Magnus Müller 068f464ead Add environment protection to PyPI publish workflow ...

Adds `environment: pypi-publish` to the publish job. Once the
`pypi-publish` environment is created in GitHub repo settings with
required reviewers, all PyPI publishes will require manual approval.

This prevents unauthorized publishing even if a token with write
access is compromised — the attacker can create a release but the
publish job will pause waiting for a reviewer to approve.

Setup required after merging:
  GitHub → Settings → Environments → New environment → "pypi-publish"
  → Add required reviewers
  → Restrict deployment branches to "main" and tags

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-03-24 22:23:55 -07:00

..

ISSUE_TEMPLATE

Fix typo in logging level environment variable

2025-12-12 19:40:54 +00:00

workflows

Add environment protection to PyPI publish workflow

2026-03-24 22:23:55 -07:00

.git-blame-ignore-revs

fixed events

2025-06-17 22:38:59 -07:00

CONTRIBUTING.md

Update CONTRIBUTING.md

2025-05-13 20:51:49 -04:00

SECURITY.md

cleanup project root dir a bit

2025-06-09 22:34:34 -07:00