mirror of
https://github.com/go-gitea/gitea.git
synced 2026-08-11 12:36:15 +00:00
Vitalii Tverdokhlib
52d0e18dac
## Problem The github.ref_protected Actions context value was hard-coded to false, even when Gitea has a matching protected-branch or protected-tag rule. That prevents policy-driven deployment workflows from relying on Gitea as the source of truth. A deployment runner or external identity provider may require a protected ref before releasing credentials. The workaround is an exact-ref allowlist outside Gitea, which duplicates repository protection policy and can drift when rules change. ## Solution Resolve configured protection rules for branch and tag refs. Non-branch/tag refs remain false; lookup failures are logged and conservatively return false. This changes the Actions context only; it does not add Actions OIDC issuance. --------- Co-authored-by: Giteabot <teabot@gitea.io>
37 lines
898 B
Go
37 lines
898 B
Go
// Copyright 2026 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package git
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
|
|
module_git "gitea.dev/modules/git"
|
|
)
|
|
|
|
// IsRefProtected checks whether a branch or tag ref is protected.
|
|
func IsRefProtected(ctx context.Context, repoID int64, ref module_git.RefName) (bool, error) {
|
|
if ref.IsBranch() {
|
|
return IsBranchProtected(ctx, repoID, ref.ShortName())
|
|
}
|
|
if !ref.IsTag() {
|
|
return false, nil
|
|
}
|
|
|
|
protectedTags, err := GetProtectedTags(ctx, repoID)
|
|
if err != nil {
|
|
return false, fmt.Errorf("get protected tags: %w", err)
|
|
}
|
|
for _, protectedTag := range protectedTags {
|
|
if err := protectedTag.EnsureCompiledPattern(); err != nil {
|
|
return false, fmt.Errorf("compile protected tag pattern %q: %w", protectedTag.NamePattern, err)
|
|
}
|
|
if protectedTag.matchString(ref.ShortName()) {
|
|
return true, nil
|
|
}
|
|
}
|
|
|
|
return false, nil
|
|
}
|