From 02bde0716776a742164941e05cb026e750763b04 Mon Sep 17 00:00:00 2001 From: Tom Stellard Date: Fri, 31 Jul 2026 13:00:46 -0700 Subject: [PATCH] workflows/release-binaries: Move environment declaration to upload job (#212687) This is the only job that actually needs to use the environment secrets, so the environment must be declared. We were using secrets in the prepare job to do a permissions check, but this is unnecessary, because that job does not do anything that is security sensitive. Only the upload job needs to have these permission checks and these are already included in the upload-release-artifact composite action. --- .github/workflows/release-binaries.yml | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-) diff --git a/.github/workflows/release-binaries.yml b/.github/workflows/release-binaries.yml index d60f33f546bd..bb10ff748188 100644 --- a/.github/workflows/release-binaries.yml +++ b/.github/workflows/release-binaries.yml @@ -53,9 +53,6 @@ permissions: jobs: prepare: name: Prepare to build binaries - environment: - deployment: false - name: ${{ case( github.event_name == 'pull_request', null, 'release') }} runs-on: ${{ inputs.runs-on }} if: github.repository_owner == 'llvm' outputs: @@ -83,14 +80,6 @@ jobs: with: release-version: ${{ inputs.release-version }} - - name: Check Permissions - if: github.event_name != 'pull_request' - uses: ./.github/workflows/require-team-membership - with: - team-slug: llvm-release-managers - LLVM_TOKEN_GENERATOR_CLIENT_ID: ${{ secrets.LLVM_TOKEN_GENERATOR_CLIENT_ID }} - LLVM_TOKEN_GENERATOR_PRIVATE_KEY: ${{ secrets.LLVM_TOKEN_GENERATOR_PRIVATE_KEY }} - # The name of the Windows binaries uses the version from source, so we need # to fetch it here. - id: version-from-source @@ -368,6 +357,9 @@ jobs: upload-release-binaries: name: "Upload Release Binaries" + environment: + deployment: false + name: release needs: - prepare - build-release-package