feat(git-refs): use dereferenced commit hash for annotated tags (renovatebot#41560)

* feat(git-refs): use dereferenced commit hash for annotated tags

When git ls-remote lists annotated tags, it returns two entries:
1. The tag object hash: refs/tags/v1.0.0 -> abc123
2. The dereferenced commit hash: refs/tags/v1.0.0^{} -> def456

Previously, Renovate used the tag object hash (abc123).  However, `git submodule status` returns the actual commit hash (def456).  This mismatch caused false-positive dependency updates that resulted in empty commits, since the tag object and commit hash differ even when pointing to the same version.

This feature:
- Parses both entries from git ls-remote into allRefs
- Builds a lookup map of tag names to their dereferenced commit hashes
- For annotated tags, replaces the tag object hash with the commit hash
- Lightweight tags are unaffected (they already return the commit hash)

This ensures Renovate's detected digest matches what git submodule operations actually use, preventing unnecessary update PRs.

* Apply suggestions from code review

Co-authored-by: Michael Kriese <michael.kriese@gmx.de>

* fix typo in dereferencedTags variable name

---------

Co-authored-by: Michael Kriese <michael.kriese@gmx.de>

Author: jasonlearst

lib/modules/datasource/git-refs/__snapshots__/index.spec.ts.snap

@@ -5,32 +5,32 @@ exports[`modules/datasource/git-refs/index > getReleases > returns versions filt
   "releases": [
     {
       "gitRef": "v1.0.0",
-      "newDigest": "a9920c014aebc28dc1b23e7efcc006d045512345",
+      "newDigest": "7b756026fb2de270240a889a413e7e3a9d4d4d85",
       "version": "v1.0.0",
     },
     {
       "gitRef": "v1.0.1",
-      "newDigest": "281fbfb58990ec98b237a923d67904c102bec34c",
+      "newDigest": "e173183f932ba8a31d0e4f23cc1070e8ebfa59d6",
       "version": "v1.0.1",
     },
     {
       "gitRef": "v1.0.2",
-      "newDigest": "9cb93e0b236385a4e2efd089d7c6a458f5ff321f",
+      "newDigest": "3936a6bced3587dc9fd464b0a910e0dfd4cfe10d",
       "version": "v1.0.2",
     },
     {
       "gitRef": "v1.0.3",
-      "newDigest": "8b0d0e0aec21ea059448ef0255387dbb82c61973",
+      "newDigest": "125ca9f3df4151e50046e5327ecb29ec4c13efab",
       "version": "v1.0.3",
     },
     {
       "gitRef": "v1.0.4",
-      "newDigest": "2b52829c7c1bd65b3501c450849c53b90b11fa0e",
+      "newDigest": "3ed9e7d7094fd4ee7751c24a3e6b706060f461ff",
       "version": "v1.0.4",
     },
     {
       "gitRef": "v1.0.5",
-      "newDigest": "2d138c34e4c6939d0a8686943e851c6528aa04db",
+      "newDigest": "6d7a933c2e6b7b39e992b1f93b6b42de083b28f0",
       "version": "v1.0.5",
     },
   ],

lib/modules/datasource/git-refs/base.ts

@@ -41,7 +41,7 @@ export abstract class GitDatasource extends Datasource {
       return null;
     }
 
