From 6c15fbb8814e1d750728fc0b3d6768d0f545d8cc Mon Sep 17 00:00:00 2001 From: Joseph Mearman Date: Mon, 12 Oct 2026 08:03:24 +0100 Subject: [PATCH] ci: read the release deploy key from a main-only environment --- .github/workflows/ci.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 86f8b75..50c922e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -274,6 +274,8 @@ jobs: # Deliberately a GitHub-hosted runner, not the resolved one: npm trusted publishing only works from GitHub-hosted runners, so the OIDC token exchange cannot happen on the self-hosted fleet or Blacksmith. runs-on: ubuntu-latest timeout-minutes: 15 + # The deploy key lives in this environment, whose deployment branches are limited to main, so no other branch's workflow can read it. + environment: release permissions: contents: write # to push the release commit and tag and create the GitHub Release issues: write # to comment on released issues