From 0894d2340dc3622a4ed7fea679a6f8723a2bea79 Mon Sep 17 00:00:00 2001 From: Stephen Freudenthaler Date: Thu, 20 Aug 2026 11:44:38 -0400 Subject: [PATCH] fix(ci): gate the release notes backfill behind reviewer approval The phase's final step is `gh release edit --notes-file`, an unconditional replace on a public release body -- it overwrites hand edits and cannot be undone from the workflow. workflow_dispatch is open to every account with write access on this repo (45 today), so this has been an unreviewed write path to public release documentation since March. Adds a no-op approval gate on the release-notes-backfill environment (required_reviewers: dotDevelopers), matching the changelog-site-publish gate and cicd_evergreen-tracks-promote.yml's apply gate. Closes: #37139 Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01EbgDBJuoBrpJxh5qLMPorL --- .../workflows/cicd_ai-release-notes-backfill.yml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/.github/workflows/cicd_ai-release-notes-backfill.yml b/.github/workflows/cicd_ai-release-notes-backfill.yml index 624425188d1d..f205d5c2a72e 100644 --- a/.github/workflows/cicd_ai-release-notes-backfill.yml +++ b/.github/workflows/cicd_ai-release-notes-backfill.yml @@ -31,8 +31,24 @@ concurrency: cancel-in-progress: true jobs: + # The phase's final step is `gh release edit --notes-file`, an unconditional replace on a + # public release body — it overwrites hand edits and cannot be undone from here. + # workflow_dispatch is open to every account with write access on this repo, so reviewer + # approval is the access control. Same pattern as cicd_evergreen-tracks-promote.yml. + # The environment must carry required_reviewers; GitHub auto-creates it UNPROTECTED on + # first use if it is missing, which would silently remove this gate. + gate: + name: Approve Notes Rewrite + runs-on: ubuntu-${{ vars.UBUNTU_RUNNER_VERSION || '24.04' }} + environment: release-notes-backfill + steps: + - run: | + echo "Approved: rewrite release notes for ${{ inputs.release_tag }}" + echo "Previous tag: ${{ inputs.previous_tag || '(auto-detect)' }}" + release-notes: name: Generate Notes + needs: gate uses: ./.github/workflows/cicd_comp_ai-release-notes-phase.yml with: release_tag: ${{ inputs.release_tag }}