From fc4b03d158539a845add9ed8de286eb1eab99c68 Mon Sep 17 00:00:00 2001
From: Rory Powell <rory.codes@gmail.com>
Date: Tue, 6 Jun 2023 07:42:33 +0100
Subject: [PATCH 01/20] Release master updates

---
 .github/workflows/release-master.yml | 1 +
 .github/workflows/tag-release.yml    | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release-master.yml b/.github/workflows/release-master.yml
index f05d369a34..a6d6208d93 100644
--- a/.github/workflows/release-master.yml
+++ b/.github/workflows/release-master.yml
@@ -65,6 +65,7 @@ jobs:
       - name: Publish budibase packages to NPM
         env:
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          # TODO: What do we do here? 'versioning' is not defined
           RELEASE_VERSION_TYPE: ${{ github.event.inputs.versioning }}
         run: |
           # setup the username and email. I tend to use 'GitHub Actions Bot' with no email by default
diff --git a/.github/workflows/tag-release.yml b/.github/workflows/tag-release.yml
index 1dcb16ac56..01db27bcc3 100644
--- a/.github/workflows/tag-release.yml
+++ b/.github/workflows/tag-release.yml
@@ -28,7 +28,7 @@ on:
         required: true
 
 jobs:
-  tag-prerelease:
+  tag-release:
     runs-on: ubuntu-latest
 
     steps:
@@ -43,7 +43,7 @@ jobs:
           token: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
 
       - run: yarn
-      - name: Tag prerelease
+      - name: Tag release
         run: |
           # setup the username and email.
           git config --global user.name "Budibase Staging Release Bot"

From b79a6b82ba4f9103b1f2c89cb60d840fbf510c4e Mon Sep 17 00:00:00 2001
From: Adria Navarro <adria@budibase.com>
Date: Tue, 6 Jun 2023 08:06:33 +0100
Subject: [PATCH 02/20] Publish release with the already fixed version

---
 .github/workflows/release-master.yml | 2 --
 package.json                         | 4 ++--
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/release-master.yml b/.github/workflows/release-master.yml
index a6d6208d93..97f823c11e 100644
--- a/.github/workflows/release-master.yml
+++ b/.github/workflows/release-master.yml
@@ -65,8 +65,6 @@ jobs:
       - name: Publish budibase packages to NPM
         env:
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-          # TODO: What do we do here? 'versioning' is not defined
-          RELEASE_VERSION_TYPE: ${{ github.event.inputs.versioning }}
         run: |
           # setup the username and email. I tend to use 'GitHub Actions Bot' with no email by default
           git config --global user.name "Budibase Release Bot"
diff --git a/package.json b/package.json
index 3849c65274..ffb3fa775a 100644
--- a/package.json
+++ b/package.json
@@ -38,8 +38,8 @@
     "backend:build": "./scripts/scopeBackend.sh 'lerna run --stream build'",
     "build:sdk": "lerna run --stream build:sdk",
     "deps:circular": "madge packages/server/dist/index.js packages/worker/src/index.ts packages/backend-core/dist/src/index.js packages/cli/src/index.js --circular",
-    "release": "lerna publish ${RELEASE_VERSION_TYPE:-patch} --yes --force-publish --no-git-tag-version --no-push --no-git-reset",
-    "release:develop": "lerna publish from-package --yes --force-publish --dist-tag develop --exact --no-git-tag-version --no-push --no-git-reset",
+    "release": "lerna publish from-package --yes --force-publish --no-git-tag-version --no-push --no-git-reset",
+    "release:develop": "yarn release --dist-tag develop",
     "restore": "yarn run clean && yarn run bootstrap && yarn run build",
     "nuke": "yarn run nuke:packages && yarn run nuke:docker",
     "nuke:packages": "yarn run restore",

From 689d423e05301c53280755fd839e1795671d1c13 Mon Sep 17 00:00:00 2001
From: Adria Navarro <adria@budibase.com>
Date: Tue, 6 Jun 2023 08:11:30 +0100
Subject: [PATCH 03/20] Fix wrong message

