Jenkins with GIT plugin - checkout specific tag and also limited to a specific branch

Question

I have managed to configure a jenkins task to checkout a specific GIT tag for further deployment to a remote server following this great blog post http://erics-notes.blogspot.be/2013/05/jenkins-build-latest-git-tag.html

In short I need to define refspec and branch properties to the following values in jenkins jobs SCM configuration:

Refspec: +refs/tags/live/*:refs/remotes/origin/tags/live/*
Branch Specifier (blank for 'any'): */tags/live/*

But now, I imagine that anybody of our developers could create a tag with a name elligible for deployment (live/...). The GIT plugin for jenkins traverses all available branches looking for matching tag names.

How can I ensure in a jenkins job (configured as described in the blog post above), that a tag is checked out only if the underlying commit is on a specific branch, e.g. our protected "master" branch?

Answer 1

After extensive search for answers to the question above I have a feeling, that it is not possible to restrict the deployment to tags pointing to commits on a specific branch. I found somewhere an answer to similar question (which I can not find again today) stating, that "GIT is not designed that way". Tags live in a global namespace not bound to any branch. So the only solution could be e.g. restrict the tagging possibility for certain users, but that is a different story and I do not want to follow that path any further.

Feel free to confirm that some day please :-)

At the beginnining I had the idea of deploying HEAD of the "master" branch to STAGE and a specific tag (from master branch) to LIVE. Now I will just introduce another branch to deploy to STAGE from.