Anso 3b12f2678f ci: gate docker-publish on production environment (#483) ...

Pin the push_to_registry job to a GitHub `production` environment so the
DOCKERHUB_USERNAME and DOCKERHUB_TOKEN credentials can live there
instead of as repo-wide secrets. Any future workflow that tries to push
to Docker Hub without declaring this environment will fail to resolve
the credentials, which is exactly the blast-radius reduction we want.

As a side benefit, adding a required reviewer to the `production`
environment in repo settings now turns every release into a manual
approval gate with zero workflow changes. The secrets were already
moved into the environment ahead of this commit, so the next release
run will pick them up seamlessly.

2026-04-10 13:51:05 -04:00

..

ci.yml

ci: capture backend and frontend logs for E2E failures (#481)

2026-04-10 13:47:07 -04:00

docker-publish.yml

ci: gate docker-publish on production environment (#483)

2026-04-10 13:51:05 -04:00

release-please.yml

ci: harden supply chain (SHA pin actions, least-privilege permissions) (#475)

2026-04-10 13:41:49 -04:00