From 4350eb91ac2d4406acc71930a3142fe8b0e9092a Mon Sep 17 00:00:00 2001
From: alex <53851759+alxxjohn@users.noreply.github.com>
Date: Tue, 18 Aug 2026 18:49:34 -0400
Subject: [PATCH] fix(release): protect trusted publishing environment

---
 .github/workflows/cd.yml | 2 ++
 packaging/README.md      | 7 +++++--
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index f9a5246b..6465430f 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -178,6 +178,7 @@ jobs:
     needs: [release-please, stable-release]
     if: needs.release-please.outputs.release_created == 'true'
     runs-on: ubuntu-latest
+    environment: release-publish
     permissions:
       contents: read
       id-token: write # npm trusted publishing (OIDC) — no NPM_TOKEN needed.
@@ -248,6 +249,7 @@ jobs:
     needs: [release-please, stable-release]
     if: needs.release-please.outputs.release_created == 'true'
     runs-on: ubuntu-latest
+    environment: release-publish
     permissions:
       contents: read
       id-token: write # PyPI trusted publishing (OIDC) — no PYPI_API_TOKEN needed.
diff --git a/packaging/README.md b/packaging/README.md
index 7637bc8c..c7cb379e 100644
--- a/packaging/README.md
+++ b/packaging/README.md
@@ -112,7 +112,7 @@ registries use OIDC trusted publishing — no long-lived tokens live in CI.
       - Organization/user: `devr-tools`
       - Repository: `codeguard`
       - Workflow filename: `cd.yml`  ← the caller, not release.yml
-      - Environment: *(leave blank)*
+      - Environment: `release-publish`
       - Allowed actions: `npm publish`
 
       Packages: `@devr-tools/codeguard` plus
@@ -127,7 +127,10 @@ registries use OIDC trusted publishing — no long-lived tokens live in CI.
    command is still `codeguard`):
    - Owner / repo: `devr-tools/codeguard`
    - Workflow filename: `cd.yml`  ← the publish job lives in cd.yml (same as npm)
-   - Environment: *(leave blank — the job sets none)*
+   - Environment: `release-publish`
+
+   Configure the GitHub `release-publish` environment with deployment branch
+   protection for the default branch and require reviewers before deployment.
 
    This lets the `publish-pypi` job authenticate via `id-token: write` with no
    long-lived token. (Alternatively, set a `PYPI_API_TOKEN` secret and pass it