Release command can push tag to a wrong remote and then proceed to create a release.
Since in that case tag will not be present in the release repository, github will silently create annotated tag.
Since release target is specified in <org>/<repo> format, it was a surprise that it used default origin remote.
Github tags page shows Verified signature status of the commit pointed by the tag with proper key id so it is very hard to notice something went wrong.
Suggested solution:
Convenience check if remote url matches default github/gitlab pattern for git or https urls. If it is, verify it matches specified org and repository. Fail early.
Proper: Use api to verify tag ref is present in release repository before api call to create a release is made. Bonus points for checks whether object obtained from tag ref is of type tag (as opposed to annotated tag, which will have object of type commit i believe)
Usage that led to the issue occurence:
I am using hub, a cli wrapper around git for interacting with github.
In the github/hub flow origin points to a fork and upstream to original repository:
Release command can push tag to a wrong remote and then proceed to create a release. Since in that case tag will not be present in the release repository, github will silently create annotated tag.
Since release target is specified in
<org>/<repo>
format, it was a surprise that it used defaultorigin
remote. Github tags page showsVerified
signature status of the commit pointed by the tag with proper key id so it is very hard to notice something went wrong.Suggested solution:
object
obtained from tag ref is of typetag
(as opposed to annotated tag, which will have object of typecommit
i believe)Usage that led to the issue occurence: I am using
hub
, a cli wrapper around git for interacting with github. In the github/hub floworigin
points to a fork andupstream
to original repository:Terminal history leading to the problem: