chore: remove production environment from build job in publish.yml#294
chore: remove production environment from build job in publish.yml#294ammodev merged 1 commit intoversion/26.1from
Conversation
| @@ -17,7 +17,6 @@ env: | |||
| jobs: | |||
| build: | |||
There was a problem hiding this comment.
Removing environment: production also removes GitHub Environment protections for this publishing job (e.g., required reviewers/approvals, environment-scoped secrets, and protection rules). If those safeguards are still desired for releases on version/*, keep the environment on the job or replace it with an equivalent gating mechanism (separate protected job, manual approval, etc.).
| build: | |
| build: | |
| environment: production |
| @@ -17,7 +17,6 @@ env: | |||
| jobs: | |||
| build: | |||
| runs-on: ubuntu-latest | |||
There was a problem hiding this comment.
publish.yml doesn’t declare explicit permissions for the GITHUB_TOKEN. Other workflows in this repo do (e.g. .github/workflows/api-dump-version.yml:7-10). Since this workflow creates a GitHub Release, define minimal required permissions at the workflow or job level (at least contents: write) to avoid relying on repository defaults and to keep token scope least-privilege.
| runs-on: ubuntu-latest | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write |
No description provided.