fix: Lookup signed tag commit information

__fixtures__/handlers.ts

@@ -33,6 +33,56 @@ export const handlers = [
       })
     }
   ),
+  http.get(
+    'https://api.github.com/repos/octocat/Hello-World/git/ref/tags%2Fv2.1.3',
+    () => {
+      return HttpResponse.json({
+        ref: 'refs/tags/v2.1.3',
+        node_id: 'MDM6UmVmcmVmcy9oZWFkcy9mZWF0dXJlQQ==',
+        url: 'https://api.github.com/repos/octocat/Hello-World/git/refs/tags/v2.1.3',
+        object: {
+          type: 'tag',
+          sha: '7638417db6d59f3c431d3e1f261cc637155684cd',
+          url: 'https://api.github.com/repos/octocat/Hello-World/git/commits/aa218f56b14c9653891f9e74264a383fa43fefbd'
+        }
+      })
+    }
+  ),
+  http.get(
+    'https://api.github.com/repos/octocat/Hello-World/git/tags/7638417db6d59f3c431d3e1f261cc637155684cd',
+    () => {
+      return HttpResponse.json({
+        sha: '7638417db6d59f3c431d3e1f261cc637155684cd',
+        node_id:
+          'TA_kwDOMr1CvdoAKDAyZDJkM2M0NzE0Zjc1MWE2ZGVjZTEwMzJmMDNiMWMyZWFmNmQyYTc==',
+        url: 'https://api.github.com/repos/octocat/Hello-World/git/tags/7638417db6d59f3c431d3e1f261cc637155684cd',
+        tagger: {
+          date: '2014-11-07T22:01:45Z',
+          name: 'Monalisa Octocat',
+          email: 'octocat@github.com'
+        },
+        committer: {
+          date: '2014-11-07T22:01:45Z',
+          name: 'Monalisa Octocat',
+          email: 'octocat@github.com'
+        },
+        tag: 'v2.1.3',
+        message: 'added readme, because im a good github citizen',
+        object: {
+          type: 'commit',
+          sha: 'aa218f56b14c9653891f9e74264a383fa43fefbd',
+          url: 'https://api.github.com/repos/octocat/Hello-World/git/commits/aa218f56b14c9653891f9e74264a383fa43fefbd'
+        },
+        verification: {
+          verified: false,
+          reason: 'unsigned',
+          signature: null,
+          payload: null,
+          verified_at: null
+        }
+      })
+    }
+  ),
   http.get(
     'https://api.github.com/repos/octocat/Hello-World/git/commits/aa218f56b14c9653891f9e74264a383fa43fefbd',
     () => {

__tests__/git.test.ts

@@ -119,7 +119,7 @@ describe('git.ts', () => {
   })
 
   describe('getRef', () => {
-    test.each(['heads/featureA', 'tags/v1.2.3'])(
+    test.each(['heads/featureA', 'tags/v1.2.3', 'tags/v2.1.3'])(
       'returns a Ref via REST API (ref: %s)',
       async (ref) => {
         const result = await git.getRef(ref, github.context, octokit)

src/git.ts

@@ -33,13 +33,26 @@ export async function getRef(
   context: Context,
   octokit: InstanceType<typeof Octokit>
 ): Promise<string> {
-  return (
+  const data = (
     await octokit.request('GET /repos/{owner}/{repo}/git/ref/{ref}', {
       owner: context.repo.owner,
       repo: context.repo.repo,
       ref
     })
-  ).data.object.sha
+  ).data
+
+  // If the ref is a tag, we need to get the commit SHA from the tag object
+  if (data.object.type == 'tag') {
+    return (
+      await octokit.request('GET /repos/{owner}/{repo}/git/tags/{tag_sha}', {
+        owner: context.repo.owner,
+        repo: context.repo.repo,
+        tag_sha: data.object.sha
+      })
+    ).data.object.sha
+  } else if (data.object.type == 'commit') {
+    return data.object.sha
+  } else throw Error(`Unsupported ref type: ${data.object.type}`)
 }
 
 export async function getTree(