ci(release): gate release-trigger on the release environment#3003
Merged
Conversation
Add environment: release to the dispatch job that calls the reusable release-dispatch.yml workflow. GitHub's deployment protection runs before any of the reusable workflow's jobs start, so the prepare step (which creates tags) requires manual approval. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
environment: release cannot be used on a job that calls a reusable workflow (uses:). Instead, add an explicit approve job that holds the environment gate; the dispatch job depends on it, so the reusable workflow's prepare step (which creates tags) cannot run until a reviewer approves the deployment. Remove the previously-added environment: release from the dispatch job (invalid) and the inner environment: release from release-dispatch.yml (redundant — a single gate is sufficient). Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
iliakur
approved these changes
May 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
environment: releaseto thedispatchjob inrelease-trigger.ymlso GitHub's deployment protection runs before the reusablerelease-dispatch.ymlworkflow starts — thepreparestep (which creates tags) now requires manual approvalenvironment: releasefromrelease-dispatch.yml'sdispatchjob; a single gate at the trigger level is sufficientProblem
The
preparejob inrelease-dispatch.ymlcreates git tags before reaching theenvironment: releasegate on the innerdispatchjob, so tags could be created without a manual approval step.Test plan