git verify-tag: Usage, Options & Common CI Errors

By Daniel Zoghalchali·Latchkey

git verify-tag confirms that a signed annotated tag is authentic and trusted.

Release pipelines that ship from signed tags use verify-tag to ensure the tag was created by an authorized key before building or publishing artifacts.

What it does

git verify-tag checks the GPG or SSH signature embedded in an annotated tag object against your keyring and exits non-zero if it is missing, invalid, or untrusted.

Common usage

git verify-tag v1.2.0
git verify-tag -v v1.2.0
git verify-tag --raw v1.2.0
git tag -v v1.2.0

Options

Common errors in CI

error: <tag>: cannot verify a non-tag object - lightweight tags carry no signature, so only annotated, signed tags (git tag -s) can be verified. "gpg: Can’t check signature: No public key" means the runner lacks the signer’s public key; import it before the gate runs.

Using this in CI

CI checkouts are shallow and detached by default, which changes the answer this command gives you. Commands that read history, branch names, or tags need the checkout configured for it.

- uses: actions/checkout@v4
  with:
    fetch-depth: 0   # history, tags, and git describe all need this

- run: |
    git rev-parse --is-shallow-repository   # expect false
    git rev-parse --abbrev-ref HEAD          # prints HEAD when detached

Frequently asked questions

Related guides

References

• GitHub Actions documentation