The intent of the Validate branch step is to prevent publishing from occurring from unofficial branches. However, it's not preventing anything. It's check for an official branch is always succeeding, allowing publishing to occur from any branch.
In addition, as a safety precaution, it might be better to inverse the logic so that it fails the build by default and only allows it if the condition is met.
The intent of the
Validate branch
step is to prevent publishing from occurring from unofficial branches. However, it's not preventing anything. It's check for an official branch is always succeeding, allowing publishing to occur from any branch.It seems to be caused by this condition: https://github.com/dotnet/docker-tools/blob/3d4a494c5e7a9a741b7359f220ef70a779ce1dc7/eng/common/templates/steps/validate-branch.yml#L8
That check was added as part of https://github.com/dotnet/docker-tools/pull/1044. Not exactly sure what the intent of it is (yes, I know I authored it).
In addition, as a safety precaution, it might be better to inverse the logic so that it fails the build by default and only allows it if the condition is met.