title: How to allow tags in Azure DevOps environment branch control
body: <p>We would like to limit our prod-level service connections to master branches as a protection so we only deploy code that has been reviewed. For now we setup a master branch control on the production environment in <em>&quot;Approvals and Checks&quot;</em> to be <em>refs/heads/master</em>.</p>
  <p>That works, so if a pipeline references any template from another repository, this will fail if the ref property is something else than master.</p>
  <p>Now we would like to also allow tags for custom pipeline templates versioning, so the pipeline could reference a template by tag. We can do it like this</p>
  <pre><code> repositories:
      - repository: templates
        name: RepositoryWithTemplates
        type: git
        ref: refs/tags/0.0.1
  </code></pre>
  <p>However, we don't want to allow all the tags, but only the tags of commits, that are already on master.</p>
  <p>We try to do it by using &quot;<em>Invoke Azure Function</em>&quot; in &quot;<em>Approvals and Checks</em>&quot; of the environment in order to do our custom branch control inside of an azure function. This function will need to check every repository reference and if a tag present, run a git command to check this tag is pointing to commit on master.</p>
  <p>But we didn't find yet a way to get all the resources/repositories of the pipeline to pass as arguments to the function, or to query them from Azure DevOps API.</p>
  <p>Does anybody know if it is possible to obtain from environment variables or from the API all the resources and repositories used in the pipeline? Somehow the standard &quot;branch control&quot; check does it for all the repositories, but is it even exposed for the custom control checks?</p>