cd workflow fired event outside of the create tags event

[monkut]

Context

Coinciding with the automatically publish tagged versions to pypi (#1075) push to master on "Fri Jan 7 10:59:38 2022 +0000",
a new py3 wheel for 0.54.1 was uploaded to pypi on Jan 7, 2022.

Expected Behavior

Pushing to master should NOT trigger the cd.yaml gitactions workflow, and NOT publish a new whl.

Actual Behavior

New whl published to pypi

[monkut]

Recently confirmed that an existing pypi assets will not be overwritten on an attempt to re-publish to pypi.
I suspect that since the previous wheel was, zappa-0.54.1-py2.py3-none-any.whl (py2.py3) and the new wheel, being py3 only, was allowed the non-existing zappa-0.54.1-py3-none-any.whl file to be added to the pypi release.

[monkut]

The on.create.tags {filter} workflow firing outside of the expected trigger appears to be related to:
actions/runner#1007

[monkut]

docs:
https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows

github form post:
https://github.community/t/how-to-run-github-actions-workflow-only-for-new-tags/16075/10

Reviewing the links above seems to suggest that the following doesn't operate as expected:

(current cd.yaml)

on:  # yamllint disable-line rule:truthy
  create:
    tags: ["v?[0-9]+.[0-9]+.[0-9]+"]

Combined with the issue, here's a potential solution:

name: CD

on:  # yamllint disable-line rule:truthy
  push:
    tags: ["v?[0-9]+.[0-9]+.[0-9]+"]

jobs:
  publish:
    runs-on: ubuntu-20.04
    if: ${{ startsWith(github.ref, 'refs/tags/') }}
    steps:
      ...

Although I couldn't find any github action docs saying that regex was accept as filter syntax. Does anyone know if that's a valid filter?

[monkut]

https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#onpushbranchestagsbranches-ignoretags-ignore

on.push.<branches|tags|branches-ignore|tags-ignore>

Use the tags filter when you want to include tag name patterns or when you want to both include and exclude tag names patterns. Use the tags-ignore filter when you only want to exclude tag name patterns. You cannot use both the tags and tags-ignore filters for the same event in a workflow.

If you define only tags/tags-ignore or only branches/branches-ignore, the workflow won't run for events affecting the undefined Git ref. If you define neither tags/tags-ignore or branches/branches-ignore, the workflow will run for events affecting either branches or tags. If you define both branches/branches-ignore and paths, the workflow will only run when both filters are satisfied.

Confirmed in a separate repository that the event doesn't fire on branch creation, or PR merge.
Also confirmed that the regex filters as expected, and the event doesn't fire when a tag that doesn't match the regex is pushed.

[monkut]

confirmed that pipenv uses the proposed/implemented "on.push.tags {filter}" method for their pypi deployment.

https://github.com/pypa/pipenv/blob/main/.github/workflows/pypi_upload.yml#L3-L7

[monkut]

Confirmed that a new pypi release was NOT uploaded to pypi on merge to master.

Closing.