CI - Use GitHub environments

.github/workflows/attach-artifacts.yml

@@ -10,6 +10,7 @@ on:
 jobs:
   upload-assets:
     runs-on: spacetimedb-new-runner-2
+    environment: release
     permissions:
       contents: write  # needed to modify releases
 
@@ -60,4 +61,3 @@ jobs:
           gh release upload "$RELEASE_TAG" ./* \
             --repo "$GITHUB_REPOSITORY" \
             --clobber
-

.github/workflows/benchmarks.yml

@@ -24,6 +24,7 @@ jobs:
   benchmark:
     name: run criterion benchmarks
     runs-on: benchmarks-runner
+    environment: benchmarks
     # filter for a comment containing 'benchmarks please'
     if: ${{ github.event_name != 'issue_comment' || (github.event.issue.pull_request && contains(github.event.comment.body, 'benchmarks please')) }}
     env:
@@ -181,6 +182,7 @@ jobs:
     # about other stuff running on the machine!
     # runs-on: benchmarks-runner
     runs-on: ubuntu-latest
+    environment: benchmarks
     timeout-minutes: 20 # on a successful run, runs in 8 minutes
     container:
       image: rust:1.93.0

.github/workflows/ci.yml

@@ -379,6 +379,7 @@ jobs:
     # This can't go on e.g. ubuntu-latest because that runner runs out of disk space. ChatGPT suggested that the general solution tends to be to use
     # a custom runner.
     runs-on: spacetimedb-new-runner-2
+    environment: licensed-ci
     # Disable the tests because they are very flaky at the moment.
     # TODO: Remove this line and re-enable the `if` line just below here.
     if: false
@@ -567,6 +568,7 @@ jobs:
       contents: read
       checks: write
     runs-on: spacetimedb-unity-runner
+    environment: licensed-ci
     timeout-minutes: 30
     env:
       CARGO_TARGET_DIR: ${{ github.workspace }}/target
@@ -837,6 +839,7 @@ jobs:
     permissions:
       contents: read
     runs-on: ubuntu-latest
+    environment: coordination
     env:
       TARGET_OWNER: clockworklabs
       TARGET_REPO: SpacetimeDBPrivate

.github/workflows/discord-posts.yml

@@ -7,6 +7,7 @@ on:
 jobs:
   discordNotification:
     runs-on: ubuntu-latest
+    environment: coordination
     if: github.event.pull_request.merged == true &&
       github.event.pull_request.base.ref == 'master'
     env:
@@ -73,6 +74,7 @@ jobs:
 
   invokePrivate:
     runs-on: ubuntu-latest
+    environment: coordination
     if: github.event.pull_request.merged == true &&
       github.event.pull_request.base.ref == 'master'
     permissions:

.github/workflows/docker.yml

@@ -12,6 +12,7 @@ on:
 jobs:
   docker-amd64:
     runs-on: ubuntu-latest
+    environment: release
     name: Build DockerHub AMD64 Container
     steps:
       - name: Checkout
@@ -69,6 +70,7 @@ jobs:
 
   docker-arm64:
     runs-on: arm-runner
+    environment: release
     name: Build DockerHub ARM64 Container
     steps:
       - name: Install jq

.github/workflows/docs-publish.yaml

@@ -11,6 +11,7 @@ on:
 jobs:
   build:
     runs-on: spacetimedb-new-runner-2
+    environment: release
     steps:
       - name: Checkout repository
         uses: actions/checkout@v3

.github/workflows/docs-update-llms.yaml

@@ -15,6 +15,7 @@ on:
 jobs:
   update-llms:
     runs-on: spacetimedb-new-runner-2
+    environment: release
     steps:
       - name: Checkout repository
         uses: actions/checkout@v3

.github/workflows/llm-benchmark-periodic.yml

@@ -30,6 +30,7 @@ concurrency:
 jobs:
   run-benchmarks:
     runs-on: spacetimedb-new-runner
+    environment: llm-benchmark-update
     container:
       image: localhost:5000/spacetimedb-ci:latest
       options: >-

.github/workflows/package.yml

@@ -29,6 +29,7 @@ jobs:
 
     name: Build CLI for ${{ matrix.name }}
     runs-on: ${{ matrix.runner }}
+    environment: release
 
     steps:
       - name: Checkout

.github/workflows/tag-release.yml

@@ -6,6 +6,7 @@ jobs:
   on-release:
     name: Re-tag latest
     runs-on: ubuntu-latest
+    environment: release
     steps:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2