Read an existing tag through git/ref/tags in publish_release.py, following an annotated tag to its commit

README.md

@@ -1148,7 +1148,7 @@ the files the build and its tests read, nor the workflow itself, in which case
 it's skipped. That build is the whole gate but the
 changelog check, which CI runs against the PR base — vet, complexity, format check
 and tests — so run it locally before pushing. The lowest Go builds the `portable`
-stage, all of that bar the format check:
+stage, all of that bar the format check and the release tooling's tests:
 
 ```sh
 docker build .                                                  # latest

release-tooling/publish_release.py

@@ -47,9 +47,11 @@ def main() -> int:
 			raise
 	sha = os.environ["SHA"]
 	try:
-		at = request(f"tags/{tag}")["commit"]["sha"]
-		if at != sha:
-			print(f"{tag} exists at {at}, not {sha}; the version is burnt, bump the heading", file=sys.stderr)
+		at = request(f"git/ref/tags/{tag}")["object"]
+		if at["type"] == "tag":
+			at = request(f"git/tags/{at['sha']}")["object"]
+		if at["sha"] != sha:
+			print(f"{tag} exists at {at['sha']}, not {sha}; the version is burnt, bump the heading", file=sys.stderr)
 			return 1
 	except urllib.error.HTTPError as e:
 		if e.code != 404: