From 13af29ddcb593e44fa03bd8f483541a787a9ae38 Mon Sep 17 00:00:00 2001 From: Jac Fitzgerald Date: Thu, 23 Jul 2026 13:51:21 -0700 Subject: [PATCH] security: add environment gate to production PyPI publish job Adds `environment: pypi` to the publish-pypi job, wiring it to the GitHub Environment configured with required reviewers. Without this, any repo write holder could push a tag or invoke workflow_dispatch and publish to production PyPI with no human checkpoint. Co-Authored-By: Claude Sonnet 4.6 --- .github/workflows/publish-pypi.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml index 8c0289ba2..8bc11466d 100644 --- a/.github/workflows/publish-pypi.yml +++ b/.github/workflows/publish-pypi.yml @@ -75,6 +75,7 @@ jobs: needs: smoke-test-pypi if: ${{ github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/v') }} runs-on: ubuntu-latest + environment: pypi steps: - uses: actions/download-artifact@v8 with: