branch validation

.github/workflows/release.yaml

@@ -15,15 +15,30 @@ jobs:
     runs-on: ubuntu-20.04
     steps:
       - uses: actions/checkout@v2
-        with:
-          ref: main
+      # TODO: Unfortunately it's not obvious how to restrict `workflow_dispatch` to a particular branch
+      # so this step ensures releases are always done off of `main`.
+      - name: Ensure branch is 'main'
+        run: |
+          git fetch origin &> /dev/null
+          branch="$(git rev-parse --abbrev-ref HEAD)"
+          if [[ "${branch}" != "main" ]]; then
+            echo "The release branch must be main. Got '${branch}'' instead." >&2
+            exit 1
+          else
+            echo "Branch is '${branch}'"
+          fi
       - name: Ensure release does not already exist
         run: |
+          git fetch origin &> /dev/null
           version="$(grep 'VERSION =' ${{ github.workspace }}/version.bzl | sed 's/VERSION = "//' | sed 's/"//')"
           if [[ -n "$(git tag -l ${version})" ]]; then
             echo "A release '${version}' already exists." >&2
+            exit 1
+          else
+            echo "Tag '${version}' will be created"
           fi
   builds:
+    needs: validation
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
@@ -52,8 +67,6 @@ jobs:
               TARGET: "x86_64-unknown-linux-musl"
     steps:
       - uses: actions/checkout@v2
-        with:
-          ref: "${{ github.base_ref }}"
       - name: Install rust toolchains for host
         run: |
           # Detect the current version of rust
@@ -92,8 +105,6 @@ jobs:
     runs-on: ubuntu-20.04
     steps:
       - uses: actions/checkout@v2
-        with:
-          ref: main
       - uses: actions/download-artifact@v2
         with:
           path: ${{ github.workspace }}/crate_universe/target/artifacts