feat: environment-scoped release secrets (dev/prod R2 isolation)

.github/workflows/release-rust-bridge.yml

@@ -15,6 +15,17 @@ name: Release Rust Bridge Provider Bundle
 #
 # The tag prefix is intentionally not `v...` so the Swift release workflow
 # cannot accidentally publish a Swift bundle for the bridge tag.
+#
+# Repo secrets use DEV_/PROD_ prefixes so both environments live at repo
+# level without needing GitHub environments:
+#   DEV_R2_ACCESS_KEY_ID  / PROD_R2_ACCESS_KEY_ID
+#   DEV_R2_SECRET_ACCESS_KEY / PROD_R2_SECRET_ACCESS_KEY
+#   DEV_R2_ENDPOINT       / PROD_R2_ENDPOINT
+#   DEV_R2_BUCKET         / PROD_R2_BUCKET
+#   DEV_R2_PUBLIC_URL     / PROD_R2_PUBLIC_URL
+#   DEV_COORDINATOR_URL   / PROD_COORDINATOR_URL
+#   RELEASE_KEY           — shared across environments (no prefix)
+# Apple signing secrets are shared (same cert for both envs).
 
 on:
   push:
@@ -53,6 +64,12 @@ jobs:
     outputs:
       environment: ${{ steps.pick.outputs.environment }}
       version: ${{ steps.pick.outputs.version }}
+      r2_access_key_id: ${{ steps.secrets.outputs.r2_access_key_id }}
+      r2_secret_access_key: ${{ steps.secrets.outputs.r2_secret_access_key }}
+      r2_endpoint: ${{ steps.secrets.outputs.r2_endpoint }}
+      r2_bucket: ${{ steps.secrets.outputs.r2_bucket }}
+      r2_public_url: ${{ steps.secrets.outputs.r2_public_url }}
+      coordinator_url: ${{ steps.secrets.outputs.coordinator_url }}
     steps:
       - id: pick
         run: |
@@ -72,10 +89,34 @@ jobs:
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
           echo "Resolved env=$ENV version=$VERSION"
 
+      - id: secrets
+        env:
+          ENV_PREFIX: ${{ steps.pick.outputs.environment }}
+          DEV_R2_ACCESS_KEY_ID: ${{ secrets.DEV_R2_ACCESS_KEY_ID }}
+          PROD_R2_ACCESS_KEY_ID: ${{ secrets.PROD_R2_ACCESS_KEY_ID }}
+          DEV_R2_SECRET_ACCESS_KEY: ${{ secrets.DEV_R2_SECRET_ACCESS_KEY }}
+          PROD_R2_SECRET_ACCESS_KEY: ${{ secrets.PROD_R2_SECRET_ACCESS_KEY }}
+          DEV_R2_ENDPOINT: ${{ secrets.DEV_R2_ENDPOINT }}
+          PROD_R2_ENDPOINT: ${{ secrets.PROD_R2_ENDPOINT }}
+          DEV_R2_BUCKET: ${{ secrets.DEV_R2_BUCKET }}
+          PROD_R2_BUCKET: ${{ secrets.PROD_R2_BUCKET }}
+          DEV_R2_PUBLIC_URL: ${{ secrets.DEV_R2_PUBLIC_URL }}
+          PROD_R2_PUBLIC_URL: ${{ secrets.PROD_R2_PUBLIC_URL }}
+          DEV_COORDINATOR_URL: ${{ secrets.DEV_COORDINATOR_URL }}
+          PROD_COORDINATOR_URL: ${{ secrets.PROD_COORDINATOR_URL }}
+        run: |
+          set -euo pipefail
+          PREFIX=$(echo "$ENV_PREFIX" | tr '[:lower:]' '[:upper:]')
+          for key in R2_ACCESS_KEY_ID R2_SECRET_ACCESS_KEY R2_ENDPOINT R2_BUCKET R2_PUBLIC_URL COORDINATOR_URL; do
+            varname="${PREFIX}_${key}"
+            val="${!varname}"
+            outkey=$(echo "$key" | tr '[:upper:]' '[:lower:]')
+            echo "${outkey}=${val}" >> "$GITHUB_OUTPUT"
+          done
+
   build-and-release:
     name: Build, sign, notarize, upload, register
     needs: [resolve-env]
-    environment: ${{ needs.resolve-env.outputs.environment }}
     runs-on: macos-26-xlarge
 
     env:
@@ -306,10 +347,10 @@ jobs:
 
