From b557aee662c37dce19e885d63894283e498a07d6 Mon Sep 17 00:00:00 2001 From: Smart Mekiliuwa Date: Sun, 19 Jul 2026 22:52:20 +0100 Subject: [PATCH] fix: block ref-qualified feature_branch names refs/heads/main would bypass the literal main check and force-push the default branch. refs/* is now rejected like other protected shapes. --- .github/workflows/sdk_generation.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/sdk_generation.yaml b/.github/workflows/sdk_generation.yaml index 468a376..5015e2b 100644 --- a/.github/workflows/sdk_generation.yaml +++ b/.github/workflows/sdk_generation.yaml @@ -79,8 +79,10 @@ jobs: if [ -n "$FEATURE_BRANCH_INPUT" ]; then # SDK PRs must come from a reviewable feature branch, never a # protected ref or an option-looking / metacharacter name. + # refs/* is blocked too: "refs/heads/main" would bypass the + # literal main check and force-push the default branch. case "$FEATURE_BRANCH_INPUT" in - main|master|release/*|-*|*[!a-zA-Z0-9._/-]*) + main|master|release/*|refs/*|-*|*[!a-zA-Z0-9._/-]*) echo "::error::Invalid feature_branch '$FEATURE_BRANCH_INPUT'" exit 1 ;;