GitHub Actions Not Respecting Trigger "On Create Tags"

[yousefcodes]

Describe the bug
I have two github workflows, one that fires when pushing a branch to master. And another that fires only when a tag is created. However, I am itermittently seeing my tags workflow fire, even when I push a branch. This doesn't always happen, it only happens ocassionally and generally it follows the tag creation rule. However, this is our production github workflow, and we simply cannot have a branch push cause that action to fire. What gives?

Note, I had also created this issue here:
actions/runner-images#2898

To Reproduce
Steps to reproduce the behavior:

1. Create a github actions workflow that fires on:

on:
  create:
    tags:
      - v*

2. Push a branch up to the repo, don't create a tag. The workflow fires. This is itermittent and can't always be replicated. So I'm perplexed here. It happens often enough to be a problem.

Expected behavior
I would only expect this github action to fire when I create a tag named v1.0.0 or v1.0.1 or vAnything

Runner Version and Platform

Version of your runner?
This is happening live on GitHub.com not a local runner

OS of the machine running the runner? OSX/Windows/Linux/...

What's not working?

When a github action fires, the on part of the workflow.

Job Log Output

N/A

Runner and Worker's Diagnostic Logs

N/A

[yousefcodes]

Not getting much traction on this issue, and thought I'd ask again!

[ChristopherHX]

Hi,
If I understand the documentation correctly, it states that the branch and tag filter are only supported for push and pull_request events. Althought it isn't a yaml schema error, it seems to ignore branch and tag filter for all other events like create.

I made a simple workflow which only runs if you create a tag. All other create events are skipped.
At least it skips create branch events.

# This is a basic workflow to help you get started with Actions

name: prod-sample

# Controls when the action will run. 
on:
  # Triggers the workflow on push or pull request events but only for the main branch
  create:
# A workflow run is made up of one or more jobs that can run sequentially or in parallel
jobs:
  # This workflow contains a single job called "build"
  build:
    if: ${{ startsWith(github.ref, 'refs/tags/v') }}
    # The type of runner that the job will run on
    runs-on: ubuntu-latest

    # Steps represent a sequence of tasks that will be executed as part of the job
    steps:
      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
      - uses: actions/checkout@v2

      # Runs a single command using the runners shell
      - name: Run a one-line script
        run: echo Hello, world

I hope it helps :)

[yousefcodes]

This is wonderful, thank you! Worked as expected.

[monkut]

It appears that this may perform the same desired result?

name: prod-sample

# Controls when the action will run. 
on:
  push:
    tag:
      - v*

# A workflow run is made up of one or more jobs that can run sequentially or in parallel
jobs:
  # This workflow contains a single job called "build"
  build:
    # The type of runner that the job will run on
    runs-on: ubuntu-latest

    # Steps represent a sequence of tasks that will be executed as part of the job
    steps:
      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
      - uses: actions/checkout@v2

      # Runs a single command using the runners shell
      - name: Run a one-line script
        run: echo Hello, world

[KonradHoeffner]

I am not sure if that produces the same result when the tag is manually created using the GitHub web interface instead of being pushed.

[Zeratoxx]

I am not sure if that produces the same result when the tag is manually created using the GitHub web interface instead of being pushed.

@KonradHoeffner Nope, doesn't work afaik.

I am also kinda confused.. the workaround from @ChristopherHX with if: ${{ startsWith(github.ref, 'refs/tags/v') }} is not completely enough imo.

What about a tag called like validation, generally starting with a 'v'? This would also trigger the job with the mentioned if statement.

[ChristopherHX]

I am also kinda confused.. the workaround from @ChristopherHX with if: ${{ startsWith(github.ref, 'refs/tags/v') }} is not completely enough imo.

In my point of view your requirements here are different, since the op post of this issue uses v*, which also includes validation

What about a tag called like validation, generally starting with a 'v'? This would also trigger the job with the mentioned if statement.

I expect you would come up with variadic, value, variable as well that would require glob/regex matching

I would say game over with action expressions, at this point you need to spawn a job and do calculations in your own script then feed the job outputs to the if condition... Obviously that cost at minimum 1min of included/paid minutes and time on each run.

What you could do additionally check if it includes a . so validation doesn't match without enumerating it, but it also doesn't really check the format...

if: startsWith(github.ref, 'refs/tags/v') && contains(github.ref, '.')

So refs/tags/validation.exploit would still match..

[Zeratoxx]

@ChristopherHX at this point it would be more convenient to have the possibility of writing

create:
  tags:
    - 'v[0-9]+.[0-9]+.[0-9]+'

I mean, the backend code does already exist for push, am I right? 🤔 😅

[ChristopherHX]

I mean, the backend code does already exist for push, am I right? 🤔 😅

Maybe, but I was never a GitHub Employee and have no insights for anything.
Usually GitHub People tell you nowaday to post feature requests to Community Discussions a bunch of them seem to gone stale.
I usually write about things already possible and not about missing features, since I use GitHub Actions Hosted Runner for free without paying anything.

I gone so far and rebuilt the backend of GitHub by forking this repository and yes my backend only warns you about unavailability of the feature in GitHub Actions and still applies it. However only self-hosted runners are possible and no free runners by GitHub including missing security features and so on. I'm using my backend locally with a fake GHES aka Gitea