       - name: Upload bridge artifacts to R2
         env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
-          R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
-          R2_BUCKET: ${{ vars.R2_BUCKET }}
+          AWS_ACCESS_KEY_ID: ${{ needs.resolve-env.outputs.r2_access_key_id }}
+          AWS_SECRET_ACCESS_KEY: ${{ needs.resolve-env.outputs.r2_secret_access_key }}
+          R2_ENDPOINT: ${{ needs.resolve-env.outputs.r2_endpoint }}
+          R2_BUCKET: ${{ needs.resolve-env.outputs.r2_bucket }}
         run: |
           set -euo pipefail
           PREFIX="s3://${R2_BUCKET}/releases/v${VERSION}"
@@ -339,9 +380,9 @@ jobs:
 
       - name: Register bridge release with coordinator
         env:
-          COORDINATOR_URL: ${{ secrets.COORDINATOR_URL }}
+          COORDINATOR_URL: ${{ needs.resolve-env.outputs.coordinator_url }}
           RELEASE_KEY: ${{ secrets.RELEASE_KEY }}
-          R2_PUBLIC_URL: ${{ secrets.R2_PUBLIC_URL }}
+          R2_PUBLIC_URL: ${{ needs.resolve-env.outputs.r2_public_url }}
         run: |
           set -euo pipefail
           BUNDLE_URL="${R2_PUBLIC_URL}/releases/v${VERSION}/eigeninference-bundle-macos-arm64.tar.gz"

.github/workflows/release-swift.yml

@@ -23,6 +23,17 @@ name: Release Provider Bundle (Swift)
 #
 # The one-time Rust migration bridge intentionally uses `rust-bridge-vX.Y.Z`
 # so it cannot be confused with the Swift cutover tags above.
+#
+# Repo secrets use DEV_/PROD_ prefixes so both environments live at repo
+# level without needing GitHub environments:
+#   DEV_R2_ACCESS_KEY_ID  / PROD_R2_ACCESS_KEY_ID
+#   DEV_R2_SECRET_ACCESS_KEY / PROD_R2_SECRET_ACCESS_KEY
+#   DEV_R2_ENDPOINT       / PROD_R2_ENDPOINT
+#   DEV_R2_BUCKET         / PROD_R2_BUCKET
+#   DEV_R2_PUBLIC_URL     / PROD_R2_PUBLIC_URL
+#   DEV_COORDINATOR_URL   / PROD_COORDINATOR_URL
+#   RELEASE_KEY           — shared across environments (no prefix)
+# Apple signing secrets are shared (same cert for both envs).
 
 on:
   push:
@@ -62,6 +73,12 @@ jobs:
     outputs:
       environment: ${{ steps.pick.outputs.environment }}
       version: ${{ steps.pick.outputs.version }}
+      r2_access_key_id: ${{ steps.secrets.outputs.r2_access_key_id }}
+      r2_secret_access_key: ${{ steps.secrets.outputs.r2_secret_access_key }}
+      r2_endpoint: ${{ steps.secrets.outputs.r2_endpoint }}
+      r2_bucket: ${{ steps.secrets.outputs.r2_bucket }}
+      r2_public_url: ${{ steps.secrets.outputs.r2_public_url }}
+      coordinator_url: ${{ steps.secrets.outputs.coordinator_url }}
     steps:
       - id: pick
         run: |
@@ -84,10 +101,34 @@ jobs:
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
           echo "Resolved env=$ENV version=$VERSION"
 
