ci: declare release job as deploying to nuget-org environment#280
Merged
Conversation
Adds `environment: nuget-org` to the release job in .github/workflows/release.yml. Effects: - secrets.NUGET_API_KEY now resolves from the env-scoped secret on the `nuget-org` GitHub Environment (created in #272), rather than the repo-scoped one. This is the scoping half of #273 — Chris adds the env secret value via the UI before this PR merges. - The env's required-reviewer rule (Chris) fires before the job runs. This matches the Tier 1 / production gating documented in the channel taxonomy (see RFC #267 comment). - A deployment record is created visible under the Deployments tab. When #274 lands the tag-trigger + multi-channel split, the `environment:` declaration will move from the job level down to a dedicated publish-nuget-org step. Test+Pack become unguarded. This transitional shape applies it to the whole job because there's only one job; that's a minor overhead (manual workflow_dispatch is already gated by intent) and avoids preempting #274's larger restructure. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Prep PR for #273. Adds
environment: nuget-orgto the release job sosecrets.NUGET_API_KEYresolves from the env-scoped secret rather than the repo-scoped one.Runbook for landing this safely
nuget-org→ Add environment secretNUGET_API_KEYFallout.*(either the existing one from your password manager OR generate a fresh key as a rotation hygiene step)NUGET_API_KEYsecret is still there as a fallback but unused.release→ Run workflow onmain→ approve the env gate when prompted → workflow succeeds + publishes (or just packs, depending on whether you want a real release at the verification moment).NUGET_API_KEYsecret via UI (Settings → Secrets and variables → Actions). After step 4 confirms the env-scoped one works.What changes in this PR
jobs.releasegainsenvironment:declaration withname: nuget-organd the user-facingurl: https://www.nuget.org/profiles/Fallout.What this PR explicitly does NOT do
Test → Pack → Publishrun, which is fine for the manualworkflow_dispatchshape (you approve once knowing you want to release).github-packagesorgithub-releasesenvironments — they're unguarded and the workflow doesn't currently target them; they come into play in Refactor release.yml: tag-triggered, multi-channel via environments #274.🤖 Generated with Claude Code