docs: how to unbork lightweight tag

See coop-cloud/organising#433

docs/maintainers/handbook.md

@@ -646,3 +646,73 @@ export APP_ENTRYPOINT_VERSION=v5
 ```
 
 You should be able to deploy this overriden configuration now.
+
+## Linting rules
+
+### R014: "invalid lightweight tag"
+
+This is an issue related to the way Git/`go-git` handle Git tags internally. We
+need to use "annotated tags" and not "lightweight tags" for our recipe versions
+tags. Otherwise, `abra` has a hard time parsing what is going on.
+
+The `R01O4` linting error happens because the recipe in question has a
+lightweight tag. This needs to be replaced. This is a manual process. Here's a
+practical example with the Gitea recipe when we had this issue.
+
+You can validate what kind of tag is which by running the following:
+
+```
+git for-each-ref refs/tags
+734045872a57d795cd54b1992a1753893a4934f1 tag    refs/tags/1.0.0+1.14.5-rootless
+b2cefa5ccf2f2f77dae54cf6c304cccecb3547ca tag    refs/tags/1.1.0+1.15.0-rootless
+6d669112d8caafcdcf4eb1485f2d6afdb54a8e30 tag    refs/tags/1.1.1+1.15.3-rootless
+64761ad187cc7a3984a37dd9abd4fa16979f97b9 tag    refs/tags/1.1.2+1.15.6-rootless
+1ccb1cb6a63a08eebf6ba5508b676eaaccba7ed8 tag    refs/tags/1.1.3+1.15.10-rootless
+b86e1f6dfef3c464b16736274b3cd95f8978f66b tag    refs/tags/1.2.0+1.16.3-rootless
+b1d22f3c39ca768a4efa1a0b9b9f780268c924b3 tag    refs/tags/1.2.1+1.16.8-rootless
+85a45aa749427822a73ef62b6362d57bae1a61af tag    refs/tags/1.3.0+1.17.2-rootless
+f35689989c0b57575b8362e1252476d8133dc961 commit refs/tags/1.3.1+1.17.3-rootless
+df015fae592fca7728a3f0835217e110da4dbafc tag    refs/tags/2.0.0+1.18.0-rootless
+71920adb0c25a59f7678894e39f1a705f0ad08dd tag    refs/tags/2.0.1+1.18.2-rootless
+1ab9a96922341c8e54bdb6d60850630cce4b9587 tag    refs/tags/2.1.0+1.18.5-rootless
+1e612d84a2ad7c9beb7aa064701a520c7e91eecc commit refs/tags/2.1.2+1.19.3-rootless
+0bee99615a8bbd534a66a315ee088af3124e054b tag    refs/tags/2.2.0+1.19.3-rootless
+699378f53501b2d5079fa62cc7f8e79930da7540 tag    refs/tags/2.3.0+1.20.1-rootless
+c0dc5f82930d875c0a6e29abc016b4f6a53b83dd tag    refs/tags/2.3.1+1.20.1-rootless
+```
+
+Where `f35689989c0b57575b8362e1252476d8133dc961` &
+`1e612d84a2ad7c9beb7aa064701a520c7e91eecc` need to be removed ("commit"). We
+will deal with `refs/tags/1.3.1+1.17.3-rootless` in this example.
+
+```
+# find the tag hash
+git show 1.3.1+1.17.3-rootless
+commit f35689989c0b57575b8362e1252476d8133dc961 (tag: 1.3.1+1.17.3-rootless)
+Merge: af97db8 1d4dc8e
+Author: decentral1se <decentral1se@noreply.git.coopcloud.tech>
+Date:   Sun Nov 13 21:54:01 2022 +0000
+
+    Merge pull request 'Adding Oauth2 options and up on versions' (#29) from javielico/gitea:master into master
+
+    Reviewed-on: https://git.coopcloud.tech/coop-cloud/gitea/pulls/29
+
+# delete the tag locally / remotely
+git tag -d 1.3.1+1.17.3-rootless
+git push origin 1.3.1+1.17.3-rootless --delete
+
+# re-tag, this time with `-a` (annotated)
+git checkout f35689989c0b57575b8362e1252476d8133dc961
+git tag -a 1.3.1+1.17.3-rootless
+
+# push new tag
+git checkout master # might be main on other recipes!
+git push origin master --tags
+
+# check everything works
+git for-each-ref refs/tags | grep 1.3.1+1.17.3-rootless
+964f1680000fbba6daa520aa8d533a53ad151ab8 tag refs/tags/1.3.1+1.17.3-rootless
+```
+
+That's it! Spread the word, use `-a` when taggin recipe versions manually! Or
+just use `abra` which handles this automagically for you in all cases 🎉