update environment secrets

.github/workflows/check-action-file.yaml

@@ -16,6 +16,7 @@ jobs:
     name: Validate GitHub Actions workflows
     permissions:
       contents: read
+    environment: ci
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4

.github/workflows/ci.yaml

@@ -22,6 +22,7 @@ on:
 
 jobs:
   ut-linux-x86:
+    environment: ci
     runs-on: ubuntu-22.04
     name: UT Test on Ubuntu/x86
     steps:
@@ -92,6 +93,7 @@ jobs:
   ut-mac-x86:
     #if: ${{ !github.event.pull_request.draft }}
     if: ${{ false }}
+    environment: ci
     runs-on: macos-12
     name: UT Test on Darwin/x86
 
@@ -126,6 +128,7 @@ jobs:
           find scratch -name "**-UT-Count.out" -exec cat {} \;
 
   sca:
+    environment: ci
     runs-on: ubuntu-22.04
     name: SCA Test on Ubuntu/x86
     steps:

.github/workflows/e2e-compose.yaml

@@ -6,6 +6,7 @@ on:
 jobs:
   bvt-docker-compose-push:
     if: ${{ !github.event.pull_request.draft }}
+    environment: ci
     runs-on: ubuntu-22.04
     name: multi cn e2e bvt test docker compose(Optimistic/PUSH)
     timeout-minutes: 60
@@ -110,6 +111,7 @@ jobs:
 
   multi-CN-bvt-docker-compose-pessimistic:
     if: ${{ !github.event.pull_request.draft }}
+    environment: ci
     runs-on: ubuntu-22.04
     name: multi cn e2e bvt test docker compose(PESSIMISTIC)
     timeout-minutes: 60

.github/workflows/e2e-standalone.yaml

@@ -6,6 +6,7 @@ on:
 jobs:
   bvt-linux-x86:
     if: ${{ !github.event.pull_request.draft }}
+    environment: ci
     runs-on: ubuntu-22.04
     name: e2e BVT Test on Linux/x64(LAUNCH,Optimistic)
     timeout-minutes: 90

.github/workflows/e2e-upgrade.yaml

@@ -14,6 +14,7 @@ env:
 
 jobs:
   upgrade-ci-target-linux-amd64:
+    environment: ci
     runs-on: ubuntu-22.04
     name: Compatibility Test With Target on Linux/x64(LAUNCH)
     timeout-minutes: 60
@@ -168,6 +169,7 @@ jobs:
 
   upgrade-ci-release-linux-amd64:
     if: ${{ github.event_name == '' }}
+    environment: ci
     runs-on: ubuntu-22.04
     name: Compatibility Test With Release on Linux/x64(LAUNCH)
     timeout-minutes: 60

.github/workflows/image-build.yaml

@@ -41,6 +41,7 @@ permissions:
 
 jobs:
   dockerhub:
+    environment: ci
     runs-on: ubuntu-22.04
 
     steps:

.github/workflows/merge-trigger-standalone.yaml

@@ -10,6 +10,7 @@ on:
 jobs:
   pessimistic-bvt-darwin-arm64:
     if: ${{ github.event.pull_request.merged == true }}
+    environment: ci
     runs-on: mac-arm64-mini
     name: e2e BVT Test on Darwin/ARM64(LAUNCH, PESSIMISTIC)
     timeout-minutes: 120
@@ -110,6 +111,7 @@ jobs:
 
   multi-cn-bvt-race-linux-x86:
     if: ${{ github.event.pull_request.merged == true && always() }}
+    environment: ci
     runs-on: amd64-mo-guangzhou-2xlarge32
     needs: [pessimistic-bvt-darwin-arm64]
     name: Multi-CN e2e BVT(Race) Test on Linux/x64

.github/workflows/merge-trigger-tke.yaml

@@ -25,6 +25,7 @@ on:
 
 jobs:
   docker_image_build:
+    environment: ci
     runs-on: amd64-mo-shanghai-dind
     if: ${{ github.event.pull_request.merged == true }}
     timeout-minutes: 30
@@ -69,6 +70,7 @@ jobs:
   setup_mo_test_env:
     if: ${{ always() && !cancelled() && needs.docker_image_build.result == 'success' }}
     needs: docker_image_build
+    environment: ci
     runs-on: amd64-mo-guangzhou-medium8
     timeout-minutes: 40
     name: SETUP MO TEST ENV
@@ -222,6 +224,7 @@ jobs:
   bvt_test:
     if: ${{ always() && !cancelled() && needs.setup_mo_test_env.result == 'success' }}
     name: MO CHECKIN BVT TEST
+    environment: ci
     runs-on: amd64-mo-guangzhou-medium8
     needs: [setup_mo_test_env,docker_image_build]
     steps:
@@ -274,6 +277,7 @@ jobs:
   ssb_and_tpch_test:
     if: ${{ always() && !cancelled() && needs.setup_mo_test_env.result == 'success' }}
     name: MO CHECKIN SSB AND TPCH TEST
+    environment: ci
     runs-on: amd64-mo-guangzhou-2xlarge16
     needs: [setup_mo_test_env,bvt_test]
     steps:
@@ -495,6 +499,7 @@ jobs:
   sysbench_test:
     if: ${{ always() && !cancelled() && needs.setup_mo_test_env.result == 'success' }}
     name: SYSBENCH TEST
+    environment: ci
     runs-on: amd64-mo-guangzhou-2xlarge16
     needs: [setup_mo_test_env,bvt_test]
     steps:
@@ -614,6 +619,7 @@ jobs:
   tpcc_test:
     if: ${{ always() && !cancelled() && needs.setup_mo_test_env.result == 'success'}}
     name: TPCC TEST
+    environment: ci
     runs-on: amd64-mo-guangzhou-2xlarge16
     needs: [setup_mo_test_env,bvt_test]
     steps:
@@ -757,6 +763,7 @@ jobs:
   clean_up_env:
     if: ${{ always() && github.event.pull_request.merged == true }}
     name: CLEAN ENV AND NOTICE
+    environment: ci
     runs-on: amd64-mo-guangzhou-medium8
     needs: [docker_image_build,setup_mo_test_env,bvt_test,ssb_and_tpch_test,sysbench_test,tpcc_test]
     steps:

