ci: cmux-tui artifact publishing runs in its own artifacts environment

[lawrencecchen]

#16171 put the cmux-tui publish job in the `release` environment. That policy allows only `main` and `v*` tags, so publishes from cmux-next helper branches (`cmux-tui-pin-*`) failed before any step ran (run 36779595430).

A commit-addressed cmux-tui build is not a production release. The job now runs in a new `artifacts` environment. Its deployment policy (already configured) allows `main`, `feat-cmux-next` and `cmux-tui-pin-`. The job uses only the three `CF_R2_` upload secrets; signing, Sparkle, Homebrew and Apple secrets stay in `release`. The guard test checks the environment and that the job reads no other secret.

Commit 1 adds the failing guard, commit 2 the fix. `tests/test_ci_production_secrets_protected_env.py` passes locally.

Changelog

none

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Fixes cmux-tui artifact publishing so daemon pin builds from helper branches can upload to R2 again.

• The publish job now runs in a new artifacts environment whose deployment policy allows main, feat-cmux-next, and cmux-tui-pin-* branches; the release environment only allows main and v* tags, which blocked pin publishes before any step ran.
• The artifacts environment holds only the three CF_R2_* upload secrets; signing, Sparkle, Homebrew, and Apple secrets stay in release.
• Adds a guard test that the publish job runs in the artifacts environment and reads no secrets other than the R2 upload credentials.

^{Written for commit fa3bedb. Summary will update on new commits.}

Summary by CodeRabbit

• Chores
  • Improved security controls for publishing build artifacts. No user-facing functionality changes.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Repository: manaflow-ai/cmux/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 675a63f8-9ba5-46c4-be98-9236af8a309b

📥 Commits

Reviewing files that changed from the base of the PR and between 71bb553 and fa3bedb.

📒 Files selected for processing (2)

• .github/workflows/cmux-tui-artifacts.yml
• tests/test_ci_production_secrets_protected_env.py

 _____________________________________
< Please step away from the keyboard! >
 -------------------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Merge receipt for fa3bedbab5: every check was green at merge (12 verified; 17 skipped by policy). Full suite runs on main after merge.