feat: fix release ci

.github/workflows/ci.yml

@@ -2,6 +2,8 @@ name: CI
 
 on:
   push:
+    tags:
+      - v*
     branches-ignore:
       - gh-pages
   pull_request:

.github/workflows/release-rc.yml

@@ -1,18 +1,45 @@
 name: Release Armada components - RC
 
 on:
-  push:
+  workflow_run:
+    types: [completed]
+    workflows: [CI]
     branches:
-      - main
       - master
 
 permissions:
   contents: write
 
 jobs:
+  validate:
+    if: github.event.workflow_run.event == 'push' && github.event.workflow_run.conclusion == 'success' && github.repository_owner == 'armadaproject'
+    name: "Validate revision"
+    runs-on: ubuntu-22.04
+
+    steps:
+      - name: "Checkout"
+        uses: "actions/checkout@v3"
+        with:
+          fetch-depth: 0
+
+      # The given ref should belong to the master branch.
+      # If it's master, it shouldn't be more than 2 commits away (in case another push happened in the meantime).
+      # Anything else is invalid.
+      - name: Validate ref
+        run: |
+          ref='${{ github.event.workflow_run.head_branch }}'
+          sha='${{ github.event.workflow_run.head_sha }}'
+
+          [ "$ref" == "master" ] &&
+          [ $(git branch --contains=$sha master | wc -l) -eq 1 ] &&
+          [ $(git rev-list --count $sha..master) -le 2 ]
+          if [ $? -ne 0 ]; then
+            echo "::error ::Invalid ref $ref $sha: must be a merge to master branch and not more than 2 commits away"
+            exit 1
+          fi
   release:
-    if: github.repository_owner == 'armadaproject'
     name: Release
+    needs: validate
     runs-on: "ubuntu-22.04"
     environment: armada-dockerhub
 

.github/workflows/release.yml

@@ -1,17 +1,45 @@
 name: Release Armada components
 
 on:
-  push:
-    tags:
-      - 'v*'
+  workflow_run:
+    types: [completed]
+    workflows: [CI]
+    branches:
+      - v*
 
 permissions:
   contents: write
 
 jobs:
+  validate:
+    if: github.event.workflow_run.event == 'push' && github.event.workflow_run.conclusion == 'success' && github.repository_owner == 'armadaproject'
+    name: "Validate revision"
+    runs-on: ubuntu-22.04
+
+    steps:
+      - name: "Checkout"
+        uses: "actions/checkout@v3"
+        with:
+          fetch-depth: 0
+
+      # The given ref should belong to the master branch.
+      # If it starts with 'v', it should be a tag, belong to the master branch and match the semver regex.
+      # Anything else is invalid.
+      - name: Validate ref
+        run: |
+          ref='${{ github.event.workflow_run.head_branch }}'
+          sha='${{ github.event.workflow_run.head_sha }}'
+
+          [[ $ref =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] &&
+          [ $(git rev-parse refs/tags/$ref) == $sha ] &&
+          [ $(git branch --contains=$sha master | wc -l) -eq 1 ]
+          if [ $? -ne 0 ]; then
+            echo "::error ::Invalid ref $ref $sha: must be a tag, belong to the master branch and match the semver regex"
+            exit 1
+          fi
   release:
-    if: github.repository_owner == 'armadaproject'
     name: "Release"
+    needs: validate
     runs-on: ubuntu-22.04
     environment: armada-dockerhub