From 641d86716f5391919d6e7ada11047c6951850372 Mon Sep 17 00:00:00 2001 From: Fedor Korotkov Date: Mon, 6 Jul 2026 13:10:14 -0400 Subject: [PATCH] Scope release secrets to GoReleaser steps --- .github/workflows/release.yml | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d707732..910af92 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -15,13 +15,6 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 60 environment: publish - env: - GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }} - MACOS_NOTARY_ISSUER_ID: ${{ secrets.MACOS_NOTARY_ISSUER_ID }} - MACOS_NOTARY_KEY: ${{ secrets.MACOS_NOTARY_KEY }} - MACOS_NOTARY_KEY_ID: ${{ secrets.MACOS_NOTARY_KEY_ID }} - MACOS_SIGN_P12: ${{ secrets.MACOS_SIGN_P12 }} - MACOS_SIGN_PASSWORD: ${{ secrets.MACOS_SIGN_PASSWORD }} steps: - uses: actions/checkout@v6 with: @@ -58,7 +51,13 @@ jobs: args: release --clean env: GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} + GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }} HOMEBREW_TAP_GITHUB_TOKEN: ${{ steps.tap-token.outputs.token }} + MACOS_NOTARY_ISSUER_ID: ${{ secrets.MACOS_NOTARY_ISSUER_ID }} + MACOS_NOTARY_KEY: ${{ secrets.MACOS_NOTARY_KEY }} + MACOS_NOTARY_KEY_ID: ${{ secrets.MACOS_NOTARY_KEY_ID }} + MACOS_SIGN_P12: ${{ secrets.MACOS_SIGN_P12 }} + MACOS_SIGN_PASSWORD: ${{ secrets.MACOS_SIGN_PASSWORD }} - name: Release dry run if: github.ref_type != 'tag' uses: goreleaser/goreleaser-action@v7 @@ -66,6 +65,13 @@ jobs: distribution: goreleaser-pro version: "~> v2" args: release --skip=publish --snapshot --clean + env: + GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }} + MACOS_NOTARY_ISSUER_ID: ${{ secrets.MACOS_NOTARY_ISSUER_ID }} + MACOS_NOTARY_KEY: ${{ secrets.MACOS_NOTARY_KEY }} + MACOS_NOTARY_KEY_ID: ${{ secrets.MACOS_NOTARY_KEY_ID }} + MACOS_SIGN_P12: ${{ secrets.MACOS_SIGN_P12 }} + MACOS_SIGN_PASSWORD: ${{ secrets.MACOS_SIGN_PASSWORD }} - name: Upload dry-run artifacts if: github.ref_type != 'tag' uses: actions/upload-artifact@v6