---
 scripts/versionCommit.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/versionCommit.sh b/scripts/versionCommit.sh
index 10e7a9df71..d70f6900e2 100755
--- a/scripts/versionCommit.sh
+++ b/scripts/versionCommit.sh
@@ -2,7 +2,7 @@
 
 if [ -z "$1" ]
 then
-  echo "Error: version number is required. Usage: $0 [major|minor|patch|prerelease]"
+  echo "Error: bump type is required. Usage: $0 [major|minor|patch|prerelease]"
   exit 1
 fi
 

From e7e28c0367b09a089b359012e29bab98e6f61462 Mon Sep 17 00:00:00 2001
From: Adria Navarro <adria@revityapp.com>
Date: Tue, 6 Jun 2023 09:26:07 +0200
Subject: [PATCH 04/20] Defaulting release version to patch

---
 .github/workflows/tag-release.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/tag-release.yml b/.github/workflows/tag-release.yml
index 01db27bcc3..40340ad2f1 100644
--- a/.github/workflows/tag-release.yml
+++ b/.github/workflows/tag-release.yml
@@ -48,4 +48,4 @@ jobs:
           # setup the username and email.
           git config --global user.name "Budibase Staging Release Bot"
           git config --global user.email "<>"
-          ./scripts/versionCommit.sh ${{ github.event.inputs.versioning }}
+          ./scripts/versionCommit.sh ${{ github.event.inputs.versioning:-patch }}

From 2f8ad0ab8fcd27a152b210924925f448b057bf0e Mon Sep 17 00:00:00 2001
From: Adria Navarro <adria@budibase.com>
Date: Tue, 6 Jun 2023 08:49:12 +0100
Subject: [PATCH 05/20] Update tag-release.yml

Fix default value
---
 .github/workflows/tag-release.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/tag-release.yml b/.github/workflows/tag-release.yml
index 40340ad2f1..47e8c5c11d 100644
--- a/.github/workflows/tag-release.yml
+++ b/.github/workflows/tag-release.yml
@@ -48,4 +48,4 @@ jobs:
           # setup the username and email.
           git config --global user.name "Budibase Staging Release Bot"
           git config --global user.email "<>"
-          ./scripts/versionCommit.sh ${{ github.event.inputs.versioning:-patch }}
+          ./scripts/versionCommit.sh ${{ github.event.inputs.versioning || "patch" }}

From 05ad752c918e01f615d1bc5942b14c6e73343d1f Mon Sep 17 00:00:00 2001
From: Adria Navarro <adria@budibase.com>
Date: Tue, 6 Jun 2023 08:52:32 +0100
Subject: [PATCH 06/20] Update tag-release.yml

---
 .github/workflows/tag-release.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/tag-release.yml b/.github/workflows/tag-release.yml
index 47e8c5c11d..f361c200a0 100644
--- a/.github/workflows/tag-release.yml
+++ b/.github/workflows/tag-release.yml
@@ -48,4 +48,6 @@ jobs:
           # setup the username and email.
           git config --global user.name "Budibase Staging Release Bot"
           git config --global user.email "<>"
-          ./scripts/versionCommit.sh ${{ github.event.inputs.versioning || "patch" }}
+          BUMP_TYPE_INPUT=${{ github.event.inputs.versioning }}
+          BUMP_TYPE=${BUMP_TYPE_INPUT:-"patch"}
+          ./scripts/versionCommit.sh $BUMP_TYPE

From 1c983b4638916f4af7585e3250037d5d7f523530 Mon Sep 17 00:00:00 2001
From: Budibase Staging Release Bot <>
Date: Tue, 6 Jun 2023 07:55:44 +0000
Subject: [PATCH 07/20] Bump version to 2.6.24

---
 lerna.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lerna.json b/lerna.json
index 9f8cd12e31..9a16f2537d 100644
--- a/lerna.json
+++ b/lerna.json
@@ -1,5 +1,5 @@
 {
-  "version": "2.6.24-alpha.0",
+  "version": "2.6.24",
   "npmClient": "yarn",
   "packages": [
     "packages/backend-core",

From 59eb02a7fb553bbffc406c5f6a12362238a76643 Mon Sep 17 00:00:00 2001
From: Adria Navarro <adria@budibase.com>
Date: Tue, 6 Jun 2023 09:04:20 +0100
Subject: [PATCH 08/20] Remove unused input

