From 3eade55fad2136f4eaa44edd783fd0de9e9a814e Mon Sep 17 00:00:00 2001 From: Louis Varin Date: Fri, 7 Aug 2026 18:40:16 +0000 Subject: [PATCH] fix(root): gate beta/alpha publish workflow behind an environment Restrict the publish workflow's job with a GitHub environment named beta-alpha-release, instead of running unconstrained on ubuntu-latest. The corresponding environment (added in the infra repo) will use a deployment branch policy limited to protected branches, so the job can only run when dispatched from master. Previously @bitgo-beta (and @bitgo-alpha) packages could be published from any PR branch via workflow_dispatch, even though @bitgo-beta packages are consumed by production systems. Restricting both scopes to the same protected-branch environment closes that gap and also requires approval for alpha releases triggered from PR runs. Ticket: INF-2526 Session-Id: 2fc496b6-5f20-43a9-94f6-2f4e6f8f8d2b Task-Id: b2188fee-9bd7-41b8-b5db-78b108797dc0 --- .github/workflows/publish.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index eeb356ed8f..9426b3ce3b 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -31,6 +31,10 @@ jobs: publish: name: Publish Release runs-on: ubuntu-latest + # Restricts @bitgo-beta/@bitgo-alpha publishing to protected branches via + # a deployment branch policy on this environment, so the job cannot run + # from arbitrary PR branches even though it is manually dispatched. + environment: beta-alpha-release steps: - uses: socketdev/action@4337a545deecc20f19a909e52db7a2f6ba292f42 # v1