-    const refs = lsRemote
+    const allRefs = lsRemote
       .trim()
       .split(newlineRegex)
       .map((line) => line.trim())
@@ -66,7 +66,32 @@ export abstract class GitDatasource extends Datasource {
         return null;
       })
       .filter(isTruthy)
-      .filter((ref) => ref.type !== 'pull' && !ref.value.endsWith('^{}'));
+      .filter((ref) => ref.type !== 'pull');
+
+    // For annotated tags, git ls-remote returns two entries:
+    // 1. The tag object hash: refs/tags/v1.0.0
+    // 2. The dereferenced commit hash: refs/tags/v1.0.0^{}
+    // We need to use the dereferenced commit hash (^{}) for annotated tags
+    // to match what `git submodule status` returns (the actual commit hash).
+    // This prevents false-positive updates that result in empty commits.
+    const dereferencedTags: Record<string, string> = {};
+    for (const ref of allRefs) {
+      if (ref.value.endsWith('^{}')) {
+        // Store the commit hash for the base tag name (without ^{})
+        dereferencedTags[ref.value.slice(0, -3)] = ref.hash;
+      }
+    }
+
+    const refs = allRefs
+      .filter((ref) => !ref.value.endsWith('^{}'))
+      .map((ref) => {
+        // For annotated tags, use the dereferenced commit hash
+        const dereferencedHash = dereferencedTags[ref.value];
+        if (dereferencedHash) {
+          return { ...ref, hash: dereferencedHash };
+        }
+        return ref;
+      });
 
     return refs;
   }

lib/modules/datasource/git-refs/index.spec.ts

@@ -98,7 +98,9 @@ describe('modules/datasource/git-refs/index', () => {
         { packageName: 'a tag to look up' },
         'v1.0.4',
       );
-      expect(digest).toBe('2b52829c7c1bd65b3501c450849c53b90b11fa0e');
+      // For annotated tags, we return the dereferenced commit hash (^{})
+      // to match what `git submodule status` returns
+      expect(digest).toBe('3ed9e7d7094fd4ee7751c24a3e6b706060f461ff');
     });
 
     it('ignores refs/for/', async () => {

lib/modules/datasource/git-tags/__snapshots__/index.spec.ts.snap

@@ -5,32 +5,32 @@ exports[`modules/datasource/git-tags/index > getReleases > returns versions filt
   "releases": [
     {
       "gitRef": "v1.0.0",
-      "newDigest": "0be9ffb1ae0c8d0846cd88b58dfef42d74674673",
+      "newDigest": "7b756026fb2de270240a889a413e7e3a9d4d4d85",
       "version": "v1.0.0",
     },
     {
       "gitRef": "v1.0.1",
-      "newDigest": "281fbfb58990ec98b237a923d67904c102bec34c",
+      "newDigest": "e173183f932ba8a31d0e4f23cc1070e8ebfa59d6",
       "version": "v1.0.1",
     },
     {
       "gitRef": "v1.0.2",
-      "newDigest": "9cb93e0b236385a4e2efd089d7c6a458f5ff321f",
+      "newDigest": "3936a6bced3587dc9fd464b0a910e0dfd4cfe10d",
       "version": "v1.0.2",
     },
     {
       "gitRef": "v1.0.3",
-      "newDigest": "8b0d0e0aec21ea059448ef0255387dbb82c61973",
+      "newDigest": "125ca9f3df4151e50046e5327ecb29ec4c13efab",
       "version": "v1.0.3",
     },
     {
       "gitRef": "v1.0.4",
-      "newDigest": "2b52829c7c1bd65b3501c450849c53b90b11fa0e",
+      "newDigest": "3ed9e7d7094fd4ee7751c24a3e6b706060f461ff",
       "version": "v1.0.4",
     },
     {
       "gitRef": "v1.0.5",
-      "newDigest": "2d138c34e4c6939d0a8686943e851c6528aa04db",
+      "newDigest": "6d7a933c2e6b7b39e992b1f93b6b42de083b28f0",
       "version": "v1.0.5",
     },
   ],

lib/modules/datasource/git-tags/index.spec.ts

@@ -81,7 +81,7 @@ describe('modules/datasource/git-tags/index', () => {
         { packageName: 'a tag to look up' },
         'v1.0.2',
       );
-      expect(digest).toBe('9cb93e0b236385a4e2efd089d7c6a458f5ff321f');
+      expect(digest).toBe('3936a6bced3587dc9fd464b0a910e0dfd4cfe10d');
     });
 
     it('returns digest for HEAD', async () => {