bug(CI): build-release workflow Build CLI step matching incorrect tag

[mkcp]

Environment

Device and OS: CI
App version: v0.53.0
Kubernetes distro being used: N/A
Other:

Steps to reproduce

1. Cut a tag for a Zarf release candidate. `git tag -sa v0.53.0-rc1 -m "v0.53.0-rc1"
2. rc release is successful
3. Cut a tag for full release `git tag -sa v0.53.0 -m "v0.53.0"

Expected result

build-release matches the v0.53.0 tag and builds Zarf with the correctly tagged version.

Actual Result

build-release Build CLI step matches ...-rc1 and fails to upload because the rc version already exists.

Visual Proof (screenshots, videos, text, etc)

https://github.com/zarf-dev/zarf/actions/runs/14626766601/job/41041598083#step:9:448 https://github.com/zarf-dev/zarf/actions/runs/14626766601/job/41040045394#step:6:6

Severity/Priority

Medium, rcs are useful for managing release risk and ideally we can ship as many as we need before cutting the full release.

Additional Context

Oddly, the checkout step correctly sets the ref to the latest tag, so not sure why git describe --tags is resolving to rc1. We checked this on multiple local machines and each time it resolved to the correct tag (v0.53.0) locally.

[corang]

Might be fixable by providing the tag directly from the workflow rather than relying on git tags --describe

jobs:
  build-release:
    runs-on: large-ubuntu-zarf-release
    permissions:
      id-token: write
      packages: write
    env:
      CLI_VERSION: ${{ github.ref_name }}