ci: publish releases from the deployment GitHub environment - #1850
Conversation
Co-Authored-By: mish@e2b.dev <mish@e2b.dev>
🤖 Devin AI EngineerI'll be helping with this pull request! Here's what you should know: ✅ I will automatically:
Note: I can only respond to comments from users who have write access to this repository. ⚙️ Control Options:
|
|
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
There was a problem hiding this comment.
TASTE.md compliance review: this PR only touches .github/workflows/publish_packages.yml (adds environment: deployment to the test job) and changes no SDK or CLI code, so none of the TASTE.md principles (T-1 – T-58: parity, API shape, streaming, control plane, template builder, timeouts, configuration, module structure, errors) apply. 0 violations.
Package ArtifactsBuilt from 85fa574. Download artifacts from this workflow run. JS SDK ( npm install ./e2b-2.47.1-devin-1788948545-release-environment.0.tgzCLI ( npm install ./e2b-cli-2.18.2-devin-1788948545-release-environment.0.tgzCode Interpreter JS SDK ( npm install ./e2b-code-interpreter-2.8.1-devin-1788948545-release-environment.0.tgzDesktop JS SDK ( npm install ./e2b-desktop-2.4.1-devin-1788948545-release-environment.0.tgzPython SDK ( pip install ./e2b-2.47.0+devin.1788948545.release.environment-py3-none-any.whlCode Interpreter Python SDK ( pip install ./e2b_code_interpreter-2.10.0+devin.1788948545.release.environment-py3-none-any.whlDesktop Python SDK ( pip install ./e2b_desktop-2.5.0+devin.1788948545.release.environment-py3-none-any.whl |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Looks good, straightforward CI config change.
What was reviewed: the single-line addition of environment: deployment to the test job in .github/workflows/publish_packages.yml, the placement rationale (can't go on the reusable-workflow-calling publish job in release.yml), and the rest of the job's publish/tag/push steps for any interaction with the new key. Checked whether the OIDC environment claim this introduces conflicts with existing npm/PyPI trusted-publisher config — ruled out, since those publishers were registered with an empty environment which matches any value. Also confirmed release-candidate.yml/publish_candidates.yml are correctly left untouched, consistent with candidates being cut from non-main branches.
Extended reasoning...
Overview
The diff is a single-line, well-commented addition to .github/workflows/publish_packages.yml: it adds environment: deployment to the test job (the "Build and test SDK" job that ultimately performs the publish/tag/push steps). The comment explains the placement rationale (a job that uses: a reusable workflow can't carry an environment key, so it can't live on publish in release.yml). No SDK source code, spec files, or public package surfaces are touched.
Security risks
This is a release-pipeline hardening change: it ties publish eligibility to a GitHub Environment whose deployment-branch policy can restrict runs to main. The change itself introduces no new secrets handling or auth logic; it layers an additional gate on top of the existing preflight ref-check. The two considerations raised and ruled out this run — that the new environment claim could interact with npm/PyPI trusted-publisher OIDC config, and that the guard is inert until an admin manually creates the deployment environment — are both accurately disclosed in the PR's own "Required repository configuration" section, and neither represents a code defect; they are external repo-configuration follow-ups, not bugs in this diff.
Level of scrutiny
Given the change is a single line plus a comment, confined to a CI/CD workflow file, mechanical, and does not alter build/test/publish logic paths for SDK packages, a lighter-touch review is appropriate. The bug hunting system found no issues, and the two candidates it considered were adequately explained by the PR description itself.
Other factors
No CODEOWNERS restriction applies to .github/workflows/, and the PR timeline shows no outstanding CHANGES_REQUESTED review or unaddressed third-party objection — only the author's own commit and automated bot comments. As a workflow-only change with no impact on packages/cli, packages/js-sdk, or packages/python-sdk public surfaces, it does not require a changeset per CLAUDE.md.
## Summary Deletes `release-candidate.yml` and the `publish_candidates.yml` reusable workflow it called. Neither has been run since the candidate flow was split out of `release.yml` in #1483 (2026-06-25); the last RC published through the old combined workflow was `e2b@2.24.1-connections.1189.0` on 2026-05-26, and the last PyPI RC was `e2b==2.0.0rc2` (2025-08). `release.yml` keeps its `release-${{ github.ref }}` concurrency group and the main-only preflight check; only the comments pointing at the candidate workflow are dropped. `publish_packages.yml` (now running in the `deployment` environment, #1850) is unaffected. ## Follow-up (PyPI) The trusted publishers registered for `publish_candidates.yml` on the `e2b`, `e2b-code-interpreter` and `e2b-desktop` PyPI projects (see #1828) no longer have a workflow behind them and can be removed. Since the remaining `publish_packages.yml` publishers are now the only ones, they can also be tightened to require the `deployment` environment. Link to Devin session: https://app.devin.ai/sessions/a59b5e364c484ced9524a652f80a49f9 Open in Devin Desktop: https://app.devin.ai/desktop/session/a59b5e364c484ced9524a652f80a49f9?variant=devin Requested by: @mishushakov Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: mish@e2b.dev <mish@e2b.dev>
1 participant
Summary
Runs the production publish job inside a GitHub environment so that the environment's deployment branch policy — not only the
Check the refpreflight step — decides which refs may publishlatestto npm and PyPI.It lives on the job in
publish_packages.yml, not onpublish:inrelease.yml, because a job thatuses:a reusable workflow only acceptsname/uses/with/secrets/strategy/needs/if/concurrency/permissions(docs). The preflight ref check stays: it fails fast before the SDK test matrix runs, whereas the environment rule only rejects the publish job itself.release-candidate.yml/publish_candidates.ymlare intentionally left without an environment — candidates are cut from feature branches, which a main-only policy would block.Required repository configuration
The
deploymentenvironment doesn't exist yet (GitHub would auto-create it on first run with no rules). The Devin GitHub App has no admin on this repo, so an admin needs to create it and restrict it tomain:Or in the UI: Settings → Environments → New environment
deployment→ Deployment branches and tags → Selected branches and tags → addmain.No trusted-publisher change is needed: the PyPI publishers from #1828 and the npm publishers were registered with an empty environment, which matches any environment. Optionally tighten them afterwards by setting the environment to
deploymenton thepublish_packages.ymlpublishers (leave thepublish_candidates.ymlones empty).Link to Devin session: https://app.devin.ai/sessions/a59b5e364c484ced9524a652f80a49f9
Open in Devin Desktop: https://app.devin.ai/desktop/session/a59b5e364c484ced9524a652f80a49f9?variant=devin
Requested by: @mishushakov