+      - id: secrets
+        env:
+          ENV_PREFIX: ${{ steps.pick.outputs.environment }}
+          DEV_R2_ACCESS_KEY_ID: ${{ secrets.DEV_R2_ACCESS_KEY_ID }}
+          PROD_R2_ACCESS_KEY_ID: ${{ secrets.PROD_R2_ACCESS_KEY_ID }}
+          DEV_R2_SECRET_ACCESS_KEY: ${{ secrets.DEV_R2_SECRET_ACCESS_KEY }}
+          PROD_R2_SECRET_ACCESS_KEY: ${{ secrets.PROD_R2_SECRET_ACCESS_KEY }}
+          DEV_R2_ENDPOINT: ${{ secrets.DEV_R2_ENDPOINT }}
+          PROD_R2_ENDPOINT: ${{ secrets.PROD_R2_ENDPOINT }}
+          DEV_R2_BUCKET: ${{ secrets.DEV_R2_BUCKET }}
+          PROD_R2_BUCKET: ${{ secrets.PROD_R2_BUCKET }}
+          DEV_R2_PUBLIC_URL: ${{ secrets.DEV_R2_PUBLIC_URL }}
+          PROD_R2_PUBLIC_URL: ${{ secrets.PROD_R2_PUBLIC_URL }}
+          DEV_COORDINATOR_URL: ${{ secrets.DEV_COORDINATOR_URL }}
+          PROD_COORDINATOR_URL: ${{ secrets.PROD_COORDINATOR_URL }}
+        run: |
+          set -euo pipefail
+          PREFIX=$(echo "$ENV_PREFIX" | tr '[:lower:]' '[:upper:]')
+          for key in R2_ACCESS_KEY_ID R2_SECRET_ACCESS_KEY R2_ENDPOINT R2_BUCKET R2_PUBLIC_URL COORDINATOR_URL; do
+            varname="${PREFIX}_${key}"
+            val="${!varname}"
+            outkey=$(echo "$key" | tr '[:upper:]' '[:lower:]')
+            echo "${outkey}=${val}" >> "$GITHUB_OUTPUT"
+          done
+
   build-and-release:
     name: Build, sign, notarize, upload, register
     needs: [resolve-env]
-    environment: ${{ needs.resolve-env.outputs.environment }}
     runs-on: macos-26-xlarge
 
     env:
@@ -295,10 +336,11 @@ jobs:
 
       - name: Upload bundle to R2
         env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
-          R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
-          R2_BUCKET: ${{ vars.R2_BUCKET }}
+          AWS_ACCESS_KEY_ID: ${{ needs.resolve-env.outputs.r2_access_key_id }}
+          AWS_SECRET_ACCESS_KEY: ${{ needs.resolve-env.outputs.r2_secret_access_key }}
+          R2_ENDPOINT: ${{ needs.resolve-env.outputs.r2_endpoint }}
+          R2_BUCKET: ${{ needs.resolve-env.outputs.r2_bucket }}
+          R2_PUBLIC_URL: ${{ needs.resolve-env.outputs.r2_public_url }}
         run: |
           set -euo pipefail
           PREFIX="s3://${R2_BUCKET}/releases/v${VERSION}"
@@ -335,9 +377,9 @@ jobs:
 
       - name: Register release with coordinator
         env:
-          COORDINATOR_URL: ${{ secrets.COORDINATOR_URL }}
+          COORDINATOR_URL: ${{ needs.resolve-env.outputs.coordinator_url }}
           RELEASE_KEY: ${{ secrets.RELEASE_KEY }}
-          R2_PUBLIC_URL: ${{ secrets.R2_PUBLIC_URL }}
+          R2_PUBLIC_URL: ${{ needs.resolve-env.outputs.r2_public_url }}
         run: |
           set -euo pipefail
           BUNDLE_URL="${R2_PUBLIC_URL}/releases/v${VERSION}/darkbloom-bundle-macos-arm64.tar.gz"
@@ -390,7 +432,7 @@ jobs:
           ### Install
 
           \`\`\`bash
-          curl -fsSL ${{ secrets.COORDINATOR_URL }}/install.sh | bash
+          curl -fsSL ${{ needs.resolve-env.outputs.coordinator_url }}/install.sh | bash
           \`\`\`
 
           NOTES