gsadmin/sencho
1
0
Fork 0
mirror of https://github.com/Studio-Saelix/sencho.git synced 2026-08-08 18:05:10 +00:00
Code Issues Packages Projects Releases Wiki Activity

ci: gate docker-publish on production environment (#483)

Browse Source 
Pin the push_to_registry job to a GitHub `production` environment so the
DOCKERHUB_USERNAME and DOCKERHUB_TOKEN credentials can live there
instead of as repo-wide secrets. Any future workflow that tries to push
to Docker Hub without declaring this environment will fail to resolve
the credentials, which is exactly the blast-radius reduction we want.

As a side benefit, adding a required reviewer to the `production`
environment in repo settings now turns every release into a manual
approval gate with zero workflow changes. The secrets were already
moved into the environment ahead of this commit, so the next release
run will pick them up seamlessly.
This commit is contained in:
Anso
2026-04-10 13:51:05 -04:00
committed by GitHub
parent e5e58ed932
commit 3b12f2678f
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/docker-publish.yml
+7
View File
@@ -15,6 +15,13 @@ jobs:
name: Push Docker image to Docker Hub
runs-on: ubuntu-latest
timeout-minutes: 30
# DOCKERHUB_USERNAME and DOCKERHUB_TOKEN live in the `production` environment,
# not repo-wide secrets. Any future workflow that tries to push to Docker Hub
# without declaring this environment will fail to resolve the credentials,
# which is exactly the blast-radius reduction we want. Adding a required
# reviewer to the environment in repo settings also turns every release into
# a manual-approval gate without any workflow change.
environment: production
permissions:
contents: read
# Required for cosign keyless signing via GitHub OIDC.