ci: only publish a release for an actual tag

On workflow_dispatch GITHUB_REF_NAME is the BRANCH, so the upload step created a Gitea release AND a git tag both named "main" — a tag sharing the branch name, from a run that was only meant to be a smoke test. Both have been deleted. Gated on github.ref_type == 'tag'. A dispatch now exercises build, SBOM, sign and offline verify, and stops there. Co-Authored-By: Claude Opus 5 <[email protected]>
2026-08-13 21:06:44 -07:00
parent 837a3d3ff0
commit 25a3d6902a
1 changed files with 4 additions and 0 deletions
@@ -173,7 +173,11 @@ jobs:

      # Gitea's release API, not softprops/action-gh-release (GitHub-only).
      # Create-or-reuse, so a re-run of the same tag updates instead of 409ing.
+      # Tag pushes only. On workflow_dispatch GITHUB_REF_NAME is the BRANCH, so
+      # this step previously created a release — and a git tag — literally named
+      # "main". A smoke-test run must not be able to mint a release.
      - name: Attach to the Gitea release
+        if: github.ref_type == 'tag'
        env:
          FORGE_TOKEN: ${{ secrets.FORGE_TOKEN }}
        run: |