Skip to content

Allow guests to see tag names associated with releases

Currently, we treat "tag names" associated with releases as source code and don't allow guests to see them.

But:

  1. we use the tag name as ID for releases, so without it, guests won't be able to see the release page.
  2. we use tag name as the default "name" for the release, so guest will see releases called "release-ID" (which is a strange user experience)
  3. we even consider removing some features for guest users to preserve this security feature
  4. all these workarounds require a lot of time of our development team to support

We can solve of this by relaxing security requirements a little and allowing users to see tag name for releases. (Note that all tag related information like commit SHA will still be unavailable)

The end result is

  1. Guests see proper names of releases (in case name is empty we show tag as name)
  2. Guests can visit the individual release page (tag is treated as ID, so previously we couldn't give users URL)
  3. We can remove all other workarounds we put in place to prevent a user from knowing the tag name. (Tracked in a separate issue #345568 (closed))
Edited by Bala Kumar