---
 .github/workflows/release-master.yml | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/.github/workflows/release-master.yml b/.github/workflows/release-master.yml
index 97f823c11e..200391b4e0 100644
--- a/.github/workflows/release-master.yml
+++ b/.github/workflows/release-master.yml
@@ -10,11 +10,6 @@ on:
       # Exclude all pre-releases
       - "!v*[0-9]+.[0-9]+.[0-9]+-*"
   workflow_dispatch:
-    inputs:
-      tags:
-        description: "Release tag"
-        required: true
-        type: boolean
 
 env:
   # Posthog token used by ui at build time

From 1b54a028db7039ece2be97f11dacc70258f9a89f Mon Sep 17 00:00:00 2001
From: Adria Navarro <adria@budibase.com>
Date: Tue, 6 Jun 2023 09:04:39 +0100
Subject: [PATCH 09/20] Check type instead of reference

---
 .github/workflows/release-master.yml | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/release-master.yml b/.github/workflows/release-master.yml
index 200391b4e0..7cc2d57802 100644
--- a/.github/workflows/release-master.yml
+++ b/.github/workflows/release-master.yml
@@ -28,12 +28,13 @@ jobs:
           token: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
           fetch-depth: 0
 
-      - name: Fail if branch is not master
-        if: github.ref != 'refs/heads/master'
+      - name: Fail if tag is not master
         run: |
-          echo "Ref is not master, you must run this job from master."
-          // Change to "exit 1" when merged. Left to 0 to not fail all the pipelines and not to cause noise
-          exit 0
+          if ! git merge-base --is-ancestor ${{ github.sha }} origin/develop; then
+            echo "Tag is not in master. This pipeline can only execute tags that are present on the master branch"
+            exit 1
+          fi
+
 
       - uses: actions/setup-node@v1
         with:

From e173cd2c5184af621f15b51de6209befc94e5ea0 Mon Sep 17 00:00:00 2001
From: Adria Navarro <adria@budibase.com>
Date: Tue, 6 Jun 2023 09:11:45 +0100
Subject: [PATCH 10/20] Fix pointer

---
 .github/workflows/release-master.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/release-master.yml b/.github/workflows/release-master.yml
index 7cc2d57802..271cfdb45a 100644
--- a/.github/workflows/release-master.yml
+++ b/.github/workflows/release-master.yml
@@ -30,7 +30,7 @@ jobs:
 
       - name: Fail if tag is not master
         run: |
-          if ! git merge-base --is-ancestor ${{ github.sha }} origin/develop; then
+          if ! git merge-base --is-ancestor ${{ github.sha }} origin/master; then
             echo "Tag is not in master. This pipeline can only execute tags that are present on the master branch"
             exit 1
           fi

From 63017cf959fdf29f58a8268317de3f4a655199c9 Mon Sep 17 00:00:00 2001
From: Adria Navarro <adria@budibase.com>
Date: Tue, 6 Jun 2023 09:12:10 +0100
Subject: [PATCH 11/20] Remove manual trigger

---
 .github/workflows/release-master.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/release-master.yml b/.github/workflows/release-master.yml
index 271cfdb45a..7cf2f99d9f 100644
--- a/.github/workflows/release-master.yml
+++ b/.github/workflows/release-master.yml
@@ -9,7 +9,6 @@ on:
       - "v[0-9]+.[0-9]+.[0-9]+"
       # Exclude all pre-releases
       - "!v*[0-9]+.[0-9]+.[0-9]+-*"
-  workflow_dispatch:
 
 env:
   # Posthog token used by ui at build time

From 389707e14b103cea8f9e0387fd06e7c4207181db Mon Sep 17 00:00:00 2001
From: Budibase Staging Release Bot <>
Date: Tue, 6 Jun 2023 08:30:12 +0000
Subject: [PATCH 12/20] Bump version to 2.6.25

---
 lerna.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lerna.json b/lerna.json
index 9a16f2537d..550506daf3 100644
--- a/lerna.json
+++ b/lerna.json
@@ -1,5 +1,5 @@
 {
-  "version": "2.6.24",
+  "version": "2.6.25",
   "npmClient": "yarn",
   "packages": [
     "packages/backend-core",

From 395963225468c78ae82da4ea39a1a074c13bc1eb Mon Sep 17 00:00:00 2001
From: Rory Powell <rory.codes@gmail.com>
Date: Tue, 6 Jun 2023 09:43:04 +0100
Subject: [PATCH 13/20] Exclude pro from bb lint

