Bind runtime releases to protected source tags [skip ci]

tests/test_runtime_distribution_build.py

@@ -163,7 +163,7 @@ class RuntimeDistributionBuildTests(unittest.TestCase):
         )
         self.assertNotIn(".platforms[\\\"linux/amd64\\\"]", workflow)
 
-    def test_workflow_binds_the_release_tag_to_the_workflow_commit(self) -> None:
+    def test_workflow_binds_distribution_to_the_peeled_release_tag(self) -> None:
         workflow = (ROOT / ".gitea/workflows/runtime-distribution.yml").read_text(
             encoding="utf-8"
         )
@@ -171,7 +171,21 @@ class RuntimeDistributionBuildTests(unittest.TestCase):
             encoding="utf-8"
         )
 
-        self.assertIn("SOURCE_COMMIT: ${{ gitea.sha }}", workflow)
+        self.assertIn(
+            'git fetch --force --no-tags origin "refs/tags/v$VERSION:refs/tags/v$VERSION"',
+            workflow,
+        )
+        self.assertIn(
+            'git rev-parse "v$VERSION^{commit}" > runtime-output/release-source-commit',
+            workflow,
+        )
+        self.assertEqual(
+            2,
+            workflow.count(
+                'SOURCE_COMMIT="$(cat runtime-output/release-source-commit)"'
+            ),
+        )
+        self.assertNotIn("SOURCE_COMMIT: ${{ gitea.sha }}", workflow)
         self.assertIn('--target-commit "$SOURCE_COMMIT"', workflow)
         self.assertIn('"target_commitish": target_commit', publisher)
         self.assertIn("self._resolve_commit(tag) != target_commit", publisher)