Deploy jobs use GitHub environments

.github/workflows/deploy-android.yml

@@ -67,6 +67,9 @@ jobs:
     name: build + upload Android
     runs-on: ubuntu-24.04
     timeout-minutes: 90
+    # Mirrors TARGET below (the job's `env` is not readable here): a production-track build waits for
+    # reviewer approval and runs only from main or a v* tag.
+    environment: ${{ (github.event_name == 'workflow_dispatch' && inputs.profile || 'internal') == 'production' && 'production' || 'staging' }}
     env:
       TARGET: ${{ github.event_name == 'workflow_dispatch' && inputs.profile || 'internal' }}
     steps:

.github/workflows/deploy-mobile.yml

@@ -80,6 +80,9 @@ jobs:
     name: build + upload iOS
     runs-on: macos-26
     timeout-minutes: 120
+    # Mirrors PROFILE below (the job's `env` is not readable here): a production-profile build waits
+    # for reviewer approval and runs only from main or a v* tag.
+    environment: ${{ (github.event_name == 'workflow_dispatch' && inputs.profile || 'testflight') == 'production' && 'production' || 'staging' }}
     env:
       PROFILE: ${{ github.event_name == 'workflow_dispatch' && inputs.profile || 'testflight' }}
     steps:

.github/workflows/deploy-web.yml

@@ -57,8 +57,11 @@ jobs:
     # `github.ref_name == ...` ternary in four separate `env:` expressions, which is how a build once
     # shipped a test key to civfix.org and a live key to a public preview: four chances to get the same
     # decision wrong independently, and no check that they agreed. Decide once, here, then assert.
+    # The GitHub environment is that same decision (the YAML alias below), so a production deploy
+    # always waits for reviewer approval and can never run from a ref other than main or a v* tag.
+    environment: &deploy_env ${{ startsWith(github.ref, 'refs/tags/v') && 'production' || 'staging' }}
     env:
-      DEPLOY_ENV: ${{ startsWith(github.ref, 'refs/tags/v') && 'production' || 'staging' }}
+      DEPLOY_ENV: *deploy_env
     steps:
       - name: Refuse a deploy from any ref but main or a v* release tag
         run: |

.github/workflows/publish-shared.yml

@@ -36,6 +36,8 @@ concurrency:
 jobs:
   publish:
     if: github.ref == 'refs/heads/main'
+    # Publishing `latest` is a main-only act; the environment's ref policy enforces that at admission.
+    environment: staging
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4