config environment for release workflow

.github/workflows/release.yml

@@ -41,6 +41,7 @@ jobs:
   release:
     runs-on: ubuntu-latest
     needs: build
+    environment: Production
     permissions:
       contents: read
     steps:
@@ -50,6 +51,25 @@ jobs:
           name: rendered-email-templates
           path: release/html
 
+      - name: Validate Cloudflare R2 configuration
+        env:
+          CF_R2_ACCESS_KEY_ID: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
+          CF_R2_SECRET_ACCESS_KEY: ${{ secrets.CF_R2_SECRET_ACCESS_KEY }}
+          CF_R2_ACCOUNT_ID: ${{ secrets.CF_R2_ACCOUNT_ID }}
+          CF_R2_BUCKET: ${{ secrets.CF_R2_BUCKET }}
+        run: |
+          missing=()
+          for name in CF_R2_ACCESS_KEY_ID CF_R2_SECRET_ACCESS_KEY CF_R2_ACCOUNT_ID CF_R2_BUCKET; do
+            if [ -z "${!name}" ]; then
+              missing+=("$name")
+            fi
+          done
+
+          if [ "${#missing[@]}" -gt 0 ]; then
+            printf 'Missing required GitHub Actions secrets for the Production environment: %s\n' "${missing[*]}" >&2
+            exit 1
+          fi
+
       - name: Upload templates to Cloudflare R2
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.CF_R2_ACCESS_KEY_ID }}

README.md

@@ -63,13 +63,15 @@ The workflow at `.github/workflows/release.yml`:
 2. runs the renderer to produce HTML files
 3. uploads the generated templates to a Cloudflare R2 bucket
 
-Required GitHub secrets:
+The `release` job targets the `Production` GitHub Actions environment.
+
+Required `Production` environment secrets:
 
 - `CF_R2_ACCESS_KEY_ID`
 - `CF_R2_SECRET_ACCESS_KEY`
 - `CF_R2_ACCOUNT_ID`
 - `CF_R2_BUCKET`
 
-Optional GitHub variable:
+Optional `Production` environment variable:
 
 - `CF_R2_PREFIX`