From 84eb8d596c4a1cc788bb9509859a313c9bb4cfc1 Mon Sep 17 00:00:00 2001
From: byteful <info@byteful.me>
Date: Sun, 4 Oct 2026 22:05:46 -0400
Subject: [PATCH] deploy jobs use github environments

---
 .github/workflows/deploy-android.yml | 3 +++
 .github/workflows/deploy-mobile.yml  | 3 +++
 .github/workflows/deploy-web.yml     | 5 ++++-
 .github/workflows/publish-shared.yml | 2 ++
 4 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/deploy-android.yml b/.github/workflows/deploy-android.yml
index bbf1ac3e..a4a49db6 100644
--- a/.github/workflows/deploy-android.yml
+++ b/.github/workflows/deploy-android.yml
@@ -67,6 +67,9 @@ jobs:
     name: build + upload Android
     runs-on: ubuntu-24.04
     timeout-minutes: 90
+    # Mirrors TARGET below (the job's `env` is not readable here): a production-track build waits for
+    # reviewer approval and runs only from main or a v* tag.
+    environment: ${{ (github.event_name == 'workflow_dispatch' && inputs.profile || 'internal') == 'production' && 'production' || 'staging' }}
     env:
       TARGET: ${{ github.event_name == 'workflow_dispatch' && inputs.profile || 'internal' }}
     steps:
diff --git a/.github/workflows/deploy-mobile.yml b/.github/workflows/deploy-mobile.yml
index 2dbeb67d..430f92cf 100644
--- a/.github/workflows/deploy-mobile.yml
+++ b/.github/workflows/deploy-mobile.yml
@@ -80,6 +80,9 @@ jobs:
     name: build + upload iOS
     runs-on: macos-26
     timeout-minutes: 120
+    # Mirrors PROFILE below (the job's `env` is not readable here): a production-profile build waits
+    # for reviewer approval and runs only from main or a v* tag.
+    environment: ${{ (github.event_name == 'workflow_dispatch' && inputs.profile || 'testflight') == 'production' && 'production' || 'staging' }}
     env:
       PROFILE: ${{ github.event_name == 'workflow_dispatch' && inputs.profile || 'testflight' }}
     steps:
diff --git a/.github/workflows/deploy-web.yml b/.github/workflows/deploy-web.yml
index 6db8bbe7..f5558ada 100644
--- a/.github/workflows/deploy-web.yml
+++ b/.github/workflows/deploy-web.yml
@@ -57,8 +57,11 @@ jobs:
     # `github.ref_name == ...` ternary in four separate `env:` expressions, which is how a build once
     # shipped a test key to civfix.org and a live key to a public preview: four chances to get the same
     # decision wrong independently, and no check that they agreed. Decide once, here, then assert.
+    # The GitHub environment is that same decision (the YAML alias below), so a production deploy
+    # always waits for reviewer approval and can never run from a ref other than main or a v* tag.
+    environment: &deploy_env ${{ startsWith(github.ref, 'refs/tags/v') && 'production' || 'staging' }}
     env:
-      DEPLOY_ENV: ${{ startsWith(github.ref, 'refs/tags/v') && 'production' || 'staging' }}
+      DEPLOY_ENV: *deploy_env
     steps:
       - name: Refuse a deploy from any ref but main or a v* release tag
         run: |
diff --git a/.github/workflows/publish-shared.yml b/.github/workflows/publish-shared.yml
index fe0d2c91..2fa8f4b4 100644
--- a/.github/workflows/publish-shared.yml
+++ b/.github/workflows/publish-shared.yml
@@ -36,6 +36,8 @@ concurrency:
 jobs:
   publish:
     if: github.ref == 'refs/heads/main'
+    # Publishing `latest` is a main-only act; the environment's ref policy enforces that at admission.
+    environment: staging
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4