Gitlab CI job running on new tag despite rules say run only on master

Question

I have a job in a pipeline as such:

msi_build:
  stage: Build
  script:
    - cd project_name
    - ls -a
    - wine python setup.py bdist_msi
  rules:
    - if: '$CI_COMMIT_REF_NAME == $BUILD_BRANCH'
    - changes:
      - /*.{py, html, css, yml, json}
  tags:
    - pywine
  artifacts:
    when: on_success
    paths:
      - /builds/$CI_PROJECT_PATH/project_name/dist/*.msi
    expire_in: 1 yrs

But this also runs when I tag a commit and push it in another branch.

BUILD_BRANCH is master. This won't run when only pushing normal commits to other branches. And it'll run when pushing to master. But for some reason unknown to me, it also runs on tagged commits. What is the cause?

If it matters I used: git push --atomic origin <branch name> <tag> when pushing to another branch.

You can see https://docs.gitlab.com/ee/ci/yaml/ to find out how to exclude tags — fredrik, Oct 18 '21 at 13:10
`/*.{py, html, css, yml, json}` this is an odd syntax. Are you sure it works? Where from did you take such syntax - is there any dcumentation? Why do you start with a leading `/`? — KamilCuk, Oct 18 '21 at 14:08
@KamilCuk I've got it from the example in https://docs.gitlab.com/ee/ci/yaml/#onlychanges--exceptchanges and https://stackoverflow.com/questions/40712275/gitlab-ci-how-to-trigger-a-build-only-if-changes-happen-on-particular-set-of-f . But yes, no exact documentation for ```/```. I guess ```**/*.json``` would also work for all dirs and subdirs. But this has worked so far — eemilk, Oct 19 '21 at 05:26

score 1 · Accepted Answer · answered Oct 18 '21 at 14:05

  rules:
    - if: '$CI_COMMIT_REF_NAME == $BUILD_BRANCH'
    - changes:
      - /*.{py, html, css, yml, json}

is not

  rules:
    - if: '$CI_COMMIT_REF_NAME == $BUILD_BRANCH'
      changes:
      - /*.{py, html, css, yml, json}

The first one runs when $CI_COMMIT_REF_NAME == $BUILD_BRANCH OR when the files were changed. The second one runs the job when that and that is equal AND the files with extensions were changed. Most probably in the commit the tag is run for the files with those extensions were changed, so the command is run, ignoring the first condition, because it's "or".

It's a good idea to add when: on_success to rules: explicitly, so it's nicely visible.

The ```when: on_success``` present here is for what I have gathered only for the artifacts https://docs.gitlab.com/ee/ci/yaml/#artifactswhen but otherwise thanks! — eemilk, Oct 19 '21 at 08:16

Gitlab CI job running on new tag despite rules say run only on master

1 Answers1