---
 .eslintrc.json | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.eslintrc.json b/.eslintrc.json
index 87f8269c50..79e0c00abd 100644
--- a/.eslintrc.json
+++ b/.eslintrc.json
@@ -16,7 +16,8 @@
     "dist",
     "public",
     "*.spec.js",
-    "bundle.js"
+    "bundle.js",
+    "packages/pro"
   ],
   "plugins": ["svelte3"],
   "extends": ["eslint:recommended"],

From 2b422a471e9af60cac6c5b9e780dfb861c1f576f Mon Sep 17 00:00:00 2001
From: Budibase Staging Release Bot <>
Date: Tue, 6 Jun 2023 08:55:39 +0000
Subject: [PATCH 14/20] Bump version to 2.6.26

---
 lerna.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lerna.json b/lerna.json
index 550506daf3..fbd57a02b2 100644
--- a/lerna.json
+++ b/lerna.json
@@ -1,5 +1,5 @@
 {
-  "version": "2.6.25",
+  "version": "2.6.26",
   "npmClient": "yarn",
   "packages": [
     "packages/backend-core",

From d70e49d74f776a8ab2f284c048ff44b27f6a0303 Mon Sep 17 00:00:00 2001
From: Andrew Kingston <andrew@kingston.dev>
Date: Tue, 6 Jun 2023 10:11:51 +0100
Subject: [PATCH 15/20] Add event for tracking user collaboration

---
 packages/backend-core/src/events/publishers/user.ts | 11 +++++++++++
 packages/server/src/websockets/builder.ts           |  5 ++++-
 packages/types/src/sdk/events/event.ts              |  4 ++++
 packages/types/src/sdk/events/user.ts               |  4 ++++
 4 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/packages/backend-core/src/events/publishers/user.ts b/packages/backend-core/src/events/publishers/user.ts
index 0d08c0a759..43e5355bd5 100644
--- a/packages/backend-core/src/events/publishers/user.ts
+++ b/packages/backend-core/src/events/publishers/user.ts
@@ -3,6 +3,7 @@ import {
   Event,
   User,
   UserCreatedEvent,
+  UserDataCollaborationEvent,
   UserDeletedEvent,
   UserInviteAcceptedEvent,
   UserInvitedEvent,
@@ -173,6 +174,15 @@ async function passwordReset(user: User) {
   await publishEvent(Event.USER_PASSWORD_RESET, properties)
 }
 
+// COLLABORATION
+
+async function dataCollaboration(users: number) {
+  const properties: UserDataCollaborationEvent = {
+    users,
+  }
+  await publishEvent(Event.USER_DATA_COLLABORATION, properties)
+}
+
 export default {
   created,
   updated,
@@ -188,4 +198,5 @@ export default {
   passwordUpdated,
   passwordResetRequested,
   passwordReset,
+  dataCollaboration,
 }
diff --git a/packages/server/src/websockets/builder.ts b/packages/server/src/websockets/builder.ts
index 0580a58b42..0f2c43e5ab 100644
--- a/packages/server/src/websockets/builder.ts
+++ b/packages/server/src/websockets/builder.ts
@@ -1,6 +1,6 @@
 import authorized from "../middleware/authorized"
 import { BaseSocket } from "./websocket"
-import { permissions } from "@budibase/backend-core"
+import { permissions, events } from "@budibase/backend-core"
 import http from "http"
 import Koa from "koa"
 import { Datasource, Table, SocketSession, ContextUser } from "@budibase/types"
@@ -22,6 +22,9 @@ export default class BuilderSocket extends BaseSocket {
       // Reply with all users in current room
       const sessions = await this.getRoomSessions(appId)
       callback({ users: sessions })
+
+      // Track usage
+      await events.user.dataCollaboration(sessions.length)
     })
   }
 
diff --git a/packages/types/src/sdk/events/event.ts b/packages/types/src/sdk/events/event.ts
index 0d0b166253..f20f1b8fd6 100644
--- a/packages/types/src/sdk/events/event.ts
+++ b/packages/types/src/sdk/events/event.ts
@@ -26,6 +26,9 @@ export enum Event {
   USER_PASSWORD_RESET_REQUESTED = "user:password:reset:requested",
   USER_PASSWORD_RESET = "user:password:reset",
 
