GitLab Pipeline for deploying code to Platform.sh/Upsun but only when tagged

.gitlab-ci.yml

workflow:
  name: Deploy to Platform.sh on tag
  rules:
    - if: $CI_COMMIT_TAG && $CI_PIPELINE_SOURCE == "push"

default:
  cache: &global_cache
    key: push-to-psh
    paths:
      - "push.txt"
    when: always

stages:
  - setup
  - perform

should_we_push:
  stage: setup
  before_script:
    - git fetch origin "${CI_DEFAULT_BRANCH}"
    - git fetch --tags
    - git checkout "${CI_DEFAULT_BRANCH}"
  script: |
    pushToPSH="no"
    if [ "${CI_COMMIT_TAG}" == "$(git describe --abbrev=0 --tags)" ]; then
      echo "The tag that was just pushed is the closest tag"
      pushToPSH="yes"
    fi
    
    printf "Should we push to psh? %s\n" "${pushToPSH}"
    echo "${pushToPSH}" >> push.txt
  cache:
    <<: *global_cache
    policy: push

we_should_push:
  stage: perform
  cache:
    <<: *global_cache
    policy: pull
  script: |
    if [ $(cat push.txt | grep yes) ]; then
      echo "we need to push to PSH"
      echo "setting up the platform.sh cli"
      curl -fsSL https://raw.githubusercontent.com/platformsh/cli/main/installer.sh | bash
      echo "setting the remote project to ${PROJID}"
      platform project:set-remote "${PROJID}"
      echo "set up a new ssh cert"
      platform ssh-cert:load --new --no-interaction
      pshWholeGitAddress=$(git remote get-url platform --push)
      pshGitAddress=$(TMP=${pshWholeGitAddress#*@};echo ${TMP%:*})
      echo "Adding psh git address ${pshGitAddress} to known hosts"
      ssh-keyscan -t rsa "${pshGitAddress}" >> ~/.ssh/known_hosts
      echo "Pushing tag ${CI_COMMIT_TAG} to Platform.sh..."
      pshDefaultBranch=$(platform project:info default_branch)
      git push platform "refs/tags/${CI_COMMIT_TAG}^{commit}:refs/heads/${pshDefaultBranch}"
    else
      echo "no changes to push. exiting"
    fi