Docker releasebranch condition check

[echoix]

@neteler I might need some imagination on grep patterns/bash scripting.
In the docker workflow, where I check if it is a releasebranch, I'm matching the branch pattern name used by renovate:

      - name: Get the latest tag and release branches
        id: tag-branch
        run: |
          # Make sure tags are fetched
          git fetch --tags
          # Get sorted list of tags, keep the first that has a semver pattern (not RCs)
          latest_tag="$(git tag --sort=-v:refname \
            | grep -E '^[0-9]+\.[0-9]+\.[0-9]+$' \
            | head -n 1)"
          echo "latest_tag=${latest_tag}" >> "${GITHUB_OUTPUT}"
          echo "latest_tag is: ${latest_tag}"
          if [ -z "$latest_tag" ]; then
              echo "Error getting latest tag information"
              echo "error_latest=yes" >> "${GITHUB_OUTPUT}"
              exit 0
          fi
          latest_rel_branch="$(git branch --all --list 'origin/*' \
            --contains "${latest_tag}" --format "%(refname:lstrip=3)" || echo "")"
          echo "latest_rel_branch=${latest_rel_branch}" >> "${GITHUB_OUTPUT}"
          echo "latest_rel_branch is: ${latest_rel_branch}"
          if [ -z "$latest_rel_branch" ]; then
              echo "Error getting latest release branch information"
              echo "error_latest_rel_branch=yes" >> "${GITHUB_OUTPUT}"
              exit 0
          fi
          echo "error_latest=no" >> "${GITHUB_OUTPUT}"
          echo "error_latest_rel_branch=no" >> "${GITHUB_OUTPUT}"

In this run, it fails: https://github.com/OSGeo/grass/actions/runs/20349843427/job/58471362621

0s
Run # Make sure tags are fetched
  # Make sure tags are fetched
  git fetch --tags
  # Get sorted list of tags, keep the first that has a semver pattern (not RCs)
  latest_tag="$(git tag --sort=-v:refname \
    | grep -E '^[0-9]+\.[0-9]+\.[0-9]+$' \
    | head -n 1)"
  echo "latest_tag=${latest_tag}" >> "${GITHUB_OUTPUT}"
  echo "latest_tag is: ${latest_tag}"
  if [ -z "$latest_tag" ]; then
      echo "Error getting latest tag information"
      echo "error_latest=yes" >> "${GITHUB_OUTPUT}"
      exit 0
  fi
  latest_rel_branch="$(git branch --all --list 'origin/*' \
    --contains "${latest_tag}" --format "%(refname:lstrip=3)" || echo "")"
  echo "latest_rel_branch=${latest_rel_branch}" >> "${GITHUB_OUTPUT}"
  echo "latest_rel_branch is: ${latest_rel_branch}"
  if [ -z "$latest_rel_branch" ]; then
      echo "Error getting latest release branch information"
      echo "error_latest_rel_branch=yes" >> "${GITHUB_OUTPUT}"
      exit 0
  fi
  echo "error_latest=no" >> "${GITHUB_OUTPUT}"
  echo "error_latest_rel_branch=no" >> "${GITHUB_OUTPUT}"
  shell: /usr/bin/bash -e {0}
latest_tag is: 8.4.2
latest_rel_branch is: releasebranch_8_4
renovate/releasebranch_8_4-actions-download-artifact-4.x
renovate/releasebranch_8_4-actions-upload-artifact-4.x
Error: Unable to process file command 'output' successfully.
Error: Invalid format 'renovate/releasebranch_8_4-actions-download-artifact-4.x'

Any ideas anyone? Ideally to implement before tomorrow end of UTC day.

Originally posted by @echoix in #6746 (comment)

[echoix]

If I understand this page correctly: https://git-scm.com/docs/git-for-each-ref#Documentation/git-for-each-ref.txt-refname
would using --format "%(refname:lstrip=-1)" work correctly for getting only the last part of the slash?

Oh, would it be vulnerable to an injection vuln because someone could name their branch with slashes and make the last segment work?

[echoix]

I think I got something, replacing upstream with origin.

PS D:\repos\grass_repo\grass> git branch --all --list 'origin/*'  --contains "8.4.2" --format "%(refname:lstrip=3)"
releasebranch_8_4
PS D:\repos\grass_repo\grass> git branch --all --list 'origin/*'  --contains "8.4.2" --format "%(refname:lstrip=3)"
releasebranch_8_4
PS D:\repos\grass_repo\grass> git branch --all --list 'upstream/*'  --contains "8.4.2" --format "%(refname:lstrip=3)"
releasebranch_8_4
renovate/releasebranch_8_4-actions-download-artifact-4.x
renovate/releasebranch_8_4-actions-upload-artifact-4.x
PS D:\repos\grass_repo\grass> git branch --all --list 'upstream/releasebranch_*'  --contains "8.4.2" --format "%(refname:lstrip=3)"
releasebranch_8_4
PS D:\repos\grass_repo\grass> git branch --all --list 'upstream/releasebranch_[0-9]+_[0-9]'  --contains "8.4.2" --format "%(refname:lstrip=3)"
PS D:\repos\grass_repo\grass> git branch --all --list 'upstream/releasebranch_[0-9]_[0-9]'  --contains "8.4.2" --format "%(refname:lstrip=3)"
releasebranch_8_4
PS D:\repos\grass_repo\grass> git branch --all --list 'upstream/releasebranch_[0-9]_[0-9]'  --contains "8.4.2" --format "%(refname:lstrip=3)"

Ideally, we would also limit who (from our roles) can create releasebranches. I'll create a ruleset for that

[echoix]

@wenzeslaus Please take a look at this additional rule, that we didn't consider (or couldn't consider the last time we reviewed these settings).

Ok, here's what the ruleset should look like:

The exported json from my fork to import: Restrict releasebranch creation.json

Even though even us with write permissions (the ones that can already merge PRs) have the right to create a releasebranch (instead of like the 4 of us that have maintain/admin permissions), at least it would prevent doing it from a deploy key, an app, a github-bot, etc.

[echoix]

Even though I opened a PR for the initial issue, there is still a value in limiting what can create a branch (humans rather than bots)