Make the release process create annotated tags

.github/workflows/release.yaml

@@ -61,8 +61,8 @@ jobs:
         env:
           VERSION: ${{ steps.next.outputs.version }}
         with:
-          result-encoding: string
           # Commit & tag with the actions token, so that they get signed
+          # This returns the commit sha and the tag object sha
           script: |
             const fs = require("fs/promises");
             const [owner, repo] = process.env.GITHUB_REPOSITORY.split("/");
@@ -122,27 +122,29 @@ jobs:
             });
             console.log("Created tag:", tag.data.url);
 
-            return commit.data.sha;
+            return { commit: commit.data.sha, tag: tag.data.sha };
 
       - name: Update the refs
         uses: actions/github-script@v7.0.1
         env:
           VERSION: ${{ steps.next.outputs.version }}
-          COMMIT: ${{ steps.commit.outputs.result }}
+          TAG_SHA: ${{ fromJSON(steps.commit.outputs.result).tag }}
+          COMMIT_SHA: ${{ fromJSON(steps.commit.outputs.result).commit }}
         with:
           # Update the refs with the bot token, so that workflows are triggered
           github-token: ${{ secrets.BOT_GITHUB_TOKEN }}
           script: |
             const [owner, repo] = process.env.GITHUB_REPOSITORY.split("/");
             const version = process.env.VERSION;
-            const commit = process.env.COMMIT;
+            const commit = process.env.COMMIT_SHA;
+            const tag = process.env.TAG_SHA;
             const branch = process.env.GITHUB_REF_NAME;
 
             const tag = await github.rest.git.createRef({
               owner,
               repo,
               ref: `refs/tags/v${version}`,
-              sha: commit,
+              sha: tag,
             });
             console.log("Created tag ref:", tag.data.url);