From b6912957441897381582b116e709a1e7929d12ee Mon Sep 17 00:00:00 2001 From: "Joseph T. French" Date: Thu, 27 Aug 2026 11:39:34 -0500 Subject: [PATCH] chore(ci): gate PyPI publishing behind the production environment The publish job now binds the production GitHub environment, so its protection rules (required reviewer, deployment refs) pause every publish for approval. A release-branch push no longer publishes with no human in the loop. --- .github/workflows/publish.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 3e78dcf..1cd3848 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -9,6 +9,9 @@ on: jobs: publish: runs-on: ubuntu-latest + # The production environment's protection rules (required reviewer, + # deployment branches) gate every publish here. + environment: production permissions: contents: read