ignore non-default branches

not 100% on this, perhaps these should show in the projects but not on the dashboard

app/controllers/api/github_actions_webhooks_controller.rb

@@ -9,6 +9,11 @@ def create
       return
     end
 
+    unless workflow_job[:head_branch] == params[:repository][:default_branch]
+      render json: {}
+      return
+    end
+
     project = UpdateBuildStatus.call(
       workflow_job[:name],
       params[:repository][:ssh_url],

spec/requests/api/github_actions_webhooks_spec.rb

@@ -9,24 +9,33 @@
 
   let(:attributes) {
     {
-      repository: { ssh_url: "[email protected]:user/foo.git" },
+      repository: { ssh_url: "[email protected]:user/foo.git", default_branch: "main" },
       workflow_job: {
         name: "foo_tests",
         head_sha: "440f78f6de0c71e073707d9435db89f8e5390a59",
         status: "success",
         conclusion: "success",
         html_url: "http://example.com/status-for-job/foo_tests",
+        head_branch: "main"
       },
     }
   }
 
-  it "adds or updates build status" do
+  it "adds or updates build status for the default branch" do
     post "/api/github_actions_webhook", headers: { "X-Hub-Signature-256" => "sha256=secret" }, params: attributes
 
     expect(response).to be_successful
     expect(Build.last.status).to eq("successful")
   end
 
+  it "ignores requests for non-default branches" do
+    attributes[:workflow_job][:head_branch] = "feature-branch"
+    post "/api/github_actions_webhook", headers: { "X-Hub-Signature-256" => "sha256=secret" }, params: attributes
+
+    expect(response).to be_successful
+    expect(Build.all).to be_empty
+  end
+
   it "ignores requests without a workflow job" do
     post "/api/github_actions_webhook", headers: { "X-Hub-Signature-256" => "sha256=secret" }, params: { zen: "something else" }