github action is running on feature branches and it should only run on main branch or release branch

I have the following github action and it runs the action even if I create a feature branch with a name other than main, master, or release

What am I doing wrong?

#see https://raw.githubusercontent.com/zellwk/zellwk.com/master/.github/workflows/deploy.yml
name: deploy
on:
push:
branches:
- main
- master
- release
jobs:
build-and-deploy:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2
- uses: actions/setup-node@v1
- name: Install SSH Key
uses: shimataro/ssh-key-action@v2
with:
key: ${{ secrets.SSH_PRIVATE_KEY }}
known_hosts: unnecessary
- name: Adding Known Hosts
run: ssh-keyscan -p ${{ secrets.SSH_PORT}} -H ${{ secrets.SSH_HOST }}  >> ~/.ssh/known_hosts
- name: Set env file and jwk.json for release
if: ${{ contains(github.ref_name, 'release') || github.ref == 'refs/heads/release' }}
run: |
echo "${{secrets.PRODUCTION_ENV }}" > .env.prod
ln -sf .env.prod .env
echo "${{secrets.PRODUCTION_JWK}}" | base64 --decode > jwk.json
- name: Set env file and jwk.json for development
if: ${{ !contains(github.ref_name, 'release') || github.ref != 'refs/heads/release' }}
run: |
echo "${{secrets.DEVELOPMENT_ENV }}" > .env.dev
ln -sf .env.dev .env
echo "${{secrets.DEVELOPMENT_JWK}}" | base64 --decode > jwk.json
- name: Deploy with rsync for release
if: ${{ contains(github.ref_name, 'release') || github.ref == 'refs/heads/release' }}
# from ./bin/deploy.sh
run: rsync -azvP -e "ssh -p ${{ secrets.SSH_PORT }}" --delete --exclude=node_modules --exclude=redis-data --exclude=.idea --exclude=.git --exclude=mongo_data --exclude=data01 --exclude=uploads --exclude=emails.txt --exclude=main --exclude=deno --exclude=app --exclude=database.sqlite --exclude=database.sqlite-journal --exclude=data ./ ${{secrets.SSH_USER}}@${{secrets.SSH_HOST}}:www/${{secrets.HOST_PATH_PROD}}/${{secrets.HOST_PROJECT}}
#        run: rsync -avz -e "ssh -p ${{ secrets.SSH_PORT }}" ./dist/ ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }}:/var/www/zellwk.com/
- name: Deploy with rsync for development
if: ${{ !contains(github.ref_name, 'release') && github.ref != 'refs/heads/release' }}
# from ./bin/deploy.sh
run: rsync -azvP -e "ssh -p ${{ secrets.SSH_PORT }}" --delete --exclude=node_modules --exclude=redis-data --exclude=.idea --exclude=.git --exclude=mongo_data --exclude=data01 --exclude=uploads --exclude=emails.txt --exclude=main --exclude=deno --exclude=app --exclude=database.sqlite --exclude=database.sqlite-journal --exclude=data ./ ${{secrets.SSH_USER}}@${{secrets.SSH_HOST}}:www/${{secrets.HOST_PATH_DEV}}/${{secrets.HOST_PROJECT}}
- name: Post-Deploy script for release
if: ${{ contains(github.ref_name, 'release') || github.ref == 'refs/heads/release' }}
# from ./bin/deploy.sh
run: ssh -t ${{secrets.SSH_USER}}@${{secrets.SSH_HOST}} -p ${{secrets.SSH_PORT}} \$HOME/www/${{secrets.HOST_PATH_PROD}}/${{secrets.HOST_PROJECT}}/bin/post-deploy.sh
- name: Post-Deploy script for development
if: ${{ !contains(github.ref_name, 'release') && github.ref != 'refs/heads/release' }}
# from ./bin/deploy.sh
run: ssh -t ${{secrets.SSH_USER}}@${{secrets.SSH_HOST}} -p ${{secrets.SSH_PORT}} \$HOME/www/${{secrets.HOST_PATH_DEV}}/${{secrets.HOST_PROJECT}}/bin/post-deploy.sh
# - name: Restart App Server
#   uses: appleboy/ssh-action@master
#   with:
#     host: ${{ secrets.SSH_HOST }}
#     username: ${{ secrets.SSH_USER }}
#     key: ${{ secrets.SSH_PRIVATE_KEY }}
#     port: ${{ secrets.SSH_PORT }}
#     debug: true
#     # from ./bin/post-deploy.sh
#     #            if [ ${{ contains(github.ref_name, 'release') || github.ref == 'refs/heads/release' }} ]; then
#     #           else
#     #             cd $HOME/www/${{secrets.HOST_PATH_DEV}}/${{secrets.HOST_PROJECT}}
#     #             deno upgrade
#     #             sudo /etc/init.d/nginx reload
#     #             sudo systemctl daemon-reload
#     #             sudo systemctl restart ${{secrets.META_SERVICE_DEV}}
#     #           fi
#     script: |
#       cd $HOME/www/${{secrets.HOST_PATH_DEV}}/${{secrets.HOST_PROJECT}}
#       deno upgrade
#       sudo /etc/init.d/nginx reload
#       sudo systemctl daemon-reload
#       sudo systemctl restart ${{secrets.META_SERVICE_DEV}}

it shouldn't run the action on push to a different branch ie: feature1

There are 2 things going on. Even though you've updated the YAML file in the main/master branch, it's likely that existing branches have a copy of the YAML file without the filter. You can fix that by cherry-picking the new YAML file into the existing branches.

The other thing you can do is define an Environment and add an environment: xxxxx to the YAML file and a branch filter on the environment. That will prevent people from running the deploy job against the environment.

In your repository settings, navigate to environments add an environment (any name will do) and then set the Deployment branches to Selected branches and then add the list of branches you want to allow to the list using the ➕ Add Deployment Branch.

By putting all the production secrets in the list of Environment Secrets instead of the Repository Secrets you also prevent others from accessing these from any workflow that doesn't specifically target this environment.