.github/workflows/release.yaml

@@ -30,6 +30,7 @@ on:
 
 jobs:
   linux-amd64-build-job:
+    environment: ci
     runs-on: ubuntu-20.04
     steps:
       - name: Checkout source
@@ -99,6 +100,7 @@ jobs:
           echo "check in [ J_0. Set variables ]->[ Step_99. Display and output actual variables ] to see if the binary file url is correct"
 
   linux-arm64-build-job:
+    environment: ci
     runs-on: aws-arm64-runner
     steps:
       - name: Checkout source
@@ -160,6 +162,7 @@ jobs:
 
 
   darwin-x86-build-job:
+    environment: ci
     runs-on: macos-latest
     steps:
       # GitHub Hosted MacOS runner cannot connect to time.apple.com, so use time.windows.com
@@ -278,6 +281,7 @@ jobs:
 
   #if the release for darwin-arm is failed, please contact guguducken to check runner status
   darwin-arm-build-job:
+    environment: ci
     runs-on: mac-arm64-mini
     steps:
       - name: Sync system time
@@ -389,6 +393,7 @@ jobs:
           security find-identity -p codesigning | grep ID | awk 'NR=1{system("security delete-identity -Z "$2)}'
 
   musl-x86-build-job:
+    environment: ci
     runs-on: ubuntu-20.04
     steps:
       - name: Checkout source
@@ -457,6 +462,7 @@ jobs:
           echo "check in [ J_0. Set variables ]->[ Step_99. Display and output actual variables ] to see if the binary file url is correct"
 
   musl-arm64-build-job:
+    environment: ci
     runs-on: aws-arm64-runner
     steps:
       - name: Checkout source

.github/workflows/robot.yaml

@@ -18,6 +18,7 @@ on:
 jobs:
   issue-notify:
     if: github.event_name == 'issues' && github.event.action == 'assigned'
+    environment: ci
     runs-on: ubuntu-22.04
     steps:
       - name: ISSUE Triggered
@@ -31,6 +32,7 @@ jobs:
 
   add-projects-milestone:
     if: github.event_name == 'issues' && github.event.action == 'opened'
+    environment: ci
     runs-on: ubuntu-22.04
     steps:
       - name: Issue Add  Milestone
@@ -42,6 +44,7 @@ jobs:
 
   check-bvt-issue:
     if: github.event_name == 'issues' && github.event.action == 'closed'
+    environment: ci
     runs-on: ubuntu-22.04
     steps:
       - name: CheckOut
@@ -78,6 +81,7 @@ jobs:
             Hello @${{ github.event.issue.user.login }}. The bug issue in the BVT test code has not been removed,issues automatically open.
 
   issue-reopen:
+    environment: ci
     runs-on: ubuntu-22.04
     if: github.event_name == 'issues' && github.event.action == 'closed'
     steps:
@@ -90,6 +94,7 @@ jobs:
           issue-number: ${{ github.event.issue.number }}
 
   issue_close_check:
+    environment: ci
     runs-on: ubuntu-22.04
     if: github.event_name == 'issues' && github.event.action == 'closed'
     steps:
@@ -101,6 +106,7 @@ jobs:
           mentions: "Prinz,DengNan"
 
   add-issue-to-project:
+    environment: ci
     runs-on: ubuntu-22.04
     if: github.event_name == 'issues' && github.event.action == 'assigned'
     steps:
@@ -119,7 +125,8 @@ jobs:
 
   nightly-check:
     if: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
-    runs-on: amd64-mo-shanghai-4xlarge32
+    environment: ci
+    runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
         with:
@@ -288,6 +295,7 @@ jobs:
           content: ${{ env.Detail }}
 
   issue-rm-labels:
+    environment: ci
     runs-on: ubuntu-latest
     if: ${{ github.event_name == 'issues' && github.event.action == 'assigned' }}
     steps:
@@ -305,6 +313,7 @@ jobs:
           blacklist: 'matrix-meow'  #黑名单形如: user1,user2,...
 
   reopen-without-PR:
+    environment: ci
     runs-on: ubuntu-latest
     if: ${{ github.event_name == 'issues' && github.event.action == 'closed' && github.actor != 'sukki37' }}
     steps:

.github/workflows/utils.yaml

@@ -31,6 +31,7 @@ on:
 
 jobs:
   check_organization_user:
+    environment: ci
     runs-on: ubuntu-22.04
     outputs:
       in_org: ${{ steps.check_in_org.outputs.in_org }}
@@ -79,7 +80,8 @@ jobs:
     if: ${{ needs.check_organization_user.outputs.safe_label == '1' || needs.check_organization_user.outputs.in_org == '1' }}
     name: PR Unit and BVT Test Coverage
     needs: [check_organization_user]
-    runs-on: amd64-mo-guangzhou-2xlarge16
+    environment: ci
+    runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
         with:
@@ -257,6 +259,7 @@ jobs:
           retention-days: 7
 
   pr-size-label:
+    environment: ci
     runs-on: ubuntu-22.04
     needs: [check_organization_user]
     steps:
@@ -276,6 +279,7 @@ jobs:
             }
 
   docu_issue_check:
+    environment: ci
     runs-on: ubuntu-22.04
     needs: [check_organization_user]
     if: ${{ github.event.action == 'opened' }}