act ignoring if: conditions — steps that should be skipped are running anyway

[centranoisacs]

I have a workflow with:

- name: Deploy
  if: github.ref == 'refs/heads/main'
  run: ./deploy.sh

On GitHub Actions this step only runs on the main branch. But when I run act push locally on a feature branch, the deploy step runs anyway. It's ignoring the if condition.

Is this expected? Does act evaluate github.ref differently than real Actions? I'm using act push --eventpath event.json with:

{
  "ref": "refs/heads/feature/my-branch"
}

But the step still executes. This is dangerous because I almost deployed to prod from a local test.

[mehvetero]

Yeah this is a known gotcha. act doesn't automatically pick up github.ref from your event.json the way you'd expect.

The --eventpath flag populates github.event.* fields, but github.ref and github.sha come from a different place — act infers them from your local git state or its own defaults, not from the event payload.

What actually works: pass the branch explicitly with -b:

act push -b feature/my-branch

This sets github.ref to refs/heads/feature/my-branch properly, and your if: github.ref == 'refs/heads/main' will correctly skip the deploy step.

If you want to be extra safe for local testing, you can also add a second guard in the workflow itself:

- name: Deploy
  if: github.ref == 'refs/heads/main' && !env.ACT
  run: ./deploy.sh

env.ACT is set to true whenever act is running. Belt and suspenders — catches the case where someone forgets the -b flag.

[Dotoryman]

The advice to use -b feature/my-branch is incorrect: in act, -b is the boolean --bind option, not a branch selector. For a push event, act reads the top-level ref from the event JSON into github.ref, falling back to the local Git ref only when that value is empty. Your payload should therefore make the deploy step skip.

First check what this run actually sees. Run act push -e ./event.json -v, and temporarily add a step before the deploy step:

- name: Inspect event ref
  run: |
    echo 'github.ref=${{ github.ref }}'
    echo 'github.event.ref=${{ github.event.ref }}'

If either value is refs/heads/main, check that ./event.json is the file being loaded (and that the ref is at the top level). If both show your feature branch but the deploy step still runs, please share the full workflow around that step, your act version, and the relevant verbose log; that would be worth reproducing as a bug. Until this is understood, don't pass production deployment credentials to a local test.

Source: -b and -e flag definitions, SetRef implementation.