ci: release environment and secrets check

.github/workflows/check-release-secrets.yml

@@ -0,0 +1,62 @@
+name: Check release secrets
+
+# Manual, read-only check of the publishing secrets. It publishes nothing and never prints a secret value.
+on:
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  environment-secrets:
+    name: Secrets seen by the release environment
+    runs-on: ubuntu-latest
+    # Same protected environment as the publishing jobs: needs the maintainer's approval to run.
+    environment: release
+    steps:
+      - name: Check the secrets are present and the winget token works
+        shell: bash
+        env:
+          CHOCOLATEY_API_KEY: ${{ secrets.CHOCOLATEY_API_KEY }}
+          WINGET_GITHUB_TOKEN: ${{ secrets.WINGET_GITHUB_TOKEN }}
+          WINGET_FORK_OWNER: ${{ secrets.WINGET_FORK_OWNER }}
+        run: |
+          missing=0
+          {
+            echo "## Secrets seen by the release environment"
+            for name in CHOCOLATEY_API_KEY WINGET_GITHUB_TOKEN WINGET_FORK_OWNER; do
+              if [ -n "${!name}" ]; then echo "- $name: present"; else echo "- $name: MISSING"; missing=1; fi
+            done
+          } >> "$GITHUB_STEP_SUMMARY"
+
+          if [ -n "$WINGET_GITHUB_TOKEN" ]; then
+            # Read-only call: who owns the token. Only a yes/no goes to the summary.
+            login=$(curl -fsS -H "Authorization: Bearer $WINGET_GITHUB_TOKEN" -H "Accept: application/vnd.github+json" https://api.github.com/user | jq -r .login) || login=""
+            if [ -z "$login" ]; then
+              echo "- WINGET_GITHUB_TOKEN: rejected by GitHub (expired or revoked)" >> "$GITHUB_STEP_SUMMARY"
+              missing=1
+            elif [ "${login,,}" = "${WINGET_FORK_OWNER,,}" ]; then
+              echo "- WINGET_GITHUB_TOKEN: valid, belongs to WINGET_FORK_OWNER" >> "$GITHUB_STEP_SUMMARY"
+            else
+              echo "- WINGET_GITHUB_TOKEN: valid, but its user differs from WINGET_FORK_OWNER" >> "$GITHUB_STEP_SUMMARY"
+            fi
+          fi
+
+          exit $missing
+
+  repository-secrets:
+    name: Repository-level copies (MISSING once deleted)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check which repository-level copies still exist
+        shell: bash
+        env:
+          CHOCOLATEY_API_KEY: ${{ secrets.CHOCOLATEY_API_KEY }}
+          WINGET_GITHUB_TOKEN: ${{ secrets.WINGET_GITHUB_TOKEN }}
+          WINGET_FORK_OWNER: ${{ secrets.WINGET_FORK_OWNER }}
+        run: |
+          {
+            echo "## Repository-level copies (outside the environment)"
+            for name in CHOCOLATEY_API_KEY WINGET_GITHUB_TOKEN WINGET_FORK_OWNER; do
+              if [ -n "${!name}" ]; then echo "- $name: still present"; else echo "- $name: MISSING"; fi
+            done
+          } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/publish-chocolatey.yml

@@ -21,6 +21,7 @@ permissions:
 jobs:
   publish-chocolatey:
     runs-on: windows-2022
+    environment: release
 
     steps:
       - name: Resolve release metadata

.github/workflows/release.yml

@@ -318,6 +318,8 @@ jobs:
 
   release:
     runs-on: ubuntu-latest
+    # Protected environment: waits for the maintainer's approval before it can write the release.
+    environment: release
     needs:
       - build
       - smoke-test
@@ -439,6 +441,7 @@ jobs:
 
   publish-winget:
     runs-on: windows-2022
+    environment: release
     needs:
       - build
       - release