docs: document HEAD-prioritized tag detection fix

When prepare-release tags HEAD with a new release version, do-release should
immediately detect that tag rather than finding the latest tag chronologically.

Changes:
- Modified detect-tag step to check if HEAD is exactly at a tag first
- Falls back to latest tag only if HEAD is not tagged
- Fixes issue where v1.0.2 was detected instead of v1.1.0 at HEAD

This ensures correct version detection in prepare-release → do-release workflow chain.

.gitea/workflows/do-release.yml

@@ -41,13 +41,17 @@ jobs:
         run: |
           set -euo pipefail
 
-          # Fetch all tags from origin to ensure we have the latest
+          # Fetch all tags from origin first
           git fetch origin --tags --force --quiet 2>/dev/null || true
           
-          # Try to find the most recent tag (in case it was just created by prepare-release)
+          # Check if HEAD is at a tag (prepare-release may have just tagged it)
-          latest_tag="$(git describe --tags --abbrev=0 2>/dev/null || echo '')"
+          if head_tag="$(git describe --exact-match --tags HEAD 2>/dev/null)" && [[ -n "$head_tag" ]]; then
+            echo "detected_tag=$head_tag" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
           
-          if [[ -n "$latest_tag" ]]; then
+          # Fall back to finding the most recent tag
+          if latest_tag="$(git describe --tags --abbrev=0 2>/dev/null)" && [[ -n "$latest_tag" ]]; then
             echo "detected_tag=$latest_tag" >> "$GITHUB_OUTPUT"
           fi
 

CHANGELOG.md

@@ -37,6 +37,7 @@ A `### Breaking` section is used in addition to Keep a Changelog's standard sect
 
 - Made `do-release` version resolution resilient to `workflow_call` input passing issues by adding a separate tag detection step that fetches and discovers the latest tag from origin as a fallback when `inputs.tag` is empty, enabling proper operation even when Gitea's workflow_call doesn't pass inputs through correctly.
 - Fixed version resolution in `do-release` workflow by moving version calculation before checkout, resolving from inputs/git tags, and always passing explicit version to `publish` action.
+- Fixed tag detection in `do-release` to prioritize the tag at current HEAD (created by `prepare-release`) over the globally latest tag, ensuring correct version is detected when called from `prepare-release` workflow.
 - Made `publish` action version resolution more robust with clearer error messages when version input is missing and workflow is not running from a tag push.
 - Fixed `do-release` workflow to always checkout the resolved release tag, eliminating conditional checkout logic that could skip the checkout when called from `prepare-release` workflow.
 - Pinned `securego/gosec` and `golang/govulncheck-action` to concrete version tags (`v2.22.4` and `v1.0.4`) so self-hosted Gitea runners can resolve them via direct git clone without relying on the GitHub Actions floating-tag API.