From f48a94afcdfd61fdac5ac1b9211e67c84d7c511a Mon Sep 17 00:00:00 2001
From: ulises-jeremias <ulises.jeremias@users.noreply.github.com>
Date: Thu, 16 Jul 2026 12:36:58 -0300
Subject: [PATCH] fix(ci): read dist secrets from the pypi environment

Docker, Homebrew notify, and AUR publish already store credentials as
environment secrets on `pypi`; wire environment: pypi so jobs can see them.
---
 .github/workflows/notify-homebrew.yml | 1 +
 .github/workflows/publish-aur.yml     | 1 +
 .github/workflows/publish-docker.yml  | 1 +
 docs/DISTRIBUTION_SETUP.md            | 4 +++-
 4 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/notify-homebrew.yml b/.github/workflows/notify-homebrew.yml
index 25f7340..b84930a 100644
--- a/.github/workflows/notify-homebrew.yml
+++ b/.github/workflows/notify-homebrew.yml
@@ -20,6 +20,7 @@ jobs:
   notify:
     name: Dispatch to homebrew-tap
     runs-on: ubuntu-latest
+    environment: pypi
     steps:
       - name: Resolve version
         id: version
diff --git a/.github/workflows/publish-aur.yml b/.github/workflows/publish-aur.yml
index cff5c06..f03388e 100644
--- a/.github/workflows/publish-aur.yml
+++ b/.github/workflows/publish-aur.yml
@@ -20,6 +20,7 @@ jobs:
   aur:
     name: Update AUR package
     runs-on: ubuntu-latest
+    environment: pypi
     steps:
       - name: Resolve version
         id: version
diff --git a/.github/workflows/publish-docker.yml b/.github/workflows/publish-docker.yml
index c84933c..541034d 100644
--- a/.github/workflows/publish-docker.yml
+++ b/.github/workflows/publish-docker.yml
@@ -20,6 +20,7 @@ jobs:
   docker:
     name: Build and push Docker image
     runs-on: ubuntu-latest
+    environment: pypi
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
diff --git a/docs/DISTRIBUTION_SETUP.md b/docs/DISTRIBUTION_SETUP.md
index 57574b2..c0021f7 100644
--- a/docs/DISTRIBUTION_SETUP.md
+++ b/docs/DISTRIBUTION_SETUP.md
@@ -9,7 +9,9 @@
 | **AUR** | `publish-aur.yml` | `AUR_SSH_PRIVATE_KEY`, `AUR_REPO_TOKEN` |
 | **Homebrew** | `notify-homebrew.yml` → `homebrew-tap` | `HOMEBREW_TAP_TOKEN` |
 
-Configure secrets under **Settings → Secrets and variables → Actions**.
+Configure secrets under **Settings → Environments → `pypi` → Environment secrets**
+(not repository Action secrets). Release, Docker, AUR, and Homebrew jobs all use
+`environment: pypi`.
 
 ## PyPI Trusted Publishing