If we don't gate this via inputs.environment == 'production' we could also test that the signing works before we do a production release. Or do you feel confident enough in this to do it live?

For example:

If we don't gate this via inputs.environment == 'production' we could also test that the signing works before we do a production release. Or do you feel confident enough in this to do it live?

For example:

cli/.github/workflows/deployment.yml

Line 330 in 1bc3cfa

DO_PUBLISH: ${{ inputs.environment == 'production' }}

I feel confident enough to do it live but we can generate provenance for a non-production release if you'd like. Note that all attestations will be available for view on https://github.com/cli/cli/attestations. So if we do decide to generate non-production attestations, they will appear on that page alongside the production attestations.