From 0d451ac584623e2898bbea43250a5cab916c90b9 Mon Sep 17 00:00:00 2001 From: kingchenc Date: Fri, 22 May 2026 12:32:47 +0200 Subject: [PATCH] D2: gate the publish jobs behind a protected environment release.yml triggers on every v* tag push and the four publish jobs (crates.io, PyPI, npm, wasm) inject long-lived registry tokens straight from secrets with no environment, no reviewer and no tag restriction. Bind all four jobs to a `release` GitHub environment. With the environment's protection rules (required reviewers, tag/branch restrictions) configured under repo Settings -> Environments, the registry secrets become reachable only from an approved release run rather than from any workflow execution. --- .github/workflows/release.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f9deb48e..626f33fd 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -15,6 +15,13 @@ jobs: cargo-publish: name: Publish to crates.io runs-on: ubuntu-latest + # The publish jobs run with long-lived registry tokens. Binding them to a + # protected GitHub environment lets the org require a reviewer to approve + # each release and restrict which tags/branches may deploy, so the secrets + # are not reachable from an arbitrary workflow run. The `release` + # environment and its protection rules are configured under repo + # Settings -> Environments. + environment: release steps: - uses: actions/checkout@v4 - uses: dtolnay/rust-toolchain@stable @@ -122,6 +129,7 @@ jobs: name: Publish to PyPI needs: [python-wheels, python-sdist] runs-on: ubuntu-latest + environment: release steps: - uses: actions/download-artifact@v4 with: @@ -185,6 +193,7 @@ jobs: name: Publish to npm needs: node-build runs-on: ubuntu-latest + environment: release steps: - uses: actions/checkout@v4 @@ -309,6 +318,7 @@ jobs: wasm-publish: name: Publish wickra-wasm to npm runs-on: ubuntu-latest + environment: release steps: - uses: actions/checkout@v4