[jeremy]

The Go module tag and the Kotlin publish to GitHub Packages now wait for a reviewer, as the crates and npm publishes already do.

Why: crates and npm publish from their own environments with required reviewers. The Go job, which pushes the go/vX module tag, and the Kotlin job, which publishes to GitHub Packages, ran without one. They now run in release-go and release-github-packages.

Releasing now: push the v* tag as before. Each language's workflow then waits at its publish job:

• Up to 4 approvals per release, one per workflow run: crates and go always; npm and github-packages (Kotlin) only when the tagged commit enables them. Swift publishes nothing gated; SwiftPM reads the tag.
• Each publish job waits only on its own build, so every one is ready for approval as soon as its build passes.
• The go/vX module tag is pushed only after approval.
• release-github needs no approval of its own. Its orchestration now waits up to 5.5 hours for the publishes. A rejected or unanswered publish fails it. If approvals take longer than that, re-run it with gh workflow run release-github.yml -f tag=vX.Y.Z.

Who approves: a member of sip or cli. Prevent-self-review is on, so whoever pushed the tag can't approve their own release; another member does.

To approve every waiting run for a tag in one pass (GitHub still records one approval per run):

R=basecamp/hey-sdk TAG=vX.Y.Z
gh api repos/$R/compare/main...$TAG --jq .status    # behind or identical: the tag is on main
for id in $(gh run list -R $R --branch "$TAG" --event push --status waiting --json databaseId --jq '.[].databaseId'); do
  ids=$(gh api repos/$R/actions/runs/$id/pending_deployments --jq '[.[]|select(.current_user_can_approve)|.environment.id]')
  [ "$ids" = "[]" ] || gh api -X POST repos/$R/actions/runs/$id/pending_deployments --input - <<<"{\"environment_ids\":$ids,\"state\":\"approved\",\"comment\":\"$TAG\"}" >/dev/null
done

Run it again if a build finishes after the first pass.

Environment: all four environments already exist, require sip or cli, and admit only v* tags, including release-npm, which didn't exist before. Nothing else needs configuring when this merges.

Merging is the owners' call.

---

Summary by cubic

Go module tagging and Kotlin publishing to GitHub Packages now wait for a reviewer before publishing, matching the existing crates and npm release gates.

Releasing now

• Requires up to 4 approvals per release: crates and go always; npm and GitHub Packages (Kotlin) only when the tagged commit enables them.
• make release pushes only vX.Y.Z; the approved release job creates the go/vX module tag, since the module proxy serves a tag the moment it exists.
• Each publish job waits only on its own build, so every one is ready for approval as soon as its build passes.
• Approvers must be sip or cli members; the tag pusher can't approve their own release.
• The release orchestrator waits up to 5.5 hours for approvals; re-run it with gh workflow run release-github.yml -f tag=vX.Y.Z if approvals take longer.

^{Written for commit 10efd5f. Summary will update on new commits.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	🔄 Running since 2026-10-21T09:52:27.128194Z	10efd5f	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[cubic-dev-ai]

All reported issues were addressed across 3 files

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>

[jeremy]

Release secrets and the per-registry environments

This repository publishes from one environment per registry:

• release-crates
• release-npm
• release-github-packages
• release-go

No secret needs to move into them, so there is nothing to rotate in here. Each publish authenticates with OIDC trusted publishing (the package registries) or GITHUB_TOKEN (the Go module tag and GitHub Packages), and the repository has no Actions secrets.

If a registry ever needs a token, put it in that registry's environment, not at repository level, and use the same order the other repositories follow:

1. Issue a fresh token.
2. Set it directly in the environment: gh secret set NAME --repo basecamp/hey-sdk --env release-<registry>
3. Run, or wait for, one release under that environment and confirm it succeeds.
4. Only then delete any repository-level copy and revoke the old token.

Each registry's trusted publisher should also name its environment (for example release-rubygems), so a publish from outside it is refused.