0.2.3 — a lightweight tag cannot publish a release

.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "telegram-dev",
       "displayName": "Telegram Dev",
       "description": "Telegram development, split by the API each surface actually speaks. telegram-bots covers the official HTTP Bot API \u2014 update_id as the only idempotency key, the allowed_updates default that drops three types in silence, the webhook secret header, rate limits as a design constraint, and Telegram Stars with its ten-second pre-checkout window. telegram-userbots covers MTProto and Telethon \u2014 the session file as a credential equal to the password, FloodWaitError as the API working rather than failing, and the account-ban risk a bot token does not carry. telegram-miniapps covers initData verification, the algorithm shipped as a runnable fixture, and the SDK package whose name moved.",
-      "version": "0.2.2",
+      "version": "0.2.3",
       "author": {
         "name": "ssheleg",
         "url": "https://x.com/sshlg93"

.github/workflows/release.yml

@@ -48,6 +48,20 @@ jobs:
           ref: ${{ steps.t.outputs.tag }}
           fetch-depth: 0
 
+      - name: The tag must be annotated (a lightweight tag hides the release)
+        run: |
+          set -eu
+          # `git describe` and `git submodule status` see annotated tags only; the
+          # 2026-10-09 wave cut four lightweight tags and the hub read each member
+          # as its previous release. Refuse here, before anything is published.
+          TAG="${{ steps.t.outputs.tag }}"
+          KIND=$(git cat-file -t "$TAG")
+          if [ "$KIND" != "tag" ]; then
+            echo "::error::$TAG is a $KIND, not an annotated tag object. Remedy: git tag -a $TAG -m '<release>' at the same commit."
+            exit 1
+          fi
+          echo "$TAG is annotated"
+
       - name: The tag must be reachable from the default branch
         env:
           GH_TOKEN: ${{ github.token }}

CHANGELOG.md

@@ -1,3 +1,14 @@
+## v0.2.3 — a lightweight tag cannot publish a release
+
+- **The release refuses a lightweight tag.** `release.yml` gains one step, right after
+  checkout and before any gate: `git cat-file -t` on the tag must print `tag`; a `commit`
+  fails the job with the remedy (`git tag -a <tag> -m '<release>'` at the same commit)
+  before anything is published. `git describe` and `git submodule status` see annotated
+  tags only, and the 2026-10-09 family wave cut four lightweight member tags that the
+  umbrella then read as each member's previous release. The step is identical across the
+  family (umbrella plan 2026-10-10, T5 / REQ-6). Published tags are not re-cut.
+- No skill, reference or installer change.
+
 ## v0.2.2 — «добавь Telegram-бота» reaches the bot skill
 
 The 2026-10-08 family routing audit found that a request written with the inflected or

SKILL-CARD.md

@@ -5,7 +5,7 @@
 | Field | Value |
 |---|---|
 | Pack | `telegram-dev` |
-| Version | `0.2.2` |
+| Version | `0.2.3` |
 | Skills | `telegram-bots`, `telegram-userbots`, `telegram-miniapps` |
 | License | MIT |
 | Source | https://github.com/ssheleg/telegram-dev |

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ssheleg/telegram-dev",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "Three skills for building on Telegram, separated by which API each one speaks: the official HTTP Bot API for bots, MTProto (Telethon) for user accounts, and Mini Apps for the web layer whose whole security model is one signed blob.",
   "bin": {
     "telegram-dev": "bin/telegram-dev.js"

plugins/telegram-dev/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "telegram-dev",
   "displayName": "Telegram Dev",
   "description": "Telegram development, split by the API each surface actually speaks. telegram-bots covers the official HTTP Bot API \u2014 update_id as the only idempotency key, the allowed_updates default that drops three types in silence, the webhook secret header, rate limits as a design constraint, and Telegram Stars with its ten-second pre-checkout window. telegram-userbots covers MTProto and Telethon \u2014 the session file as a credential equal to the password, FloodWaitError as the API working rather than failing, and the account-ban risk a bot token does not carry. telegram-miniapps covers initData verification, the algorithm shipped as a runnable fixture, and the SDK package whose name moved.",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"