Looking at this further, it looks like we don't need to deal with tags specifically, because the sha1 matches the tag. Instead we should restrict the branches to ref/heads. This PR looks like it would do bad things with anything that didnt match ref/heads.