**Patch release.** Includes the backtick fix from v3.3.1 plus the `GOVULNCHECK_VERSION` pin fix that was blocking the v3.3.1 tag pipeline from completing.
- **Backtick fix (was: v3.3.1).** Dropped the GitLab `release:` keyword in favor of an explicit `glab release create --notes-file` invocation. The `release:` keyword routed `${CI_COMMIT_TAG_MESSAGE}` through shell `eval`, treating backticks as command substitution and stripping every `code span` from the release page. The replacement reads the tag annotation directly from `git tag -l --format='%(contents)'` into a file, then passes that file to `glab` — no shell expansion of the description body. Re-runs are idempotent: `glab release create` updates an existing release in place rather than failing.
- **`GOVULNCHECK_VERSION` pin fix.** `containers/ci-go.Containerfile` had `ARG GOVULNCHECK_VERSION=1.3.0` (no `v` prefix); Go's module loader rejects bare semver: `invalid version: unknown revision 1.3.0`. Fixed to `v1.3.0` to match the sibling `GOLANGCI_LINT_VERSION=v2.4.0` shape. This was silently blocking every tag pipeline since the pin drifted; surfaced when v3.3.1's tag pipeline couldn't reach its own release stage.
- [MR !57](https://gitlab.com/gitlab-com/public-sector/pipeline/-/merge_requests/57) — backtick fix
- [MR !58](https://gitlab.com/gitlab-com/public-sector/pipeline/-/merge_requests/58) — pin fix
- Lab evidence: [kaniko test-catalog-rc1](https://gitlab.com/gitlab-com/public-sector/kaniko/-/releases/test-catalog-rc1) — pre-merge validation of the backtick fix against a real consumer; 32-backtick parity from source tag to rendered release page
- [CHANGELOG](https://gitlab.com/gitlab-com/public-sector/pipeline/-/blob/main/CHANGELOG.md)