+  // USER / COLLABORATION
+  USER_DATA_COLLABORATION = "user:data:collaboration",
+
   // EMAIL
   EMAIL_SMTP_CREATED = "email:smtp:created",
   EMAIL_SMTP_UPDATED = "email:smtp:updated",
@@ -233,6 +236,7 @@ export const AuditedEventFriendlyName: Record<Event, string | undefined> = {
   [Event.USER_PASSWORD_FORCE_RESET]: undefined,
   [Event.USER_GROUP_ONBOARDING]: undefined,
   [Event.USER_ONBOARDING_COMPLETE]: undefined,
+  [Event.USER_DATA_COLLABORATION]: undefined,
 
   // EMAIL
   [Event.EMAIL_SMTP_CREATED]: `Email configuration created`,
diff --git a/packages/types/src/sdk/events/user.ts b/packages/types/src/sdk/events/user.ts
index 955f198732..eb3ebe97a5 100644
--- a/packages/types/src/sdk/events/user.ts
+++ b/packages/types/src/sdk/events/user.ts
@@ -86,3 +86,7 @@ export interface UserPasswordResetEvent extends BaseEvent {
     email: string
   }
 }
+
+export interface UserDataCollaborationEvent extends BaseEvent {
+  users: number
+}

From cfd7100c8c26e47eb9542d43c7e58b46290c4aed Mon Sep 17 00:00:00 2001
From: Adria Navarro <adria@budibase.com>
Date: Tue, 6 Jun 2023 10:36:21 +0100
Subject: [PATCH 16/20] Always use the checked out version

---
 .github/workflows/deploy-preprod.yml | 7 +------
 .github/workflows/release-master.yml | 1 -
 2 files changed, 1 insertion(+), 7 deletions(-)

diff --git a/.github/workflows/deploy-preprod.yml b/.github/workflows/deploy-preprod.yml
index 57e2504ded..6ce1697d3a 100644
--- a/.github/workflows/deploy-preprod.yml
+++ b/.github/workflows/deploy-preprod.yml
@@ -16,12 +16,7 @@ jobs:
       - name: Get the latest budibase release version
         id: version
         run: |
-          if [ -z "${{ github.event.inputs.version }}" ]; then
-            git pull
-            release_version=$(cat lerna.json | jq -r '.version')
-          else
-            release_version=${{ github.event.inputs.version }}
-          fi
+          release_version=$(cat lerna.json | jq -r '.version')
           echo "RELEASE_VERSION=$release_version" >> $GITHUB_ENV
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v1
diff --git a/.github/workflows/release-master.yml b/.github/workflows/release-master.yml
index 7cf2f99d9f..8f371a2481 100644
--- a/.github/workflows/release-master.yml
+++ b/.github/workflows/release-master.yml
@@ -134,7 +134,6 @@ jobs:
       - name: Get the latest budibase release version
         id: version
         run: |
-          git pull
           release_version=$(cat lerna.json | jq -r '.version')
           echo "RELEASE_VERSION=$release_version" >> $GITHUB_ENV
 

From a4844427b508d3bc0c168c69d9f01cd3544edcbd Mon Sep 17 00:00:00 2001
From: Budibase Staging Release Bot <>
Date: Tue, 6 Jun 2023 09:43:37 +0000
Subject: [PATCH 17/20] Bump version to 2.6.27

---
 lerna.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lerna.json b/lerna.json
index fbd57a02b2..1352dd768e 100644
--- a/lerna.json
+++ b/lerna.json
@@ -1,5 +1,5 @@
 {
-  "version": "2.6.26",
+  "version": "2.6.27",
   "npmClient": "yarn",
   "packages": [
     "packages/backend-core",

From 8d6e8967c5a0e25cb372a62b7b1639fc5233c992 Mon Sep 17 00:00:00 2001
From: Adria Navarro <adria@budibase.com>
Date: Tue, 6 Jun 2023 11:12:29 +0100
Subject: [PATCH 18/20] Change pipelines to use tags and secure them properly

