14

I am using a couple different Github workflows including one that should only run on official releases. Inside the .github/workflows/release.yml is this on condition:

on:
  push:
    tags:
      - 'v*'

However, this can still run if someone on our team accidentally (or purposely) pushes a tag from the develop branch. Ideally, we would want to lock this down so that the tag MUST be on the main branch (since that is protected), and maybe even further, it would be nice if we could ensure that the tags are only referencing the specific merge commit relating to the corresponding release. For example, if I run

git branch --contains tags/v1.2.3

this would normally output the main branch where I made the tag. Can I add a condition to the github workflow to check the output of that?

Looking at the Github action documentation it is not clear if multiple conditions are evaluated using a logical AND or a logical OR.

1 Answer 1

23

The events types specified in on have a logical OR between them. So for example

on:
  push:
    tags: ['v[0-9].[0-9]+.[0-9]+']
    branches: [master]

would unfortunately trigger the workflow for any matching tag on any branch but also any push on master with or without tags. I also updated the tag pattern following the example from the doc.

You will have to decide if you want to run the workflow only for tags and then filter out anything else than master:

on:
  push:
    tags: ['v[0-9].[0-9]+.[0-9]+']

jobs:
  myjob:
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/master'
    steps: [...]

or the other way around:

on:
  push:
    branches: [master]

jobs:
  myjob:
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/v')
    steps: [...]

You might pick the second solution if, for example, your workflow contains other jobs that might run on pushes to master. As you will also notice, the filter of the tag is less accurate on the second one and it might become an issue. It is also important to note that you can skip whole workflows using the conditions in on, whole jobs with jobs.<job_id>.if but also just steps with jobs.<job_id>.steps[*].if

4
  • I thought I had this working, but now that I've tried to repeat it in another repo and I can't get this to work with either option, either triggering on push of branches to main and checking ${{ startsWith('refs/tags/v', github.ref) }} OR pushing tags and checking ${{ github.ref == 'refs/heads/main' }}. Is there something more to this?
    – Everett
    Mar 5, 2021 at 19:20
  • 9
    When the action is triggered by a push on tags, github.ref is something like refs/tags/xxx; when action is triggered by a push on branches, github.ref is refs/heads/main. So this seems like a Catch-22: when I push a branch, I can't see the tag, when I push a tag, I can't see the branch.
    – Everett
    Mar 5, 2021 at 20:52
  • You could maybe checkout master and use git merge-base --is-ancestor $tag HEAD when triggered from a tag push to check if the tag is present on the master branch.
    – ITChap
    Mar 6, 2021 at 9:44
  • 1
    awesome response it was very useful, I am editing as parameters of startWith where inverted. Thanks a lot for the answer @ITChap
    – Kanekotic
    Oct 20, 2021 at 12:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.