From 11d4873d8f1203ed393c723df78f6612606e5cc3 Mon Sep 17 00:00:00 2001
From: "Nivedit (Hermes)" <hermes@exosphere.host>
Date: Mon, 13 Jul 2026 08:38:44 +0530
Subject: [PATCH] ci: add environment: production to publish and build-image
 jobs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds  to:
- publish.yml (publish → npm registry)
- build-image.yml (build → GHCR push)

This enables approval gates via GitHub Environments on all artifact
releases including npm publishing and GHCR image pushes.
---
 .github/workflows/build-image.yml | 1 +
 .github/workflows/publish.yml     | 1 +
 2 files changed, 2 insertions(+)

diff --git a/.github/workflows/build-image.yml b/.github/workflows/build-image.yml
index 29c468e0..cf8a2e7f 100644
--- a/.github/workflows/build-image.yml
+++ b/.github/workflows/build-image.yml
@@ -37,6 +37,7 @@ permissions:
 jobs:
   build:
     runs-on: ubuntu-latest
+    environment: production
     steps:
       - name: Checkout
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 2fd02536..034c09e3 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -8,6 +8,7 @@ on:
 jobs:
   publish:
     runs-on: ubuntu-latest
+    environment: production
     permissions:
       contents: write
       id-token: write