From f07009d9750e626b3a459c6c9d9643227d3f05d3 Mon Sep 17 00:00:00 2001 From: Maximilian Roos Date: Sat, 8 Aug 2026 14:33:11 -0700 Subject: [PATCH] ci: read the bot PAT from an environment in every workflow The generated tend-*.yaml jobs already name the `tend` environment; the hand-written consumers still read `TEND_BOT_TOKEN` at repo level, where every workflow the repo runs can reach it. Gate the remaining five: `tests.yaml:update-rust-toolchain` and `pull-request-target.yaml:backport` run on `main`, so they take `tend`; the three release-time jobs run on a tag, so they take `release`. Restrict the backport job to a `main` base while doing so, since `pull_request_target` runs at the base branch's ref and the `tend` environment admits only `main`. Co-Authored-By: Claude Opus 5 (1M context) --- .config/tend.yaml | 4 +++- .github/workflows/pull-request-target.yaml | 7 +++++++ .github/workflows/release.yaml | 3 +++ .github/workflows/tests.yaml | 6 ++++++ 4 files changed, 19 insertions(+), 1 deletion(-) diff --git a/.config/tend.yaml b/.config/tend.yaml index 114e6c201605..69751644747d 100644 --- a/.config/tend.yaml +++ b/.config/tend.yaml @@ -2,7 +2,9 @@ bot_name: prql-bot secrets: # Docker Hub login is needed by test-rust.yaml on internal PRs (external-DB # tests); it's a low-value pull token, so it's intentionally repo-level. - # Release secrets (cargo/snapcraft) live in the `release` environment instead. + # Everything else sits behind an environment, split by the ref that releases + # it: `tend` for the jobs that run on `main`, `release` for the ones that run + # on a tag. allowed: - DOCKERHUB_TOKEN - DOCKERHUB_USERNAME diff --git a/.github/workflows/pull-request-target.yaml b/.github/workflows/pull-request-target.yaml index e20064f5701b..c0e949514c93 100644 --- a/.github/workflows/pull-request-target.yaml +++ b/.github/workflows/pull-request-target.yaml @@ -51,6 +51,7 @@ jobs: # Confirm that it's merged and has a label to ensure nothing is backported without oversight if: | github.event.pull_request.merged + && github.event.pull_request.base.ref == 'main' && ( github.event.action == 'closed' || ( @@ -58,6 +59,12 @@ jobs: && contains(github.event.label.name, 'pr-backport-web') ) ) + # `pull_request_target` runs at the base branch's ref, and `TEND_BOT_TOKEN` + # lives in the `tend` environment, which admits only `main`. Hence the + # `base.ref` condition above. + environment: + name: tend + deployment: false steps: - uses: tibdex/backport@v2 with: diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 3235ee007581..daed59ec26bb 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -23,6 +23,7 @@ jobs: brew-dispatcher: name: Release on homebrew-prql runs-on: ubuntu-24.04 + environment: release if: github.event_name == 'release' steps: - uses: actions/github-script@v9 @@ -124,6 +125,7 @@ jobs: publish-winget: runs-on: ubuntu-24.04 + environment: release needs: build-prqlc if: github.event_name == 'release' steps: @@ -426,6 +428,7 @@ jobs: push-web-branch: runs-on: ubuntu-24.04 + environment: release if: github.event_name == 'release' steps: - name: 📂 Checkout code diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml index 9afee0405504..5c4901b87adc 100644 --- a/.github/workflows/tests.yaml +++ b/.github/workflows/tests.yaml @@ -783,6 +783,12 @@ jobs: # default toolchain to run on. The minimum is defined by Cargo.toml's # metadata.msrv and is updated manually based on when build environments # such as debian & winget are updated. + # + # `TEND_BOT_TOKEN` lives in the `tend` environment, which admits only + # `main`; `nightly-upstream` is schedule-only, so the ref is always `main`. + environment: + name: tend + deployment: false steps: - name: 📂 Checkout code uses: actions/checkout@v7