# git verify-tag: Usage, Options & Common CI Errors

> git verify-tag checks the signature on an annotated tag. Reference for --raw, -v, exit codes, and the lightweight-tag and missing-key errors in release CI.

Source: https://latchkey.dev/learn/command-reference/git-verify-tag  
Updated: 2026-06-25

git verify-tag confirms that a signed annotated tag is authentic and trusted.

Release pipelines that ship from signed tags use verify-tag to ensure the tag was created by an authorized key before building or publishing artifacts.

## What it does

git verify-tag checks the GPG or SSH signature embedded in an annotated tag object against your keyring and exits non-zero if it is missing, invalid, or untrusted.

## Common usage

```Terminal
git verify-tag v1.2.0
git verify-tag -v v1.2.0
git verify-tag --raw v1.2.0
git tag -v v1.2.0
```

## Options

| Flag | What it does |
| --- | --- |
| -v / --verbose | Show the tag body and signature info |
| --raw | Emit raw GPG status output |
| <tag> | The tag to verify |

## Common errors in CI

error: <tag>: cannot verify a non-tag object - lightweight tags carry no signature, so only annotated, signed tags (git tag -s) can be verified. "gpg: Can’t check signature: No public key" means the runner lacks the signer’s public key; import it before the gate runs.

## Using this in CI

CI checkouts are shallow and detached by default, which changes the answer this command gives you. Commands that read history, branch names, or tags need the checkout configured for it.

```.github/workflows/ci.yml
- uses: actions/checkout@v4
  with:
    fetch-depth: 0   # history, tags, and git describe all need this

- run: |
    git rev-parse --is-shallow-repository   # expect false
    git rev-parse --abbrev-ref HEAD          # prints HEAD when detached
```

> `git rev-parse --abbrev-ref HEAD` returns the literal string `HEAD` on a detached checkout rather than a branch name. On GitHub Actions read `github.ref_name` instead; the git command cannot know what it was checked out for.

## FAQ

### git verify-tag: Usage, Options & Common CI Errors?

Release pipelines that ship from signed tags use verify-tag to ensure the tag was created by an authorized key before building or publishing artifacts.

### What it does?

git verify-tag checks the GPG or SSH signature embedded in an annotated tag object against your keyring and exits non-zero if it is missing, invalid, or untrusted.

### Common errors in CI?

error: <tag>: cannot verify a non-tag object - lightweight tags carry no signature, so only annotated, signed tags (git tag -s) can be verified. "gpg: Can’t check signature: No public key" means the runner lacks the signer’s public key; import it before the gate runs.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt