From 96c55352e098eb05e0b9b12baeb8464f02d4115b Mon Sep 17 00:00:00 2001 From: CloakHQ Date: Wed, 11 Mar 2026 00:22:57 +0100 Subject: [PATCH] ci: remove deployment environments from publish workflow to hide actor identity --- .github/workflows/publish.yml | 9 --------- 1 file changed, 9 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 5e4b64a..4dc0c9d 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -59,9 +59,6 @@ jobs: needs: [test, validate-version] if: always() && needs.test.result == 'success' && (needs.validate-version.result == 'success' || needs.validate-version.result == 'skipped') runs-on: ubuntu-latest - environment: - name: pypi - url: https://pypi.org/p/cloakbrowser permissions: id-token: write # OIDC trusted publishing — no PYPI_TOKEN needed steps: @@ -80,9 +77,6 @@ jobs: needs: [test, validate-version] if: always() && needs.test.result == 'success' && (needs.validate-version.result == 'success' || needs.validate-version.result == 'skipped') runs-on: ubuntu-latest - environment: - name: npm - url: https://www.npmjs.com/package/cloakbrowser permissions: id-token: write # OIDC trusted publishing + provenance — no NPM_TOKEN needed steps: @@ -102,9 +96,6 @@ jobs: needs: [test, validate-version] if: always() && needs.test.result == 'success' && (needs.validate-version.result == 'success' || needs.validate-version.result == 'skipped') runs-on: ubuntu-latest - environment: - name: docker - url: https://hub.docker.com/r/cloakhq/cloakbrowser permissions: id-token: write # Cosign keyless signing + attestations contents: read