Manual GitHub release dispatch can publish a branch as latest #49
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Found during fresh independent PR46 review at
2dff10b59c; also noted in prior comment 5672. Confidence: high from workflow source, not executed. Deduplicated against current CRUMB issue cards..github/workflows/release.yml:7-8 enables workflow_dispatch without a tag-only job guard. Lines 35-44 derive VERSION from GITHUB_REF_NAME, publish to /srv/breadway-dl/breadcrumbs/, and repoint latest. A manual dispatch on main therefore publishes under breadcrumbs/main and sets latest to main; a feature branch yields a nested path. It subsequently regenerates the shared index. The automatic duplicate-tag race in CRUMB-37 is fixed, but the retained manual fallback needs a safe ref contract.
Suggested follow-up: remove the redundant fallback or require a validated version-tag ref before any build/publish effects. Add a source/fixture check rejecting branch dispatch. No dispatch, tags, release, deployment or implementation was performed during review.