ci: simplify staging smoke publication

Author: hesreallyhim

.github/workflows/README.md

@@ -24,7 +24,7 @@ This directory contains the repository's CI, release, dependency, and supply-cha
 
 - [`pre-release-validation.yml`](pre-release-validation.yml) is a manual, non-publishing validation pass for candidate refs. It builds the template from the candidate source, runs template smoke checks, runs generated-template consumer e2e against the same candidate action runtime, dry-runs template publication, and uploads the generated template for inspection.
 
-- [`staging-smoke.yml`](staging-smoke.yml) validates and optionally publishes the one copied-repository staging smoke scenario described in [`../../docs/STAGING_SMOKE.md`](../../docs/STAGING_SMOKE.md). Pull requests and pushes that touch the staging/template surface run `make staging-smoke` in dry-run mode and upload evidence. Manual dispatch can publish `reponomics/reponomics-dashboard-staging` only after the `staging-smoke-publication` environment approves the job, using a scoped GitHub App token for the staging repository.
+- [`staging-smoke.yml`](staging-smoke.yml) validates and optionally publishes the one copied-repository staging smoke scenario described in [`../../docs/STAGING_SMOKE.md`](../../docs/STAGING_SMOKE.md). Pull requests and pushes that touch the staging/template surface run `make staging-smoke` in dry-run mode and upload evidence. Manual dispatch can publish `reponomics/reponomics-dashboard-staging` using a scoped GitHub App token for the staging repository.
 
 - [`sbom-provenance.yml`](sbom-provenance.yml) generates a repository SPDX SBOM and creates release source/SBOM attestations for release and manual runs. Release asset upload is explicitly disabled because immutable releases cannot be mutated after publication, and dependency snapshot upload is disabled so the third-party SBOM action runs with a read-only job token.
 

.github/workflows/staging-smoke.yml

@@ -113,7 +113,6 @@ jobs:
     name: Publish staging smoke repository
     if: ${{ github.event_name == 'workflow_dispatch' && inputs.publish }}
     runs-on: ubuntu-24.04
-    environment: staging-smoke-publication
     permissions:
       contents: read
     steps:

docs/STAGING_SMOKE.md

@@ -60,15 +60,13 @@ The source repository workflow
   dry-run mode and upload the evidence files;
 - manual dispatch with `publish: false` runs the same dry-run against a selected
   source ref;
-- manual dispatch with `publish: true` publishes the copied staging repository
-  after the `staging-smoke-publication` environment allows the job to proceed.
+- manual dispatch with `publish: true` publishes the copied staging repository.
 
 The publication job uses a scoped GitHub App token. Configure these source
 repository settings before manual publication:
 
 - repository variable `STAGING_SMOKE_APP_CLIENT_ID`;
-- repository secret `STAGING_SMOKE_APP_PRIVATE_KEY`;
-- environment `staging-smoke-publication` with the desired reviewer policy.
+- repository secret `STAGING_SMOKE_APP_PRIVATE_KEY`.
 
 The GitHub App installation needs write access only to
 `reponomics/reponomics-dashboard-staging`, including repository contents and
@@ -82,8 +80,8 @@ Before publishing, configure the staging repository out of band:
 
 - repository visibility is public;
 - Settings -> Pages -> Build and deployment -> Source is set to GitHub Actions;
-- repository secret `COLLECTION_TOKEN` exists and can read the selected public
-  repositories;
+- repository secret `COLLECTION_TOKEN` exists and can read
+  `reponomics/reponomics-dashboard-action`;
 - repository secret `DASHBOARD_SECRET_DO_NOT_REPLACE` exists and is retained
   across runs.
 

tests/test_action_metadata.py

@@ -269,7 +269,7 @@ def test_staging_smoke_workflow_dry_runs_and_publishes_manually() -> None:
     assert "tests/test_staging_smoke.py" in validate_commands
     assert "--push" not in validate_commands
     assert publish_job["if"] == "${{ github.event_name == 'workflow_dispatch' && inputs.publish }}"
-    assert publish_job["environment"] == "staging-smoke-publication"
+    assert "environment" not in publish_job
     assert publish_job["permissions"] == {"contents": "read"}
     assert "Staging smoke publication is restricted to main or release tags" in publish_commands
     assert "scripts/staging_smoke.py" in publish_commands