Restore signed tag refs in release jobs

.github/workflows/release.yml

@@ -18,6 +18,7 @@ jobs:
     outputs:
       commit: ${{ steps.release.outputs.commit }}
       version: ${{ steps.release.outputs.version }}
+      tag_object: ${{ steps.release.outputs.tag_object }}
     defaults:
       run:
         shell: bash
@@ -39,9 +40,13 @@ jobs:
           STORAGEPRIMS_REQUIRE_TAG: '1'
         run: |
           set -euo pipefail
+          ./scripts/release-restore-tag-ref.sh
           ./scripts/release-guard-tag-version.sh
-          printf 'commit=%s\n' "$(git rev-parse HEAD)" >>"$GITHUB_OUTPUT"
-          printf 'version=%s\n' "$(cat VERSION)" >>"$GITHUB_OUTPUT"
+          {
+            printf 'tag_object=%s\n' "$(git rev-parse "refs/tags/$STORAGEPRIMS_RELEASE_TAG")"
+            printf 'commit=%s\n' "$(git rev-parse HEAD)"
+            printf 'version=%s\n' "$(cat VERSION)"
+          } >>"$GITHUB_OUTPUT"
       - name: Verify package archives without publishing
         run: make release-check
   verify-signature:
@@ -61,8 +66,10 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
           STORAGEPRIMS_RELEASE_TAG: ${{ github.ref_name }}
+          STORAGEPRIMS_EXPECTED_TAG_OBJECT: ${{ needs.validate.outputs.tag_object }}
         run: |
           set -euo pipefail
+          ./scripts/release-restore-tag-ref.sh
           ./scripts/verify-pinned-tag.sh
           EXPECTED_OBJECT="$(git rev-parse "refs/tags/$STORAGEPRIMS_RELEASE_TAG")"
           tag_json="$(gh api "repos/3leaps/storageprims/git/tags/$EXPECTED_OBJECT")"
@@ -196,6 +203,7 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ github.token }}
           STORAGEPRIMS_RELEASE_TAG: ${{ github.ref_name }}
+          STORAGEPRIMS_EXPECTED_TAG_OBJECT: ${{ needs.validate.outputs.tag_object }}
           STORAGEPRIMS_REQUIRE_TAG: '1'
         run: |
           set -euo pipefail
@@ -205,6 +213,7 @@ jobs:
             git config --local --unset-all http.https://github.com/.extraheader || true
           }
           trap cleanup_credentials EXIT
+          ./scripts/release-restore-tag-ref.sh
           ./scripts/release-guard-tag-version.sh
           cleanup_credentials
           trap - EXIT
@@ -215,15 +224,15 @@ jobs:
           GH_TOKEN: ${{ github.token }}
           STORAGEPRIMS_RELEASE_TAG: ${{ github.ref_name }}
         run: ./scripts/check-draft-release.sh before
-      - name: Create draft GitHub release
-        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65  # v2
-        with:
-          draft: true
-          prerelease: false
-          target_commitish: ${{ needs.validate.outputs.commit }}
-          body_path: docs/releases/${{ github.ref_name }}.md
-          files: |
-            dist/release/*
+      - name: Create new unsigned draft with exact assets
+        env:
+          GH_TOKEN: ${{ github.token }}
+          STORAGEPRIMS_RELEASE_TAG: ${{ github.ref_name }}
+          STORAGEPRIMS_EXPECTED_COMMIT: ${{ needs.validate.outputs.commit }}
+          STORAGEPRIMS_EXPECTED_TAG_OBJECT: ${{ needs.validate.outputs.tag_object }}
+        run: |
+          set -euo pipefail
+          ./scripts/release-create-draft.sh
       - name: Verify exact draft state and remote inventory
         env:
           GH_TOKEN: ${{ github.token }}

Makefile

@@ -549,8 +549,8 @@ release-crates-verify: ## Wait for the final registry version and verify each pu
 	@CRATE="$(CRATE)" ./scripts/release-crates-verify.sh
 
 release-tooling-test: ## Run release guard, asset, cleanup, and hygiene tests
-	@./scripts/release-recovery-guard.test.sh
-	@./scripts/release-recovery-create-draft.test.sh
+	@./scripts/release-restore-tag-ref.test.sh
+	@./scripts/release-create-draft.test.sh
 	@./scripts/release-decernor.test.sh
 	@./scripts/release-pin-precursors.test.sh
 	@./scripts/release-tag-controls.test.sh

RELEASE_CHECKLIST.md

@@ -187,11 +187,9 @@ output, not a claim of protection or an exception to signature checks. Neither
 target loads a secret from the repository or creates a tag implicitly during
 the push step. Stop on any failing target; do not replace an existing tag.
 
-- [ ] Confirm the tag workflow is green, or the separately authorized
-      `v0.1.2` draft-recovery workflow is green for the existing signed tag.
-      Recovery runs from reviewed `main` with the approved tag object and
-      tagged commit, refuses an existing release, and creates only an unsigned
-      draft. Never recreate, move or force-push the signed tag.
+- [ ] Confirm the tag workflow is green and its exact unsigned draft exists.
+      Stop on failure; never move or replace a signed tag without a separate
+      explicit maintainer decision.
 - [ ] Confirm the tag has GitHub **Verified** status and the
       `verify-signature` gate passed before a draft is created
 - [ ] Confirm the GitHub release is still a draft

docs/cicd.md

@@ -60,7 +60,7 @@ recovery without recreating or moving a published signed tag. See the
 [release checklist](../RELEASE_CHECKLIST.md) for the distinct local-tag,
 remote-push, and later signing steps.
 
-The separately authorized `v0.1.2` draft-recovery workflow is dispatched from
-reviewed `main` with the existing signed tag object and tagged commit. It
-verifies the committed public pin and GitHub signature, builds unsigned assets
-from the tagged tree, refuses to overwrite a release, and creates a draft only.
+After checkout, the tag-triggered workflow restores the runner-local annotated
+ref from origin before validation, signature verification, and draft inventory
+checks. Draft creation uses a create-only request; a release conflict or partial
+asset upload stops for inspection without replacing an existing release.