ci: release secrets from the main-only release environment

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UhhZMBTviDQxZvwnyP89fo

.github/CODEOWNERS

@@ -1,2 +1,13 @@
 # Every change to FieldCraft needs the maintainer's review before it merges.
 * @jyviko
+
+# Release and supply-chain paths, named explicitly so they stay owner-reviewed if the rule above
+# is ever relaxed: workflows and secrets use, packaging and signing, the updater, dependencies,
+# licences.
+/.github/ @jyviko
+/packaging/ @jyviko
+/crates/update/ @jyviko
+/Cargo.toml @jyviko
+/Cargo.lock @jyviko
+/ATTRIBUTION.md @jyviko
+/deny.toml @jyviko

.github/workflows/pages.yml

@@ -33,6 +33,10 @@ env:
 
 jobs:
   build:
+    # POSTHOG_KEY lives in the `release` environment (main only, docs/releasing.md). The deploy job
+    # already uses github-pages and a job has one environment, so the build job reads the key: on
+    # main it runs in `release`, elsewhere in no environment and with an empty key.
+    environment: ${{ github.ref == 'refs/heads/main' && 'release' || '' }}
     runs-on: ubuntu-24.04
     timeout-minutes: 60
     steps:

.github/workflows/release.yml

@@ -73,6 +73,9 @@ jobs:
   macos:
     name: macOS universal
     needs: version
+    # Signing, notarization and analytics secrets live in the `release` environment, which only
+    # `main` may use; a dry run on another branch asks for no environment and builds unsigned.
+    environment: ${{ github.ref == 'refs/heads/main' && 'release' || '' }}
     runs-on: macos-14
     timeout-minutes: 120
     outputs:
@@ -118,6 +121,9 @@ jobs:
     name: Linux x86_64
     needs: version
     # The oldest GitHub-hosted image, so the binaries need only glibc >= 2.35.
+    # Signing, notarization and analytics secrets live in the `release` environment, which only
+    # `main` may use; a dry run on another branch asks for no environment and builds unsigned.
+    environment: ${{ github.ref == 'refs/heads/main' && 'release' || '' }}
     runs-on: ubuntu-22.04
     timeout-minutes: 90
     env:
@@ -201,6 +207,9 @@ jobs:
   windows:
     name: Windows x64
     needs: version
+    # Signing, notarization and analytics secrets live in the `release` environment, which only
+    # `main` may use; a dry run on another branch asks for no environment and builds unsigned.
+    environment: ${{ github.ref == 'refs/heads/main' && 'release' || '' }}
     runs-on: windows-latest
     timeout-minutes: 90
     env:
@@ -230,6 +239,9 @@ jobs:
   release:
     name: Draft release (or dry-run artifacts)
     needs: [version, macos, linux, windows]
+    # Signing, notarization and analytics secrets live in the `release` environment, which only
+    # `main` may use; a dry run on another branch asks for no environment and builds unsigned.
+    environment: ${{ github.ref == 'refs/heads/main' && 'release' || '' }}
     runs-on: ubuntu-24.04
     permissions:
       contents: write