From 3ebabbfe1ae6e53b904d51c2e5ee35ebefbfee40 Mon Sep 17 00:00:00 2001 From: Ian Jhumel Bautista Date: Wed, 17 Jun 2026 03:38:02 +0800 Subject: [PATCH] fix(ci): sign in the gated job so it can read the production env secret MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit RULES_SIGNING_KEY_ED25519 is a production-environment secret, but the Sign step ran in the un-gated build job — environment secrets are only readable by a job that declares the environment, so the build job saw an empty secret and the first publish would fail at sign ('secret not set'). Move environment: production onto the build job (which signs); promote runs after the gated, self-verified build, so the channel re-point stays behind the required-reviewer approval. (TR-323) --- .github/workflows/publish.yml | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index ba4cd06..31f1781 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -66,6 +66,12 @@ jobs: # No channel re-point happens here. build: runs-on: ubuntu-latest + # The signing key is a `production` ENVIRONMENT secret, and environment secrets + # are only readable by a job that declares the environment — so the job that + # SIGNS must be the gated one. Declaring it here makes the whole signed publish + # wait for the required-reviewer approval before anything is signed or released + # (the self-verify still hard-blocks promoting a bad statement). + environment: production outputs: digest: ${{ steps.bundle.outputs.digest }} steps: @@ -185,13 +191,13 @@ jobs: path: ${{ runner.temp }}/statement.json retention-days: 7 - # Re-point the channel release to the new statement. Gated behind the - # `production` environment so it requires manual approval — build/sign/verify - # happen above without auto-promoting. + # Re-point the channel release to the new statement. The approval gate is on the + # `build` job (which holds the signing secret); promote only runs after that + # gated, self-verified build succeeds, so the re-point is already behind the + # required-reviewer approval and needs no second gate here. promote: needs: build runs-on: ubuntu-latest - environment: production steps: - name: Download statement uses: actions/download-artifact@v4