feat: fix release ci

.github/workflows/release-rc.yml

@@ -1,18 +1,48 @@
 name: Release Armada components - RC
 
 on:
-  push:
+  workflow_run:
+    types: [completed]
+    workflows: [CI]
     branches:
-      - main
       - master
 
 permissions:
   contents: write
 
 jobs:
+  validate:
+    if: github.event.workflow_run.event == 'push' && github.event.workflow_run.conclusion == 'success'
+    name: "Validate revision"
+    runs-on: ubuntu-22.04
+
+    steps:
+      - name: "Checkout"
+        uses: "actions/checkout@v3"
+        with:
+          fetch-depth: 0
+
+      - name: Validate ref
+        run: |
+          ref='${{ github.event.workflow_run.head_branch }}'
+          sha='${{ github.event.workflow_run.head_sha }}'
+          case $ref in
+            main)
+              [ $(git branch --contains=$sha main | wc -l) -eq 1 ] &&
+              [ $(git rev-list --count $sha..main) -le 2 ]
+              ;;
+            *)
+              false
+              ;;
+          esac
+          if [ $? -ne 0 ]; then
+            echo "::error ::Invalid ref $ref $sha"
+            exit 1
+          fi
   release:
-    if: github.repository_owner == 'armadaproject'
+    if: github.event.workflow_run.event == 'push' && github.event.workflow_run.conclusion == 'success'
     name: Release
+    needs: validate
     runs-on: "ubuntu-22.04"
     environment: armada-dockerhub
 

.github/workflows/release-validate.yml

@@ -0,0 +1,56 @@
+name: Validate Release
+
+on:
+  push:
+    tags:
+      - v*
+
+permissions:
+  contents: write
+
+jobs:
+  compare_tags:
+    if: github.repository_owner == 'armadaproject'
+    name: "Compare tags"
+    runs-on: ubuntu-22.04
+
+    steps:
+      - name: "Checkout"
+        uses: "actions/checkout@v3"
+        with:
+          fetch-depth: 0
+
+      - name: Compare tags
+        env:
+          ALLOWED_BRANCH: "master"
+        run: |
+          ref=${{ github.ref }}
+          tag=${ref#refs/tags/}
+          echo "Current tag: $tag"
+          sha=${{ github.sha }}
+          echo "Current sha: $sha"
+          result=0
+          case $tag in
+            v?*)
+              latest_tag_commit=$(git rev-parse refs/tags/$tag^{})
+              git branch --contains=$sha $ALLOWED_BRANCH >> /dev/null
+              branch_contains_commit=$?
+
+              if [[ $branch_contains_commit -eq 0 && "$latest_tag_commit" == "$sha" ]]; then
+                result=0
+              else
+                result=1
+              fi
+            ;;
+            *)
+              echo "Invalid tag $tag"
+              result=1
+            ;;
+          esac
+          if [ $result -ne 0 ]; then
+            echo "Latest tag ($tag) does not match the current commit ($sha)."
+            echo "::error ::Invalid ref $ref $sha"
+            exit 1
+          else
+            echo "Latest tag ($tag) matches the current commit ($sha)."
+          fi

.github/workflows/release.yml

@@ -1,17 +1,55 @@
 name: Release Armada components
 
 on:
-  push:
-    tags:
-      - 'v*'
+  workflow_run:
+    types: [completed]
+    workflows: [CI]
+    branches:
+      - v*
 
 permissions:
   contents: write
 
 jobs:
+  validate:
+    if: github.event.workflow_run.event == 'push' && github.event.workflow_run.conclusion == 'success' && github.repository_owner == 'armadaproject'
+    name: "Validate revision"
+    runs-on: ubuntu-22.04
+
+    steps:
+      - name: "Checkout"
+        uses: "actions/checkout@v3"
+        with:
+          fetch-depth: 0
+
+      - name: Validate ref
+        run: |
+          ref='${{ github.event.workflow_run.head_branch }}'
+          sha='${{ github.event.workflow_run.head_sha }}'
+          case $ref in
+            v?*)
+              semver_pattern="^v[0-9]+\.[0-9]+\.[0-9]+$"
+              # Check if the tag/branch name matches the semver pattern
+              if [[ ! $ref =~ $semver_pattern ]]; then
+                echo "::error ::Invalid ref $ref. It must be in semver format vX.Y.Z!"
+                exit 1
+              fi
+              [ $(git rev-parse refs/tags/$ref) == $sha ] &&
+              [ $(git branch --contains=$sha main | wc -l) -eq 1 ]
+              ;;
+            *)
+              false
+              ;;
+          esac
+          if [ $? -ne 0 ]; then
+            echo "::error ::Invalid ref $ref $sha"
+            exit 1
+          fi
+
   release:
-    if: github.repository_owner == 'armadaproject'
+    if: github.event.workflow_run.event == 'push' && github.event.workflow_run.conclusion == 'success' && github.repository_owner == 'armadaproject'
     name: "Release"
+    needs: validate
     runs-on: ubuntu-22.04
     environment: armada-dockerhub