fix: handle both lightweight and annotated tags in lshpack update action (#21413)

## What does this PR do?

Fixes the failing `update-lshpack.yml` GitHub Action that has been
consistently failing with the error: "Could not fetch SHA for tag v2.3.4
@ {SHA}".

## Root Cause

The workflow assumed all Git tags are annotated tags that need to be
dereferenced via the GitHub API. However, some tags (like lightweight
tags) point directly to commits and don't need dereferencing. When the
script tried to dereference a lightweight tag, the API call failed.

## Fix

This PR updates the workflow to:

1. **Check the tag type** before attempting to dereference
2. **For annotated tags** (`type="tag"`): dereference to get the commit
SHA via `/git/tags/{sha}`
3. **For lightweight tags** (`type="commit"`): use the SHA directly
since it already points to the commit

## Changes Made

- Updated `.github/workflows/update-lshpack.yml` to properly handle both
lightweight and annotated Git tags
- Added proper tag type checking before attempting to dereference tags
- Improved error messages to distinguish between tag types

## Testing

The workflow will now handle both types of Git tags properly:
- ✅ Annotated tags: properly dereferences to get commit SHA  
- ✅ Lightweight tags: uses the tag SHA directly as commit SHA

This should resolve the consistent failures in the lshpack update
automation.

## Files Changed

- `.github/workflows/update-lshpack.yml`: Updated tag SHA resolution
logic

🤖 Generated with [Claude Code](https://claude.ai/code)

---------

Co-authored-by: Claude Bot <claude-bot@bun.sh>
Co-authored-by: Claude <noreply@anthropic.com>

.github/workflows/update-lshpack.yml

@@ -50,15 +50,32 @@ jobs:
             exit 1
           fi
 
-          LATEST_TAG_SHA=$(curl -sL "https://api.github.com/repos/litespeedtech/ls-hpack/git/refs/tags/$LATEST_TAG" | jq -r '.object.sha')
+          # Get the tag reference, which contains both SHA and type
+          TAG_REF=$(curl -sL "https://api.github.com/repos/litespeedtech/ls-hpack/git/refs/tags/$LATEST_TAG")
+          if [ -z "$TAG_REF" ]; then
+            echo "Error: Could not fetch tag reference for $LATEST_TAG"
+            exit 1
+          fi
+
+          LATEST_TAG_SHA=$(echo "$TAG_REF" | jq -r '.object.sha')
+          TAG_TYPE=$(echo "$TAG_REF" | jq -r '.object.type')
+          
           if [ -z "$LATEST_TAG_SHA" ] || [ "$LATEST_TAG_SHA" = "null" ]; then
             echo "Error: Could not fetch SHA for tag $LATEST_TAG"
             exit 1
           fi
-          LATEST_SHA=$(curl -sL "https://api.github.com/repos/litespeedtech/ls-hpack/git/tags/$LATEST_TAG_SHA" | jq -r '.object.sha')
-          if [ -z "$LATEST_SHA" ] || [ "$LATEST_SHA" = "null" ]; then
-            echo "Error: Could not fetch SHA for tag $LATEST_TAG @ $LATEST_TAG_SHA"
-            exit 1
+
+          # If it's an annotated tag, we need to dereference it to get the commit SHA
+          # If it's a lightweight tag, the SHA already points to the commit
+          if [ "$TAG_TYPE" = "tag" ]; then
+            LATEST_SHA=$(curl -sL "https://api.github.com/repos/litespeedtech/ls-hpack/git/tags/$LATEST_TAG_SHA" | jq -r '.object.sha')
+            if [ -z "$LATEST_SHA" ] || [ "$LATEST_SHA" = "null" ]; then
+              echo "Error: Could not fetch commit SHA for annotated tag $LATEST_TAG"
+              exit 1
+            fi
+          else
+            # For lightweight tags, the SHA is already the commit SHA
+            LATEST_SHA="$LATEST_TAG_SHA"
           fi
 
           if ! [[ $LATEST_SHA =~ ^[0-9a-f]{40}$ ]]; then