[package-alt] Pin git deps to the peeled commit for annotated tags - #27395
Merged
Conversation
mdgeorge4153
temporarily deployed
to
sui-typescript-aws-kms-test-env
July 22, 2026 17:55 — with 
GitHub Actions
Inactive
|
The latest updates on your projects. Learn more about Vercel for GitHub.
2 Skipped Deployments
|
mdgeorge4153
marked this pull request as ready for review
July 23, 2026 17:00
mdgeorge4153
temporarily deployed
to
sui-typescript-aws-kms-test-env
July 23, 2026 17:00 — with
GitHub Actions
Inactive
stefan-mysten
approved these changes
Jul 28, 2026
stefan-mysten
left a comment
Contributor
There was a problem hiding this comment.
Thanks for the fix.
When a git dependency's `rev` names an annotated tag, `find_branch_or_tag_sha`
pinned the sha of the tag object rather than of the commit the tag points at.
The tag object is not reachable through branch history, and moving the tag
orphans it, after which it can no longer be fetched by sha -- so a checked-in
`Move.lock` fails to build on a clean clone or in CI.
Query the peeled ref (`refs/tags/<tag>^{}`) alongside the tag ref and prefer it,
so annotated tags resolve to their commit. Lightweight tags have no peeled line
and are unaffected.
mdgeorge4153
force-pushed
the
mdgeorge/peel-annotated-tags
branch
from
July 30, 2026 16:35
7c2be9d to
59bc437
Compare
mdgeorge4153
temporarily deployed
to
sui-typescript-aws-kms-test-env
July 30, 2026 16:35 — with
GitHub Actions
Inactive
mdgeorge4153
enabled auto-merge (squash)
July 30, 2026 16:51
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
When a git dependency's
revnames an annotated tag, we pinned the sha of the tag object rather than of the commit the tag points at. The tag object is not reachable through branch history, and moving the tag orphans it — after which GitHub will not serve it by sha to a fresh fetch, so a checked-inMove.lockfails to build on a clean clone or in CI. This surfaced via MVR, where the@mysten/attestationsdep pinned a tag object for tagtestnet/v1.Lightweight tags point straight at the commit and were never affected, which is likely why this went unnoticed — the existing test fixtures only created lightweight tags.
Test plan
New tests cover both tag kinds resolving to the commit sha. The annotated-tag test first asserts that
rev-parse <tag>differs from the commit, so it cannot pass trivially if the fixture ever stops producing a real tag object; I confirmed it fails against the old code (resolved the tag object instead of the commit).Release notes
Check each box that your change affects. If none of the boxes relate to your changes, release notes aren't required.
For each box you select, include information after the relevant heading that describes the impact of your changes for a user of that component.
revis an annotated tag now pins to the commit the tag points at instead of the tag object. ExistingMove.lockfiles that pinned a tag object keep their old sha until repinned; you can usesui move update-depsto fix old lockfiles.