diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 50a4393de2..5adb5f9ecd 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -138,6 +138,8 @@ jobs: environment: 'NPM Release' # This will require an approval from a maintainer, they are notified in Slack above permissions: contents: read + actions: read + pull-requests: read outputs: commit-hash: ${{ steps.commit-version-bump.outputs.commit-hash }} # posthog-js SDK version after `pnpm bump`. Downstream jobs use this @@ -150,6 +152,11 @@ jobs: with: egress-policy: audit + - name: Block approval by the authors of the released PRs + uses: PostHog/.github/.github/actions/release-approval-guard@68f2906c222a22652292c6120028c196db916c3f # main + with: + environment: 'NPM Release' + - name: Notify Slack - Approved continue-on-error: true # Don't block release if Slack notification fails uses: PostHog/.github/.github/actions/slack-thread-reply@836a5e06cdf40ed2a46b16f131b0a9b03c1ffea1 # main