Change pipelines to use tags and secure them properly

.github/workflows/deploy-cloud.yaml

@@ -2,23 +2,29 @@ name: Budibase Deploy Production
 
 on:
  workflow_dispatch:
-  inputs:
-    version:
-      description: Budibase release version. For example - 1.0.0
-      required: false
 
 jobs:
   release:
     runs-on: ubuntu-latest
 
     steps:
-      - name: Fail if branch is not master
+      - name: Fail if not a tag
-        if: github.ref != 'refs/heads/master' 
+        run: |
-        run: | 
+          if [[ $GITHUB_REF != refs/tags/* ]]; then 
-          echo "Ref is not master, you must run this job from master."
+            echo "Workflow Dispatch can only be run on tags" 
-          exit 1
+            exit 1 
+          fi
 
       - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+
+      - name: Fail if tag is not in master
+        run: |
+          if ! git merge-base --is-ancestor ${{ github.sha }} origin/master; then
+            echo "Tag is not in master. This pipeline can only execute tags that are present on the master branch"
+            exit 1
+          fi
 
       - name: Pull values.yaml from budibase-infra
         run: | 
@@ -31,11 +37,7 @@ jobs:
       - name: Get the latest budibase release version
         id: version
         run: | 
-          if [ -z "${{ github.event.inputs.version }}" ]; then
+          release_version=$(cat lerna.json | jq -r '.version')
-            release_version=$(cat lerna.json | jq -r '.version')
-          else
-            release_version=${{ github.event.inputs.version }}
-          fi
           echo "RELEASE_VERSION=$release_version" >> $GITHUB_ENV
       
       - name: Configure AWS Credentials

.github/workflows/deploy-preprod.yml

@@ -1,17 +1,30 @@
 name: "deploy-preprod"
 on:
   workflow_dispatch:
-    inputs:
-      version:
-        description: Budibase release version. For example - 1.0.0
-        required: false
   workflow_call:
 
 jobs:
   deploy-to-legacy-preprod-env:
     runs-on: ubuntu-latest
     steps:
+      - name: Fail if not a tag
+        run: |
+          if [[ $GITHUB_REF != refs/tags/* ]]; then 
+            echo "Workflow Dispatch can only be run on tags" 
+            exit 1 
+          fi
+
       - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+
+      - name: Fail if tag is not in master
+        run: |
+          if ! git merge-base --is-ancestor ${{ github.sha }} origin/master; then
+            echo "Tag is not in master. This pipeline can only execute tags that are present on the master branch"
+            exit 1
+          fi
+      
 
       - name: Get the latest budibase release version
         id: version

.github/workflows/release-develop.yml

@@ -22,6 +22,13 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
+      - name: Fail if not a tag
+        run: |
+          if [[ $GITHUB_REF != refs/tags/* ]]; then 
+            echo "Workflow Dispatch can only be run on tags" 
+            exit 1 
+          fi
+
       - uses: actions/checkout@v2
         with:
           submodules: true

.github/workflows/release-master.yml

@@ -27,7 +27,7 @@ jobs:
           token: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
           fetch-depth: 0
 
-      - name: Fail if tag is not master
+      - name: Fail if tag is not in master
         run: |
           if ! git merge-base --is-ancestor ${{ github.sha }} origin/master; then
             echo "Tag is not in master. This pipeline can only execute tags that are present on the master branch"

.github/workflows/release-selfhost.yml

@@ -8,16 +8,24 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - name: Fail if branch is not master
+      - name: Fail if not a tag
-        if: github.ref != 'refs/heads/master'
         run: |
-          echo "Ref is not master, you must run this job from master."
+          if [[ $GITHUB_REF != refs/tags/* ]]; then 
-          exit 1
+            echo "Workflow Dispatch can only be run on tags" 
+            exit 1 
+          fi
 
       - uses: actions/checkout@v2
         with: 
           fetch_depth: 0
 
+      - name: Fail if tag is not in master
+        run: |
+          if ! git merge-base --is-ancestor ${{ github.sha }} origin/master; then
+            echo "Tag is not in master. This pipeline can only execute tags that are present on the master branch"
+            exit 1
+          fi
+
       - name: Use Node.js 14.x
         uses: actions/setup-node@v1
         with:

.github/workflows/release-singleimage.yml

@@ -15,13 +15,24 @@ jobs:
       matrix:
         node-version: [14.x]
     steps:
-      - name: Fail if branch is not master
+      - name: Fail if not a tag
-        if: github.ref != 'refs/heads/master'
+        run: |
-        run: | 
+          if [[ $GITHUB_REF != refs/tags/* ]]; then 
-          echo "Ref is not master, you must run this job from master."
+            echo "Workflow Dispatch can only be run on tags" 
-          exit 1
+            exit 1 
+          fi
       - name: "Checkout"
         uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+
+      - name: Fail if tag is not in master
+        run: |
+          if ! git merge-base --is-ancestor ${{ github.sha }} origin/master; then
+            echo "Tag is not in master. This pipeline can only execute tags that are present on the master branch"
+            exit 1
+          fi
+          
       - name: Use Node.js ${{ matrix.node-version }}
         uses: actions/setup-node@v1
         with: