Hmm. I created a dummy package and allowed GitHub to create the tag for the release. It looks like it used a lightweight tag, and I don't see any evidence of any extra refs:

    $ git ls-remote https://github.com/dlitz/dummy
    23ed6e532fb4a3eb1403e0091885ccdb9f09b577        HEAD
    23ed6e532fb4a3eb1403e0091885ccdb9f09b577        refs/heads/master
    23ed6e532fb4a3eb1403e0091885ccdb9f09b577        refs/tags/v0.0

Pull requests, on the other hand, are stored as refs in the remote git repo:

    $ git ls-remote https://github.com/dlitz/pycrypto
    10abfc8633bac653eda4d346fc051b2f07554dcd        HEAD
    ...
    a1bfcc4a20ab0def053df75db0bb12644e55553e        refs/heads/cmac-wip
    fd398a28e3a227a539b264a9f1e11287b904c7da        refs/heads/hash-speedup-wip
    10abfc8633bac653eda4d346fc051b2f07554dcd        refs/heads/master
    606b17789c1869597466c714134f138c51b938f5        refs/pull/1/head
    7c3c142321f6aeb3e9ff502876e133d5350018e1        refs/pull/10/head
    52fe776815416ce61a516ca060f93405b3cdf7cb        refs/pull/10/merge
    0c2bb473529795d29ad43ce0d14162d1e2c19027        refs/pull/11/head
    ...
    00d0670bd7dca6bfb1c2dadaa76eaa364930ef78        refs/tags/v1.9a5
    aae6caac7874411e311f034e3547a6412fe2f362        refs/tags/v2.0.1
    40ae4256452c5cde1e714e3271af5028e96c5e1f        refs/tags/v2.0.1^{}
    d1ee050420f9a0fdacbf7c9f98c923ddfcc2a39f        refs/tags/v2.1.0
    033fc936155115b3a541387804e0a94820978498        refs/tags/v2.1.0^{}
    812e01736ca936124daa36d15a4159e92a43b9db        refs/tags/v2.1.0alpha1
    a7748d0e65fe17fbcb20f7b086536c3ccf68de43        refs/tags/v2.1.0alpha2
    ...