mirror of
https://github.com/go-gitea/gitea.git
synced 2026-08-11 06:46:20 +00:00
Vitalii Tverdokhlib
52d0e18dac
## Problem The github.ref_protected Actions context value was hard-coded to false, even when Gitea has a matching protected-branch or protected-tag rule. That prevents policy-driven deployment workflows from relying on Gitea as the source of truth. A deployment runner or external identity provider may require a protected ref before releasing credentials. The workaround is an exact-ref allowlist outside Gitea, which duplicates repository protection policy and can drift when rules change. ## Solution Resolve configured protection rules for branch and tag refs. Non-branch/tag refs remain false; lookup failures are logged and conservatively return false. This changes the Actions context only; it does not add Actions OIDC issuance. --------- Co-authored-by: Giteabot <teabot@gitea.io>