---
 .github/workflows/deploy-cloud.yaml       | 30 ++++++++++++-----------
 .github/workflows/deploy-preprod.yml      | 21 +++++++++++++---
 .github/workflows/release-develop.yml     |  7 ++++++
 .github/workflows/release-master.yml      |  2 +-
 .github/workflows/release-selfhost.yml    | 16 +++++++++---
 .github/workflows/release-singleimage.yml | 21 ++++++++++++----
 6 files changed, 69 insertions(+), 28 deletions(-)

diff --git a/.github/workflows/deploy-cloud.yaml b/.github/workflows/deploy-cloud.yaml
index fa80da846f..d8f1ee88f9 100644
--- a/.github/workflows/deploy-cloud.yaml
+++ b/.github/workflows/deploy-cloud.yaml
@@ -2,23 +2,29 @@ name: Budibase Deploy Production
 
 on:
  workflow_dispatch:
-  inputs:
-    version:
-      description: Budibase release version. For example - 1.0.0
-      required: false
 
 jobs:
   release:
     runs-on: ubuntu-latest
 
     steps:
-      - name: Fail if branch is not master
-        if: github.ref != 'refs/heads/master' 
-        run: | 
-          echo "Ref is not master, you must run this job from master."
-          exit 1
+      - name: Fail if not a tag
+        run: |
+          if [[ $GITHUB_REF != refs/tags/* ]]; then 
+            echo "Workflow Dispatch can only be run on tags" 
+            exit 1 
+          fi
 
       - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+
+      - name: Fail if tag is not in master
+        run: |
+          if ! git merge-base --is-ancestor ${{ github.sha }} origin/master; then
+            echo "Tag is not in master. This pipeline can only execute tags that are present on the master branch"
+            exit 1
+          fi
 
       - name: Pull values.yaml from budibase-infra
         run: | 
@@ -31,11 +37,7 @@ jobs:
       - name: Get the latest budibase release version
         id: version
         run: | 
-          if [ -z "${{ github.event.inputs.version }}" ]; then
-            release_version=$(cat lerna.json | jq -r '.version')
-          else
-            release_version=${{ github.event.inputs.version }}
-          fi
+          release_version=$(cat lerna.json | jq -r '.version')
           echo "RELEASE_VERSION=$release_version" >> $GITHUB_ENV
       
       - name: Configure AWS Credentials
diff --git a/.github/workflows/deploy-preprod.yml b/.github/workflows/deploy-preprod.yml
index 6ce1697d3a..81395bc7e3 100644
--- a/.github/workflows/deploy-preprod.yml
+++ b/.github/workflows/deploy-preprod.yml
@@ -1,17 +1,30 @@
 name: "deploy-preprod"
 on:
   workflow_dispatch:
-    inputs:
-      version:
-        description: Budibase release version. For example - 1.0.0
-        required: false
   workflow_call:
 
 jobs:
   deploy-to-legacy-preprod-env:
     runs-on: ubuntu-latest
     steps:
+      - name: Fail if not a tag
+        run: |
+          if [[ $GITHUB_REF != refs/tags/* ]]; then 
+            echo "Workflow Dispatch can only be run on tags" 
+            exit 1 
+          fi
+
       - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+
+      - name: Fail if tag is not in master
+        run: |
+          if ! git merge-base --is-ancestor ${{ github.sha }} origin/master; then
+            echo "Tag is not in master. This pipeline can only execute tags that are present on the master branch"
+            exit 1
+          fi
+      
 
       - name: Get the latest budibase release version
         id: version
diff --git a/.github/workflows/release-develop.yml b/.github/workflows/release-develop.yml
index 48c51e8457..503fc53194 100644
--- a/.github/workflows/release-develop.yml
+++ b/.github/workflows/release-develop.yml
@@ -22,6 +22,13 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
+      - name: Fail if not a tag
+        run: |
+          if [[ $GITHUB_REF != refs/tags/* ]]; then 
+            echo "Workflow Dispatch can only be run on tags" 
+            exit 1 
+          fi
+
       - uses: actions/checkout@v2
         with:
           submodules: true
diff --git a/.github/workflows/release-master.yml b/.github/workflows/release-master.yml
index 8f371a2481..a4e679e7bf 100644
--- a/.github/workflows/release-master.yml
+++ b/.github/workflows/release-master.yml
@@ -27,7 +27,7 @@ jobs:
           token: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
           fetch-depth: 0
 
