Tag and environment conditions — controlling which events touch which environments

A tag is a permanent name attached to a specific commit. A push event is a transient notification. The difference matters: a deploy triggered by a tag points at a specific, recoverable, signable artifact; a deploy triggered by a push to main points at whatever main happens to be at that moment.

Tag triggers

on:
  push:
    tags:
      - 'v*.*.*'
    branches-ignore:
      - '**'

The pattern v*.*.* matches v1.0.0 and v2.3.7-rc1. Combining tags: with branches-ignore: ['**'] says only deploy on tag - the trigger fires for tag pushes only, never for branch pushes.

flowchart LR
    A[git push] --> B{Is this a tag?}
    B -- "yes" --> D[Tag trigger fires]
    B -- "no" --> C[Branch trigger fires]
    D --> E[Build signed artifact]
    E --> F[Deploy to named environment]
    C --> G[Build but do not deploy]

The same pattern in GitLab CI uses $CI_COMMIT_TAG:

deploy-prod:
  stage: deploy
  rules:
    - if: '$CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+$/'
  environment: production
  script:
    - deploy.sh

Environment conditions

An environment is a named deployment target. The name is metadata with consequences: protection rules, secrets, approval gates, and deployment history are attached to the name.

jobs:
  deploy-prod:
    environment:
      name: production
    runs-on: ubuntu-latest
    steps:
      - run: deploy.sh production

The environment: block is what attaches a job to a named environment. Protection rules on that environment are evaluated when the job tries to start. A job that targets production without the required approvals is held. A job that targets a string called prod is not targeting production; it is targeting a string - the platform does not bind protection rules, secrets, or audit history to a string variable.

Production discipline

1. The deploy job’s trigger is the release act. A deploy on push-to-main is a side effect, not a release. Move the trigger to tags: or workflow_dispatch:.
2. The environment name is the audit unit. Use the platform’s environment mechanism; do not reimplement it with a string variable.
3. The tag is signed. git tag -s or -u for hardware roots of trust.

Cross-course references

• Linux for Production Sysadmins - Part XXX covers signed packages, the package-management analogue.
• Terraform for Production Sysadmins - Part XXVIII covers promoting an immutable artifact across environments.

Quiz