From 45bf9a3b029d63c6231d7e119f7c2f579716af2f Mon Sep 17 00:00:00 2001
From: Lior Poterman <191881919+cx-lior-poterman@users.noreply.github.com>
Date: Mon, 31 Aug 2026 12:38:52 +0300
Subject: [PATCH] fix(ci): remove nightly workflow, gate release/delete under
 environment

nightly.yml triggered release.yml on every push to main, but release.yml
now requires the `release` environment's human approval, so pushes would
block on manual sign-off. Releases are manual dispatch only now.

Adds `environment: release` to release.yml's release job and to
delete-dev-releases.yml's delete job (the latter is directly dispatchable
and deletes releases/tags, so it needed its own gate since release.yml
invokes it via a reusable-workflow `uses:` job, which can't carry an
environment).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/workflows/delete-dev-releases.yml |  1 +
 .github/workflows/nightly.yml             | 33 -----------------------
 .github/workflows/release.yml             |  1 +
 3 files changed, 2 insertions(+), 33 deletions(-)
 delete mode 100644 .github/workflows/nightly.yml

diff --git a/.github/workflows/delete-dev-releases.yml b/.github/workflows/delete-dev-releases.yml
index 6a47fbdb..0aa67b47 100644
--- a/.github/workflows/delete-dev-releases.yml
+++ b/.github/workflows/delete-dev-releases.yml
@@ -22,6 +22,7 @@ permissions: {}
 jobs:
   delete:
     name: Delete releases and tags
+    environment: release
     permissions:
       id-token: write  # for OIDC token generation
       contents: write  # for git tag/release deletion
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
deleted file mode 100644
index 70bdfaa5..00000000
--- a/.github/workflows/nightly.yml
+++ /dev/null
@@ -1,33 +0,0 @@
-name: Nightly Release
-
-on:
-  push:
-    branches:
-      - main
-
-concurrency:
-  group: ${{ github.workflow }}
-  cancel-in-progress: false
-
-permissions: {}
-
-jobs:
-  set_tag:
-    name: Generate Release Tag
-    runs-on: cx-public-ubuntu-x64
-    outputs:
-      tag_name: ${{ steps.tagname.outputs.tag_name }}
-    steps:
-      - name: Create tagname
-        run: echo "tag_name=2.0.0" >> "$GITHUB_OUTPUT"
-        id: tagname
-      - name: Print tagname
-        env:
-          TAG_NAME: ${{ steps.tagname.outputs.tag_name }}
-        run: echo "created tag $TAG_NAME"
-  nightly:
-    needs: set_tag
-    uses: Checkmarx/ast-eclipse-plugin/.github/workflows/release.yml@a776dbbfa70cda798753bec14dd7c1f47d094595
-    with:
-      tag: ${{ needs.set_tag.outputs.tag_name }}
-      rbranch: "nightly"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ab60a6b8..fb50eb21 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -44,6 +44,7 @@ jobs:
     if: inputs.rbranch
   release:
     name: Release
+    environment: release
     permissions:
       id-token: write  # for OIDC token generation
       contents: write  # for git push and release creation