release: a dispatch from a non-main ref pushes that ref to main and tags it

Open Beginner friendly
#170 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
72/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
github-actions, yaml
Domain
ci-cd, release

Research direction

Start by reading release.yml, especially its workflow_dispatch configuration and the git push origin HEAD:main command at line 84. Check how the dispatched ref reaches the job and how the suggested ref guard would prevent the release steps from running. Done means a dispatch from any ref other than main exits before pushing or tagging.

Written by the indexing model from the issue text.

Description

bug hardening priority: low

Why it matters

release.yml is workflow_dispatch with no ref guard. It checks out the dispatched ref, commits CITATION.cff, runs git push origin HEAD:main (line 84) and tags HEAD. Dispatching it from any other branch would fast-forward main to that branch and tag it. The obvious candidate is the bot's own thumbs/<month> branch, which is main plus an unreviewed commit. A mis-click in the Actions UI would ship that content.

Suggested approach

Add if: github.ref == 'refs/heads/main' to the job, or build the CITATION commit on a fresh checkout of origin/main regardless of the dispatched ref. (Related: #137 tracks running the first release.)

Done when

A dispatch from any ref other than main exits before pushing or tagging.

Dominant language
JavaScript
Stars
58
Forks
15
Avg merge
1d 7h
Merged PRs (30d)
12

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from TMHSDigital/Free-Game-Dev-Assets

All issues in TMHSDigital/Free-Game-Dev-Assets

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.