote --refs origin "$remote_ref")"
+          remote_count="$(printf '%s\n' "$remote_match" | awk 'NF { count++ } END { print count + 0 }')"
+          if [ "$remote_count" -ne 1 ]; then
+            echo "Expected exactly one existing remote tag $remote_ref" >&2
+            exit 1
+          fi
+          read -r remote_oid remote_name <<< "$remote_match"
+          if [ "$remote_name" != "$remote_ref" ]; then
+            echo "Remote returned unexpected ref $remote_name" >&2
+            exit 1
+          fi
+          git fetch --no-tags --force origin "$remote_ref:$remote_ref"
+          local_oid="$(git rev-parse --verify "$remote_ref")"
+          if [ "$local_oid" != "$remote_oid" ]; then
+            echo "Fetched tag object does not match $remote_ref on origin" >&2
+            exit 1
+          fi
+          tag_commit="$(git rev-parse --verify "${remote_ref}^{commit}")"
+
+          git fetch --no-tags --force origin main:refs/remotes/origin/main
+          if [ "$EVENT_NAME" = "push" ]; then
+            git merge-base --is-ancestor "$GITHUB_SHA" origin/main
+            if [ "$tag_commit" != "$GITHUB_SHA" ]; then
+              echo "Pushed tag peels to $tag_commit, not event commit $GITHUB_SHA" >&2
+              exit 1
+            fi
+          else
+            git merge-base --is-ancestor "$tag_commit" origin/main
+          fi
+          git checkout --detach "$tag_commit"
           printf 'RELEASE_VERSION=%s\n' "$version" >> "$GITHUB_ENV"
       - name: Validate release
         run: scripts/validate_release.sh
-      - name: Create release tag (workflow_dispatch only)
-        if: github.event_name == 'workflow_dispatch'
-        run: |
-          set -euo pipefail
-          if git rev-parse -q --verify "refs/tags/${RELEASE_VERSION}" >/dev/null; then
-            echo "Tag ${RELEASE_VERSION} already exists locally"
-          else
-            git tag "${RELEASE_VERSION}"
-            git push origin "refs/tags/${RELEASE_VERSION}"
-          fi
       - name: Build source archive
         run: |
           set -euo pipefail