From 31183233008f95c5dfa3e7cb0fb9a1903d62bb6c Mon Sep 17 00:00:00 2001 From: Harshit Singh Bhandari Date: Sat, 4 Jul 2026 04:15:23 +0530 Subject: [PATCH] docs(release): clarify that the approval gate, not the tag push, controls who can cut a release Co-Authored-By: Claude Fable 5 --- frontend/docs/desktop-release.md | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/frontend/docs/desktop-release.md b/frontend/docs/desktop-release.md index 987baa9e0..b405788db 100644 --- a/frontend/docs/desktop-release.md +++ b/frontend/docs/desktop-release.md @@ -135,8 +135,12 @@ Approval is governed by required reviewers on the `release` environment - @Vaibhaav-Tiwari - @Priyanchew -Self-review is allowed (the tag pusher may approve their own run) and repo -admins can bypass. The current list is readable by anyone with repo access: +Anyone with write access can push the `desktop-v*` tag, but the build jobs +stay in `waiting` until one of the approvers above approves the run, so only +they can actually cut a release through the workflow. Self-review is allowed, +meaning a tag pusher who is also an approver may approve their own run; a +pusher who is not an approver still needs one of the five. Repo admins can +bypass the gate. The current list is readable by anyone with repo access: ```bash gh api repos/AgentWrapper/agent-orchestrator/environments/release \