From 82c2e6cef22c8916c5dcc419972d5e64550c2958 Mon Sep 17 00:00:00 2001
From: Jason Ross <jason.ross841@outlook.com>
Date: Thu, 16 Apr 2026 20:12:58 -0500
Subject: [PATCH] config environment for release workflow

---
 .github/workflows/release.yml | 20 ++++++++++++++++++++
 README.md                     |  6 ++++--
 2 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a53a622..04ac444 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -41,6 +41,7 @@ jobs:
   release:
     runs-on: ubuntu-latest
     needs: build
+    environment: Production
     permissions:
       contents: read
     steps:
@@ -50,6 +51,25 @@ jobs:
           name: rendered-email-templates
           path: release/html
 
+      - name: Validate Cloudflare R2 configuration
+        env:
+          CF_R2_ACCESS_KEY_ID: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
+          CF_R2_SECRET_ACCESS_KEY: ${{ secrets.CF_R2_SECRET_ACCESS_KEY }}
+          CF_R2_ACCOUNT_ID: ${{ secrets.CF_R2_ACCOUNT_ID }}
+          CF_R2_BUCKET: ${{ secrets.CF_R2_BUCKET }}
+        run: |
+          missing=()
+          for name in CF_R2_ACCESS_KEY_ID CF_R2_SECRET_ACCESS_KEY CF_R2_ACCOUNT_ID CF_R2_BUCKET; do
+            if [ -z "${!name}" ]; then
+              missing+=("$name")
+            fi
+          done
+
+          if [ "${#missing[@]}" -gt 0 ]; then
+            printf 'Missing required GitHub Actions secrets for the Production environment: %s\n' "${missing[*]}" >&2
+            exit 1
+          fi
+
       - name: Upload templates to Cloudflare R2
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.CF_R2_ACCESS_KEY_ID }}
diff --git a/README.md b/README.md
index d7bc660..83ccaca 100644
--- a/README.md
+++ b/README.md
@@ -63,13 +63,15 @@ The workflow at `.github/workflows/release.yml`:
 2. runs the renderer to produce HTML files
 3. uploads the generated templates to a Cloudflare R2 bucket
 
-Required GitHub secrets:
+The `release` job targets the `Production` GitHub Actions environment.
+
+Required `Production` environment secrets:
 
 - `CF_R2_ACCESS_KEY_ID`
 - `CF_R2_SECRET_ACCESS_KEY`
 - `CF_R2_ACCOUNT_ID`
 - `CF_R2_BUCKET`
 
-Optional GitHub variable:
+Optional `Production` environment variable:
 
 - `CF_R2_PREFIX`