From 4b3328e129699cb748d9043b2da1b3d6766ea638 Mon Sep 17 00:00:00 2001 From: Chrison Simtian Date: Fri, 29 May 2026 16:08:13 +1200 Subject: [PATCH] ci: declare release job as deploying to nuget-org environment (#273) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds `environment: nuget-org` to the release job in .github/workflows/release.yml. Effects: - secrets.NUGET_API_KEY now resolves from the env-scoped secret on the `nuget-org` GitHub Environment (created in #272), rather than the repo-scoped one. This is the scoping half of #273 — Chris adds the env secret value via the UI before this PR merges. - The env's required-reviewer rule (Chris) fires before the job runs. This matches the Tier 1 / production gating documented in the channel taxonomy (see RFC #267 comment). - A deployment record is created visible under the Deployments tab. When #274 lands the tag-trigger + multi-channel split, the `environment:` declaration will move from the job level down to a dedicated publish-nuget-org step. Test+Pack become unguarded. This transitional shape applies it to the whole job because there's only one job; that's a minor overhead (manual workflow_dispatch is already gated by intent) and avoids preempting #274's larger restructure. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/release.yml | 23 ++++++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 78c49f939..d80651116 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -30,6 +30,21 @@ jobs: release: name: release runs-on: ubuntu-latest + # Declares the job as deploying to the `nuget-org` GitHub Environment. + # Effects: + # - `secrets.NUGET_API_KEY` resolves from the env-scoped secret rather + # than the repo-scoped one (per #273 — repo secret deleted after this + # migration verifies clean). + # - The environment's required-reviewer rule fires before the job runs. + # Currently @ChrisonSimtian is the sole reviewer (#272). + # - A deployment record is created on the GitHub Environment, visible + # under Deployments tab. + # When #274 lands the tag-trigger + multi-channel split, this `environment:` + # declaration moves down to a dedicated publish-nuget-org step; Test+Pack + # become unguarded. + environment: + name: nuget-org + url: https://www.nuget.org/profiles/Fallout steps: - uses: actions/checkout@v6 with: @@ -51,9 +66,11 @@ jobs: - name: 'Run: Test, Pack, Publish' run: dotnet fallout Test Pack Publish env: - # Publish target is nuget.org now that Fallout.* rename has landed (#54). - # NUGET_API_KEY is an API key scoped to push Fallout.* packages, set in - # repo Settings → Secrets and variables → Actions. + # Publish target is nuget.org. NUGET_API_KEY is an API key scoped to + # push Fallout.* packages. After #273 lands the secret lives on the + # `nuget-org` GitHub Environment (declared above) — the env scoping + # is what gates the approval step. Before #273, the same secret name + # resolved from the repo-level scope. NuGetApiKey: ${{ secrets.NUGET_API_KEY }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}