-      - name: Fail if tag is not master
+      - name: Fail if tag is not in master
         run: |
           if ! git merge-base --is-ancestor ${{ github.sha }} origin/master; then
             echo "Tag is not in master. This pipeline can only execute tags that are present on the master branch"
diff --git a/.github/workflows/release-selfhost.yml b/.github/workflows/release-selfhost.yml
index f5a2f643c3..8b1ae0c6fe 100644
--- a/.github/workflows/release-selfhost.yml
+++ b/.github/workflows/release-selfhost.yml
@@ -8,16 +8,24 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - name: Fail if branch is not master
-        if: github.ref != 'refs/heads/master'
+      - name: Fail if not a tag
         run: |
-          echo "Ref is not master, you must run this job from master."
-          exit 1
+          if [[ $GITHUB_REF != refs/tags/* ]]; then 
+            echo "Workflow Dispatch can only be run on tags" 
+            exit 1 
+          fi
 
       - uses: actions/checkout@v2
         with: 
           fetch_depth: 0
 
+      - name: Fail if tag is not in master
+        run: |
+          if ! git merge-base --is-ancestor ${{ github.sha }} origin/master; then
+            echo "Tag is not in master. This pipeline can only execute tags that are present on the master branch"
+            exit 1
+          fi
+
       - name: Use Node.js 14.x
         uses: actions/setup-node@v1
         with:
diff --git a/.github/workflows/release-singleimage.yml b/.github/workflows/release-singleimage.yml
index cd16574eea..fbf972a866 100644
--- a/.github/workflows/release-singleimage.yml
+++ b/.github/workflows/release-singleimage.yml
@@ -15,13 +15,24 @@ jobs:
       matrix:
         node-version: [14.x]
     steps:
-      - name: Fail if branch is not master
-        if: github.ref != 'refs/heads/master'
-        run: | 
-          echo "Ref is not master, you must run this job from master."
-          exit 1
+      - name: Fail if not a tag
+        run: |
+          if [[ $GITHUB_REF != refs/tags/* ]]; then 
+            echo "Workflow Dispatch can only be run on tags" 
+            exit 1 
+          fi
       - name: "Checkout"
         uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+
+      - name: Fail if tag is not in master
+        run: |
+          if ! git merge-base --is-ancestor ${{ github.sha }} origin/master; then
+            echo "Tag is not in master. This pipeline can only execute tags that are present on the master branch"
+            exit 1
+          fi
+          
       - name: Use Node.js ${{ matrix.node-version }}
         uses: actions/setup-node@v1
         with:

From 9506a915f3587f782ff557db84821bf11764459e Mon Sep 17 00:00:00 2001
From: Adria Navarro <adria@budibase.com>
Date: Tue, 6 Jun 2023 11:22:24 +0100
Subject: [PATCH 19/20] Remove git pull

---
 .github/workflows/release-selfhost.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/release-selfhost.yml b/.github/workflows/release-selfhost.yml
index 8b1ae0c6fe..9df089223e 100644
--- a/.github/workflows/release-selfhost.yml
+++ b/.github/workflows/release-selfhost.yml
@@ -86,7 +86,6 @@ jobs:
           git config user.name "Budibase Helm Bot"
           git config user.email "<>"
           git reset --hard
-          git pull
           mkdir sync
           echo "Packaging chart to sync dir"
           helm package charts/budibase --version "$RELEASE_VERSION" --app-version "$RELEASE_VERSION" --destination sync

From ef9f4955faff66df1aed652f549e0d09cb2c5161 Mon Sep 17 00:00:00 2001
From: Rory Powell <rory.codes@gmail.com>
Date: Tue, 6 Jun 2023 11:27:08 +0100
Subject: [PATCH 20/20] Add fetch insted of pull

---
 .github/workflows/release-selfhost.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/release-selfhost.yml b/.github/workflows/release-selfhost.yml
index 9df089223e..1ace297ed9 100644
--- a/.github/workflows/release-selfhost.yml
+++ b/.github/workflows/release-selfhost.yml
@@ -86,6 +86,7 @@ jobs:
           git config user.name "Budibase Helm Bot"
           git config user.email "<>"
           git reset --hard
+          git fetch
           mkdir sync
           echo "Packaging chart to sync dir"
           helm package charts/budibase --version "$RELEASE_VERSION" --app-version "$RELEASE_VERSION" --destination sync