From 3b12f2678f2f4f724f73951589ee3e18a16ced34 Mon Sep 17 00:00:00 2001 From: Anso Date: Fri, 10 Apr 2026 13:51:05 -0400 Subject: [PATCH] ci: gate docker-publish on `production` environment (#483) Pin the push_to_registry job to a GitHub `production` environment so the DOCKERHUB_USERNAME and DOCKERHUB_TOKEN credentials can live there instead of as repo-wide secrets. Any future workflow that tries to push to Docker Hub without declaring this environment will fail to resolve the credentials, which is exactly the blast-radius reduction we want. As a side benefit, adding a required reviewer to the `production` environment in repo settings now turns every release into a manual approval gate with zero workflow changes. The secrets were already moved into the environment ahead of this commit, so the next release run will pick them up seamlessly. --- .github/workflows/docker-publish.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index ac1d669d..0cf80c42 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -15,6 +15,13 @@ jobs: name: Push Docker image to Docker Hub runs-on: ubuntu-latest timeout-minutes: 30 + # DOCKERHUB_USERNAME and DOCKERHUB_TOKEN live in the `production` environment, + # not repo-wide secrets. Any future workflow that tries to push to Docker Hub + # without declaring this environment will fail to resolve the credentials, + # which is exactly the blast-radius reduction we want. Adding a required + # reviewer to the environment in repo settings also turns every release into + # a manual-approval gate without any workflow change. + environment: production permissions: contents: read # Required for cosign keyless signing via GitHub OIDC.