ci: read the bot PAT from an environment in every workflow

.config/tend.yaml

@@ -2,7 +2,9 @@ bot_name: prql-bot
 secrets:
   # Docker Hub login is needed by test-rust.yaml on internal PRs (external-DB
   # tests); it's a low-value pull token, so it's intentionally repo-level.
-  # Release secrets (cargo/snapcraft) live in the `release` environment instead.
+  # Everything else sits behind an environment, split by the ref that releases
+  # it: `tend` for the jobs that run on `main`, `release` for the ones that run
+  # on a tag.
   allowed:
     - DOCKERHUB_TOKEN
     - DOCKERHUB_USERNAME

.github/workflows/pull-request-target.yaml

@@ -51,13 +51,20 @@ jobs:
     # Confirm that it's merged and has a label to ensure nothing is backported without oversight
     if: |
       github.event.pull_request.merged
+      && github.event.pull_request.base.ref == 'main'
       && (
         github.event.action == 'closed'
         || (
           github.event.action == 'labeled'
           && contains(github.event.label.name, 'pr-backport-web')
         )
       )
+    # `pull_request_target` runs at the base branch's ref, and `TEND_BOT_TOKEN`
+    # lives in the `tend` environment, which admits only `main`. Hence the
+    # `base.ref` condition above.
+    environment:
+      name: tend
+      deployment: false
     steps:
       - uses: tibdex/backport@v2
         with:

.github/workflows/release.yaml

@@ -23,6 +23,7 @@ jobs:
   brew-dispatcher:
     name: Release on homebrew-prql
     runs-on: ubuntu-24.04
+    environment: release
     if: github.event_name == 'release'
     steps:
       - uses: actions/github-script@v9
@@ -124,6 +125,7 @@ jobs:
 
   publish-winget:
     runs-on: ubuntu-24.04
+    environment: release
     needs: build-prqlc
     if: github.event_name == 'release'
     steps:
@@ -426,6 +428,7 @@ jobs:
 
   push-web-branch:
     runs-on: ubuntu-24.04
+    environment: release
     if: github.event_name == 'release'
     steps:
       - name: 📂 Checkout code

.github/workflows/tests.yaml

@@ -783,6 +783,12 @@ jobs:
     # default toolchain to run on. The minimum is defined by Cargo.toml's
     # metadata.msrv and is updated manually based on when build environments
     # such as debian & winget are updated.
+    #
+    # `TEND_BOT_TOKEN` lives in the `tend` environment, which admits only
+    # `main`; `nightly-upstream` is schedule-only, so the ref is always `main`.
+    environment:
+      name: tend
+      deployment: false
     steps:
       - name: 📂 Checkout code
         uses: actions/checkout@v7