fix: correct Bitbucket trigger type validation for push events

- Fix logic to reject tag events when triggerType is 'push'
- Add test case to verify tags are rejected when triggerType is 'push'
- Addresses Greptile bot feedback on PR #3711

Author: BENZOOgataga

apps/dokploy/__test__/deploy/github.test.ts

@@ -504,6 +504,16 @@ describe("Webhook Trigger Type Validation", () => {
 			expect(validateTriggerType(headers, body, "push")).toBe(true);
 		});
 
+		it("should reject tag push events when triggerType is push", () => {
+			const headers = { "x-event-key": "repo:push" };
+			const body = {
+				push: {
+					changes: [{ new: { type: "tag", name: "v1.0.0" } }],
+				},
+			};
+			expect(validateTriggerType(headers, body, "push")).toBe(false);
+		});
+
 		it("should allow tag push events when triggerType is tag", () => {
 			const headers = { "x-event-key": "repo:push" };
 			const body = {

apps/dokploy/pages/api/deploy/[refreshToken].ts

@@ -71,15 +71,17 @@ export const validateTriggerType = (
 	// Bitbucket
 	const bitbucketEvent = headers["x-event-key"];
 	if (bitbucketEvent?.includes("repo:push")) {
+		const changes = body.push?.changes || [];
 		if (triggerType === "tag") {
 			// For Bitbucket, check if the push is for a tag
-			const changes = body.push?.changes || [];
 			return changes.some(
 				(change: any) => change.new?.type === "tag" || change.new?.type === "annotated_tag",
 			);
 		}
 		// For push trigger type, accept push events that are not tags
-		return true;
+		return !changes.some(
+			(change: any) => change.new?.type === "tag" || change.new?.type === "annotated_tag",
+		);
 	}
 
 	// Default: if we can't determine the provider, allow the event (backward compatibility)