[llvm-branch-commits] [llvm] release/23.x: workflows/release-binaries: Move environment declaration to upload job (#212687) (PR #213348)

[Tobias Hieta via llvm-branch-commits]

https://github.com/tru updated https://github.com/llvm/llvm-project/pull/213348

>From ab8ca57f94fcac6ed19474bfddf678ac6ca9c7eb Mon Sep 17 00:00:00 2001
From: Tom Stellard <tstellar at redhat.com>
Date: Fri, 31 Jul 2026 13:00:46 -0700
Subject: [PATCH] workflows/release-binaries: Move environment declaration to
 upload job (#212687)

This is the only job that actually needs to use the environment secrets,
so the environment must be declared. We were using secrets in the
prepare job to do a permissions check, but this is unnecessary, because
that job does not do anything that is security sensitive.

Only the upload job needs to have these permission checks and these are
already included in the upload-release-artifact composite action.

(cherry picked from commit 02bde0716776a742164941e05cb026e750763b04)
---
 .github/workflows/release-binaries.yml | 14 +++-----------
 1 file changed, 3 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/release-binaries.yml b/.github/workflows/release-binaries.yml
index 79f327c4d37d1..3c1b775419d06 100644
--- a/.github/workflows/release-binaries.yml
+++ b/.github/workflows/release-binaries.yml
@@ -53,9 +53,6 @@ permissions:
 jobs:
   prepare:
     name: Prepare to build binaries
-    environment:
-      deployment: false
-      name: ${{ case( github.event_name == 'pull_request', null, 'release') }}
     runs-on: ${{ inputs.runs-on }}
     if: github.repository_owner == 'llvm'
     outputs:
@@ -83,14 +80,6 @@ jobs:
       with:
         release-version: ${{ inputs.release-version }}
 
-    - name: Check Permissions
-      if: github.event_name != 'pull_request'
-      uses: ./.github/workflows/require-team-membership
-      with:
-        team-slug: llvm-release-managers
-        LLVM_TOKEN_GENERATOR_CLIENT_ID: ${{ secrets.LLVM_TOKEN_GENERATOR_CLIENT_ID }}
-        LLVM_TOKEN_GENERATOR_PRIVATE_KEY: ${{ secrets.LLVM_TOKEN_GENERATOR_PRIVATE_KEY }}
-
     # The name of the Windows binaries uses the version from source, so we need
     # to fetch it here.
     - id: version-from-source
@@ -368,6 +357,9 @@ jobs:
 
   upload-release-binaries:
     name: "Upload Release Binaries"
+    environment:
+      deployment: false
+      name: release
     needs:
       - prepare
       - build-release-package