You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@maka.apache.org by as...@apache.org on 2026/08/20 06:02:53 UTC
(maka) branch ci/release-env-branch-policy created (now 375d4fe97)
This is an automated email from the ASF dual-hosted git repository.
Astro-Han pushed a change to branch ci/release-env-branch-policy
in repository https://gitbox.apache.org/repos/asf/maka.git
at 375d4fe97 ci: bind the release deployment environment to main
This branch includes the following new commits:
new 375d4fe97 ci: bind the release deployment environment to main
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For additional commands, e-mail: commits-help@maka.apache.org
(maka) 01/01: ci: bind the release deployment environment to main
Posted by as...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
Astro-Han pushed a commit to branch ci/release-env-branch-policy
in repository https://gitbox.apache.org/repos/asf/maka.git
commit 375d4fe97be0c06cdf715db76b9de3446f0c30d8
Author: AstroHan <le...@outlook.com>
AuthorDate: Thu Aug 20 14:02:19 2026 +0800
ci: bind the release deployment environment to main
The release environment holds the Apple notarization and code signing
credentials that .github/workflows/release-desktop.yml consumes, but it
carries no protection rules at all. Its only current guard is the job-level
branch condition inside release-desktop.yml, which lives in the same file it
is meant to protect and so cannot bind the environment on its own.
Declare a deployment branch policy that restricts the environment to main.
GitHub enforces it outside the workflow, before any job that requests the
environment starts. The npm-release environment already carries an
equivalent branch policy, so this brings the desktop release channel to the
same boundary rather than inventing a new one.
The directive only visits environments named here, so npm-release and
copilot keep their current configuration. npm-release is deliberately left
undeclared: the underlying call replaces an environment's settings
wholesale, and declaring it without restating its reviewers and branch
policy would clear them.
Generated-by: Claude Code
---
.asf.yaml | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/.asf.yaml b/.asf.yaml
index 820a5b126..a90dbf549 100644
--- a/.asf.yaml
+++ b/.asf.yaml
@@ -63,6 +63,18 @@ github:
contexts:
- test
+ environments:
+ # release holds the Apple notarization and code signing credentials used by
+ # .github/workflows/release-desktop.yml. That workflow's own branch guard
+ # sits inside the file it is meant to protect, so this policy is the only
+ # boundary GitHub enforces from outside the workflow. npm-release already
+ # restricts deployments to main the same way.
+ release:
+ deployment_branch_policy:
+ policies:
+ - name: main
+ type: branch
+
notifications:
commits: commits@maka.apache.org
discussions: dev@maka.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For additional commands, e-mail: commits-help@maka.apache.org