From 51572ff281e5f8615a9b56c995babb30856db512 Mon Sep 17 00:00:00 2001 From: AstroHan Date: Thu, 20 Aug 2026 14:02:19 +0800 Subject: [PATCH] ci: bind the release deployment environment to main The release environment holds the Apple notarization and code signing credentials that .github/workflows/release-desktop.yml consumes, but it carries no protection rules at all. Its only current guard is the job-level branch condition inside release-desktop.yml, which lives in the same file it is meant to protect and so cannot bind the environment on its own. Declare a deployment branch policy that restricts the environment to main. GitHub enforces it outside the workflow, before any job that requests the environment starts. npm-release already carries the same kind of policy, so this reuses an established pattern rather than inventing one. The directive only visits environments named here, so npm-release and copilot keep their current configuration. npm-release is deliberately left undeclared: the underlying call replaces an environment's settings wholesale, and declaring it without restating its reviewer and branch policy would clear them. Generated-by: Claude Code --- .asf.yaml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/.asf.yaml b/.asf.yaml index 820a5b1267..1d201e36be 100644 --- a/.asf.yaml +++ b/.asf.yaml @@ -63,6 +63,21 @@ github: contexts: - test + environments: + # release holds the Apple notarization and code signing credentials used by + # .github/workflows/release-desktop.yml. That workflow's own branch guard + # sits inside the file it is meant to protect, so this policy is the only + # boundary GitHub enforces from outside the workflow. + # + # Naming an environment here replaces its settings wholesale, so restate + # its full configuration when adding one. npm-release carries a required + # reviewer and a branch policy that live only on GitHub. + release: + deployment_branch_policy: + policies: + - name: main + type: branch + notifications: commits: commits@maka.apache.org discussions: dev@maka.apache.org