Prevent branches or tags from starting with invalid characters (e.g. -, .)valid-branch-name-dash-bug

Closes #38817

3 files changed, 11 insertions, 1 deletions

diff --git a/changelogs/unreleased/valid-branch-name-dash-bug.yml b/changelogs/unreleased/valid-branch-name-dash-bug.yml
new file mode 100644
index 00000000000..89e4578b3e5
--- /dev/null
+++ b/changelogs/unreleased/valid-branch-name-dash-bug.yml
@@ -0,0 +1,5 @@
+---
+title: Prevent branches or tags from starting with invalid characters (e.g. -, .)
+merge_request:
+author:
+type: fixed
diff --git a/lib/gitlab/git_ref_validator.rb b/lib/gitlab/git_ref_validator.rb
index a3c6b21a6a1..2e3e4fc3f1f 100644
--- a/lib/gitlab/git_ref_validator.rb
+++ b/lib/gitlab/git_ref_validator.rb
@@ -11,7 +11,7 @@ module Gitlab
       return false if ref_name.start_with?('refs/remotes/')
 
       Gitlab::Utils.system_silent(
-        %W(#{Gitlab.config.git.bin_path} check-ref-format refs/#{ref_name}))
+        %W(#{Gitlab.config.git.bin_path} check-ref-format --branch #{ref_name}))
     end
   end
 end
diff --git a/spec/lib/gitlab/git_ref_validator_spec.rb b/spec/lib/gitlab/git_ref_validator_spec.rb
index e1fa8ae03f8..ba7fb168a3b 100644
--- a/spec/lib/gitlab/git_ref_validator_spec.rb
+++ b/spec/lib/gitlab/git_ref_validator_spec.rb
@@ -4,6 +4,7 @@ describe Gitlab::GitRefValidator do
   it { expect(described_class.validate('feature/new')).to be_truthy }
   it { expect(described_class.validate('implement_@all')).to be_truthy }
   it { expect(described_class.validate('my_new_feature')).to be_truthy }
+  it { expect(described_class.validate('my-branch')).to be_truthy }
   it { expect(described_class.validate('#1')).to be_truthy }
   it { expect(described_class.validate('feature/refs/heads/foo')).to be_truthy }
   it { expect(described_class.validate('feature/~new/')).to be_falsey }
@@ -22,4 +23,8 @@ describe Gitlab::GitRefValidator do
   it { expect(described_class.validate('refs/remotes/')).to be_falsey }
   it { expect(described_class.validate('refs/heads/feature')).to be_falsey }
   it { expect(described_class.validate('refs/remotes/origin')).to be_falsey }
+  it { expect(described_class.validate('-')).to be_falsey }
+  it { expect(described_class.validate('-branch')).to be_falsey }
+  it { expect(described_class.validate('.tag')).to be_falsey }
+  it { expect(described_class.validate('my branch')).to be_falsey }
 end