Fix stale tag considerations

.gitea/workflows/release-tool.yml

@@ -16,6 +16,7 @@ jobs:
       - name: Sync tools checkout to tag
         env:
           TAG_NAME: ${{ github.ref_name }}
+          EVENT_SHA: ${{ github.sha }}
           GITEA_SERVER_URL: ${{ github.server_url }}
           GITEA_REPO: ${{ github.repository }}
         run: |
@@ -34,18 +35,27 @@ jobs:
           cd "${CHECKOUT_PATH}"
           git remote set-url origin "${SOW_TOOLS_REPO_URL}"
           echo "Fetching tools refs from ${SOW_TOOLS_REPO_URL}"
-          timeout 120 git fetch origin --prune --tags
+          timeout 120 git fetch origin --prune --force --tags
+          TAG_SHA="$(git rev-list -n1 "refs/tags/${TAG_NAME}")"
+          if [[ -n "${EVENT_SHA}" && "${TAG_SHA}" != "${EVENT_SHA}" ]]; then
+            echo "Fetched tag ${TAG_NAME} resolves to ${TAG_SHA}, but the workflow event SHA is ${EVENT_SHA}."
+            echo "Refusing to build a release from a stale or mismatched local tag."
+            exit 1
+          fi
           git reset --hard "refs/tags/${TAG_NAME}"
-          git clean -fd
+          git clean -ffdx
+          echo "Release ${TAG_NAME} will build commit $(git rev-parse HEAD)"
 
       - name: Build sow-toolkit binaries
         run: |
           set -euo pipefail
           CHECKOUT_PATH="${CHECKOUT_PATH:-/home/ubuntu/tools-checkout}"
           cd "${CHECKOUT_PATH}"
+          rm -f ./tools/sow-toolkit ./tools/sow-toolkit.exe
           mkdir -p tools .cache/go-build
           GOCACHE="${PWD}/.cache/go-build" go build -o ./tools/sow-toolkit ./cmd/nwn-tool
           GOOS=windows GOARCH=amd64 GOCACHE="${PWD}/.cache/go-build" go build -o ./tools/sow-toolkit.exe ./cmd/nwn-tool
+          go version -m ./tools/sow-toolkit
 
       - name: Pack release bundles
         id: pack