From d133cbbf7a1dc21c8b7ef2cc0f9719a3be703454 Mon Sep 17 00:00:00 2001
From: generall <andrey@vasnetsov.com>
Date: Wed, 21 Oct 2026 09:47:10 +0200
Subject: [PATCH] ci: run Maven Central publish in release environment

Restricts the signing key and Sonatype credentials to v* tag refs once
they are moved to the environment.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/cd.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index 77e20f3..8e9ea35 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -56,6 +56,7 @@ jobs:
 
   publish:
     runs-on: ubuntu-latest
+    environment: release
     needs: build
     env:
       ORG_GRADLE_PROJECT_signingKeyId: ${{ secrets.ORG_GRADLE_PROJECT_SIGNINGKEYID }}