Bind runtime releases to protected source tags [skip ci]

.gitea/workflows/runtime-distribution.yml

@@ -92,6 +92,15 @@ jobs:
               if image_pattern.fullmatch(os.environ[name]) is None:
                   raise SystemExit(f"{name} must be an exact sha256 image reference")
           PY
+      - name: Resolve immutable release source
+        working-directory: govoplan
+        env:
+          VERSION: ${{ inputs.version }}
+        run: |
+          git fetch --force --no-tags origin "refs/tags/v$VERSION:refs/tags/v$VERSION"
+          mkdir -p runtime-output
+          git rev-parse "v$VERSION^{commit}" > runtime-output/release-source-commit
+          grep -Eq '^[0-9a-f]{40}$' runtime-output/release-source-commit
       - name: Use HTTPS for GovOPlaN repositories
         run: |
           git config --global --add url."https://git.add-ideas.de/GovOPlaN/govoplan".insteadOf "git@git.add-ideas.de:GovOPlaN/govoplan"
@@ -255,7 +264,6 @@ jobs:
         working-directory: govoplan
         env:
           VERSION: ${{ inputs.version }}
-          SOURCE_COMMIT: ${{ gitea.sha }}
           SIGNING_KEY: ${{ secrets.RUNTIME_DISTRIBUTION_SIGNING_KEY }}
           SIGNING_KEY_ID: ${{ secrets.RUNTIME_DISTRIBUTION_SIGNING_KEY_ID }}
           TRUSTED_KEYRING: ${{ secrets.RUNTIME_DISTRIBUTION_KEYRING }}
@@ -266,6 +274,7 @@ jobs:
           GARAGE_IMAGE: ${{ inputs.garage_image }}
           TEST_MAIL_IMAGE: ${{ inputs.test_mail_image }}
         run: |
+          SOURCE_COMMIT="$(cat runtime-output/release-source-commit)"
           test -n "$SIGNING_KEY"
           test -n "$SIGNING_KEY_ID"
           test -n "$TRUSTED_KEYRING"
@@ -363,9 +372,9 @@ jobs:
         working-directory: govoplan
         env:
           VERSION: ${{ inputs.version }}
-          SOURCE_COMMIT: ${{ gitea.sha }}
           GITEA_RELEASE_TOKEN: ${{ secrets.GOVOPLAN_RELEASE_TOKEN }}
         run: |
+          SOURCE_COMMIT="$(cat runtime-output/release-source-commit)"
           python tools/release/publish-runtime-release.py \
             --tag "v$VERSION" \
             --target-commit "$SOURCE_COMMIT" \