From 37db3691c6e0ce79e0b8a626cf620d1be9b34aa5 Mon Sep 17 00:00:00 2001
From: PrimeBuild-pc <primebuild.official@gmail.com>
Date: Thu, 22 Oct 2026 01:46:56 +0200
Subject: [PATCH] ci: use the protected release environment and add a read-only
 secrets check

The release, winget and chocolatey jobs run in the 'release' environment, so
they wait for the maintainer's approval and read the environment secrets.
'Check release secrets' is a manual, publish-nothing workflow: inside the
environment it confirms the three secrets exist and that the winget token is
valid and owned by WINGET_FORK_OWNER; a second job outside the environment
shows whether the repository-level copies still exist.
---
 .github/workflows/check-release-secrets.yml | 62 +++++++++++++++++++++
 .github/workflows/publish-chocolatey.yml    |  1 +
 .github/workflows/release.yml               |  3 +
 3 files changed, 66 insertions(+)
 create mode 100644 .github/workflows/check-release-secrets.yml

diff --git a/.github/workflows/check-release-secrets.yml b/.github/workflows/check-release-secrets.yml
new file mode 100644
index 0000000..32ce5a6
--- /dev/null
+++ b/.github/workflows/check-release-secrets.yml
@@ -0,0 +1,62 @@
+name: Check release secrets
+
+# Manual, read-only check of the publishing secrets. It publishes nothing and never prints a secret value.
+on:
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  environment-secrets:
+    name: Secrets seen by the release environment
+    runs-on: ubuntu-latest
+    # Same protected environment as the publishing jobs: needs the maintainer's approval to run.
+    environment: release
+    steps:
+      - name: Check the secrets are present and the winget token works
+        shell: bash
+        env:
+          CHOCOLATEY_API_KEY: ${{ secrets.CHOCOLATEY_API_KEY }}
+          WINGET_GITHUB_TOKEN: ${{ secrets.WINGET_GITHUB_TOKEN }}
+          WINGET_FORK_OWNER: ${{ secrets.WINGET_FORK_OWNER }}
+        run: |
+          missing=0
+          {
+            echo "## Secrets seen by the release environment"
+            for name in CHOCOLATEY_API_KEY WINGET_GITHUB_TOKEN WINGET_FORK_OWNER; do
+              if [ -n "${!name}" ]; then echo "- $name: present"; else echo "- $name: MISSING"; missing=1; fi
+            done
+          } >> "$GITHUB_STEP_SUMMARY"
+
+          if [ -n "$WINGET_GITHUB_TOKEN" ]; then
+            # Read-only call: who owns the token. Only a yes/no goes to the summary.
+            login=$(curl -fsS -H "Authorization: Bearer $WINGET_GITHUB_TOKEN" -H "Accept: application/vnd.github+json" https://api.github.com/user | jq -r .login) || login=""
+            if [ -z "$login" ]; then
+              echo "- WINGET_GITHUB_TOKEN: rejected by GitHub (expired or revoked)" >> "$GITHUB_STEP_SUMMARY"
+              missing=1
+            elif [ "${login,,}" = "${WINGET_FORK_OWNER,,}" ]; then
+              echo "- WINGET_GITHUB_TOKEN: valid, belongs to WINGET_FORK_OWNER" >> "$GITHUB_STEP_SUMMARY"
+            else
+              echo "- WINGET_GITHUB_TOKEN: valid, but its user differs from WINGET_FORK_OWNER" >> "$GITHUB_STEP_SUMMARY"
+            fi
+          fi
+
+          exit $missing
+
+  repository-secrets:
+    name: Repository-level copies (MISSING once deleted)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check which repository-level copies still exist
+        shell: bash
+        env:
+          CHOCOLATEY_API_KEY: ${{ secrets.CHOCOLATEY_API_KEY }}
+          WINGET_GITHUB_TOKEN: ${{ secrets.WINGET_GITHUB_TOKEN }}
+          WINGET_FORK_OWNER: ${{ secrets.WINGET_FORK_OWNER }}
+        run: |
+          {
+            echo "## Repository-level copies (outside the environment)"
+            for name in CHOCOLATEY_API_KEY WINGET_GITHUB_TOKEN WINGET_FORK_OWNER; do
+              if [ -n "${!name}" ]; then echo "- $name: still present"; else echo "- $name: MISSING"; fi
+            done
+          } >> "$GITHUB_STEP_SUMMARY"
diff --git a/.github/workflows/publish-chocolatey.yml b/.github/workflows/publish-chocolatey.yml
index d723057..ebf9450 100644
--- a/.github/workflows/publish-chocolatey.yml
+++ b/.github/workflows/publish-chocolatey.yml
@@ -21,6 +21,7 @@ permissions:
 jobs:
   publish-chocolatey:
     runs-on: windows-2022
+    environment: release
 
     steps:
       - name: Resolve release metadata
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5175257..1b75da5 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -318,6 +318,8 @@ jobs:
 
   release:
     runs-on: ubuntu-latest
+    # Protected environment: waits for the maintainer's approval before it can write the release.
+    environment: release
     needs:
       - build
       - smoke-test
@@ -439,6 +441,7 @@ jobs:
 
   publish-winget:
     runs-on: windows-2022
+    environment: release
     needs:
       - build
       - release