env:

GH_TOKEN: ${{ github.token }}

INPUT_REF: ${{ inputs.ref }}

WORKFLOW_REF_NAME: ${{ github.ref_name }}

shell: bash

run: |

set -euo pipefail

selected_sha="$(git rev-parse HEAD)"

trusted_reason=""

git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main

if [[ "${WORKFLOW_REF_NAME}" =~ ^release/[0-9]{4}\.[1-9][0-9]*\.[1-9][0-9]*$ ]]; then

git fetch --no-tags origin "+refs/heads/${WORKFLOW_REF_NAME}:refs/remotes/origin/${WORKFLOW_REF_NAME}"

fi

if git merge-base --is-ancestor "$selected_sha" refs/remotes/origin/main; then

trusted_reason="main-ancestor"

elif [[ "${WORKFLOW_REF_NAME}" =~ ^release/[0-9]{4}\.[1-9][0-9]*\.[1-9][0-9]*$ ]] &&

[[ "$selected_sha" == "$(git rev-parse "refs/remotes/origin/${WORKFLOW_REF_NAME}")" ]]; then

trusted_reason="release-branch-head"

elif git tag --points-at "$selected_sha" | grep -Eq '^v'; then

trusted_reason="release-tag"

else

if [[ -z "$trusted_reason" ]]; then

echo "Ref '${INPUT_REF}' resolved to $selected_sha, which is not trusted for secret-bearing live/E2E checks." >&2

echo "Allowed refs must be on main, point to a release tag, or match an open PR head in ${GITHUB_REPOSITORY}." >&2

echo "Allowed refs must be on main, match the current release branch head, point to a release tag, or match an open PR head in ${GITHUB_REPOSITORY}." >&2

exit 1

fi