feat: fix release ci

.github/workflows/ci.yml

@@ -2,6 +2,8 @@ name: CI
 
 on:
   push:
+    tags:
+      - v*
     branches-ignore:
       - gh-pages
   pull_request:

.github/workflows/release-rc.yml

@@ -1,18 +1,48 @@
 name: Release Armada components - RC
 
 on:
-  push:
+  workflow_run:
+    types: [completed]
+    workflows: [CI]
     branches:
-      - main
       - master
 
 permissions:
   contents: write
 
 jobs:
+  validate:
+    if: github.event.workflow_run.event == 'push' && github.event.workflow_run.conclusion == 'success' && github.repository_owner == 'armadaproject'
+    name: "Validate revision"
+    runs-on: ubuntu-22.04
+
+    steps:
+      - name: "Checkout"
+        uses: "actions/checkout@v3"
+        with:
+          fetch-depth: 0
+
+      - name: Validate ref
+        run: |
+          ref='${{ github.event.workflow_run.head_branch }}'
+          sha='${{ github.event.workflow_run.head_sha }}'
+          case $ref in
+            master)
+              [ $(git branch --contains=$sha master | wc -l) -eq 1 ] &&
+              [ $(git rev-list --count $sha..master) -le 2 ]
+              ;;
+            *)
+              false
+              ;;
+          esac
+          if [ $? -ne 0 ]; then
+            echo "::error ::Invalid ref $ref $sha"
+            exit 1
+          fi
   release:
-    if: github.repository_owner == 'armadaproject'
+    if: github.event.workflow_run.event == 'push' && github.event.workflow_run.conclusion == 'success' && github.repository_owner == 'armadaproject'
     name: Release
+    needs: validate
     runs-on: "ubuntu-22.04"
     environment: armada-dockerhub
 

.github/workflows/release.yml

@@ -1,17 +1,55 @@
 name: Release Armada components
 
 on:
-  push:
-    tags:
-      - 'v*'
+  workflow_run:
+    types: [completed]
+    workflows: [CI]
+    branches:
+      - v*
 
 permissions:
   contents: write
 
 jobs:
+  validate:
+    if: github.event.workflow_run.event == 'push' && github.event.workflow_run.conclusion == 'success' && github.repository_owner == 'armadaproject'
+    name: "Validate revision"
+    runs-on: ubuntu-22.04
+
+    steps:
+      - name: "Checkout"
+        uses: "actions/checkout@v3"
+        with:
+          fetch-depth: 0
+
+      - name: Validate ref
+        run: |
+          ref='${{ github.event.workflow_run.head_branch }}'
+          sha='${{ github.event.workflow_run.head_sha }}'
+          case $ref in
+            v?*)
+              semver_pattern="^v[0-9]+\.[0-9]+\.[0-9]+$"
+              # Check if the tag/branch name matches the semver pattern
+              if [[ ! $ref =~ $semver_pattern ]]; then
+                echo "::error ::Invalid ref $ref. It must be in semver format vX.Y.Z!"
+                exit 1
+              fi
+              [ $(git rev-parse refs/tags/$ref) == $sha ] &&
+              [ $(git branch --contains=$sha master | wc -l) -eq 1 ]
+              ;;
+            *)
+              false
+              ;;
+          esac
+          if [ $? -ne 0 ]; then
+            echo "::error ::Invalid ref $ref $sha"
+            exit 1
+          fi
+
   release:
-    if: github.repository_owner == 'armadaproject'
+    if: github.event.workflow_run.event == 'push' && github.event.workflow_run.conclusion == 'success' && github.repository_owner == 'armadaproject'
     name: "Release"
+    needs: validate
     runs-on: ubuntu-22.04
     environment: armada-dockerhub