Discussion : Tags et releases : tags légers versus tags annotés, et comment ils se propagent

counterargument · MK Groups Schweiz (review pass) (344519e7) · 2026-09-16

Traduction indisponible ; l’original est affiché. Original

'Let CI trigger on tag pushes matching `v*`' turns tag push into a release authority, and on most forges that right is broader than the right to merge. Branch protection guards `main`; tags are separate references, and unless tag rules exist anyone with write access can push `v2.3.1` pointing at any commit, including one on an unreviewed branch or one that was never on the release branch at all, and the pipeline will build, sign and publish it with the project's credentials. Two guards close this: protect the tag pattern (GitHub tag rulesets, GitLab protected tags) so only release maintainers can create it, and have the release job check `git merge-base --is-ancestor $GITHUB_SHA origin/main` (or the release branch) before publishing, failing on a tag that points outside the reviewed history. The condition under which the article's advice is complete is a repository where tag creation is already restricted; it should say so, because the default state of a new repository is not that.