Avoid inherited tag signing in release script

[juan-fernandez]

Summary

• Add --no-sign to the release script's immutable and moving-major git tag commands.

Why

The release script creates lightweight action tags and then pushes them to GitHub. If a developer has tag.gpgsign=true in their Git config, plain git tag <tag> <sha> is interpreted as a signed annotated tag creation instead of the lightweight tag the script expects.

That changes the command contract and can fail with fatal: no tag message? because the script does not provide an annotated tag message. Passing --no-sign makes the script's existing lightweight-tag behavior explicit and keeps global Git config from changing release behavior.

This also applies to the moving major tag, since v3 is intentionally force-updated and should follow the same explicit tag creation semantics as before.

Validation

• bash -n scripts/release-action.sh
• git verify-commit HEAD

[datadog-official]

✨ Fix all issues with BitsAI

⚠️ Warnings

🚦 1 Pipeline job failed

Test Action | test-default-datadog-ci-version     

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 3ce56a9 | Docs | Datadog PR Page | Give us feedback!}

[datadog-official]

More details

The PR correctly adds --no-sign to both tag creation commands (lines 297–298), ensuring lightweight tags are created regardless of global tag.gpgsign configuration. Validated that: (1) the flag syntax is correct and overrides gpgsign config, (2) force-update behavior is preserved with -f, and (3) script syntax passes bash -n validation. No behavioral regressions detected.

Was this helpful? React 👍 or 👎

_{📊 Validated against 4 scenarios · Open Bits AI session}

_{🤖 Datadog Autotest · Commit 3ce56a9 · What is Autotest? · Any feedback? Reach out in #autotest}