I have a related question/problem to #87 but with a remote repository (i.e. from NewRemote)

The tags returned from List resolve to the hashes of the tags, not the underlying commits, and ResolveRevision isn't an option on a remote repository.

For example, examining https://github.com/aide/aide, with:

.
.
.
5ee3529c3014b4238231885b1403faa3e1affb5c        refs/tags/v0.18.1
de5bb24b9b24df7598161a1ce19dc2ce15afa9c6        refs/tags/v0.18.1^{}
.
.
.

The references returned from List only include the one reference for the v0.18.1 tag, and 5ee3529c3014b4238231885b1403faa3e1affb5c is the hash of the tag itself, not the underlying commit de5bb24b9b24df7598161a1ce19dc2ce15afa9c6

https://github.com/google/osv.dev/blob/bf67aafde6fa58618e02a016a505b4a8116f6ca2/vulnfeeds/git/repository.go#L60 is where I'm using the library currently.