CI: Protect manual package publishing workflows

.github/workflows/packages_publishing.yml

@@ -15,14 +15,42 @@ on:
         type: string
         description: Package file filter pattern
         required: false
+  workflow_call:
+    inputs:
+      tag:
+        type: string
+        default: daily
+        required: false
+      filter:
+        type: string
+        default: ''
+        required: false
+      branch:
+        type: string
+        default: ''
+        required: false
+
+permissions:
+  contents: read
+  packages: write
 
 env:
   NX_SKIP_NX_CACHE: true
-  FILTER: ${{ github.event_name == 'workflow_dispatch' && inputs.filter || '' }}
+  FILTER: ${{ inputs.filter || '' }}
   SET_TIMESTAMP_VERSION:  ${{ inputs.tag == 'daily' }}
   SBOM_PACKAGE_NAMES: devextreme,devextreme-angular,devextreme-react,devextreme-vue,devextreme-themebuilder
 
 jobs:
+  approve-package-publishing:
+    name: Approve package publishing
+    needs: build
+    if: ${{ inputs.tag == 'stable' || (github.event_name == 'workflow_dispatch' && !contains(github.workflow_ref, '/.github/workflows/packages_publishing_scheduler.yml@')) }}
+    runs-on: ubuntu-latest
+    environment: packages-publishing
+    steps:
+      - name: Approve publishing
+        run: echo "Package publishing approved"
+
   build:
     name: Build packages
     runs-on: ubuntu-latest
@@ -31,6 +59,8 @@ jobs:
     steps:
       - name: Get sources
         uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.branch || github.ref }}
 
       - name: Set up nodejs
         uses: actions/setup-node@v6
@@ -145,14 +175,17 @@ jobs:
   publish:
     name: Publish package
     runs-on: ubuntu-slim
-    needs: build
+    needs: [build, approve-package-publishing]
+    if: ${{ always() && !cancelled() && needs.build.result == 'success' && (needs.approve-package-publishing.result == 'success' || needs.approve-package-publishing.result == 'skipped') }}
     strategy:
       fail-fast: false
       matrix:
         package: ${{ fromJSON(needs.build.outputs.packages) }}
     steps:
       - name: Get sources
         uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.branch || github.ref }}
 
       - name: Download packages
         uses: actions/download-artifact@v8

.github/workflows/packages_publishing_scheduler.yml

@@ -5,24 +5,29 @@ on:
     - cron: '00 18 * * *'
   workflow_dispatch:
 
+permissions:
+  contents: read
+  packages: write
+
 jobs:
-  publish:
+  approve-manual-scheduler:
+    name: Approve manual publishing scheduler run
+    if: ${{ github.event_name == 'workflow_dispatch' }}
     runs-on: ubuntu-latest
-    env:
-      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    environment: packages-publishing
+    steps:
+      - name: Approve scheduler run
+        run: echo "Manual package publishing scheduler run approved"
+
+  publish:
+    needs: approve-manual-scheduler
+    if: ${{ always() && !cancelled() && (github.event_name != 'workflow_dispatch' || needs.approve-manual-scheduler.result == 'success') }}
     strategy:
       matrix:
         branch: ['24_2', '25_1', '25_2', '26_1', 'main']
-
     name: Run Packages Publishing workflow
-    steps:
-      - name: Get sources
-        uses: actions/checkout@v6
-        with:
-          sparse-checkout: |
-            README.md
-          sparse-checkout-cone-mode: false
-
-      - name: Publish Packages (${{ matrix.branch }})
-        run: |
-          gh workflow run packages_publishing.yml -f tag=daily --ref ${{ matrix.branch }}          
+    uses: ./.github/workflows/packages_publishing.yml
+    with:
+      tag: daily
+      branch: ${{ matrix.branch }}
+    secrets: inherit

.github/workflows/pr-storybook-cleanup.yml

@@ -9,10 +9,21 @@ permissions:
   contents: write
 
 jobs:
+  approve-manual-cleanup:
+    name: Approve manual storybook cleanup
+    if: ${{ github.event_name == 'workflow_dispatch' }}
+    runs-on: ubuntu-latest
+    environment: storybook-cleanup
+    steps:
+      - name: Approve cleanup
+        run: echo "Manual storybook cleanup approved"
+
   cleanup:
     name: Delete stale PR storybook folders
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    needs: approve-manual-cleanup
+    if: ${{ always() && !cancelled() && (github.event_name != 'workflow_dispatch' || needs.approve-manual-cleanup.result == 'success') }}
 
     steps:
       - name: Checkout gh-pages (full history)

.github/workflows/pr-storybook-deploy.yml

@@ -136,6 +136,9 @@ jobs:
     name: Remove storybook
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    environment:
+      name: storybook
+      url: https://devexpress.github.io/DevExtreme/storybook/pr-${{ github.event.pull_request.number }}
     if: >-
       github.event.pull_request.head.repo.full_name == github.repository &&
       (

.github/workflows/publish-demos.yml

@@ -3,6 +3,9 @@ name: Publishing to GitHub Pages step 1 (to branch)
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build-devextreme-all:
     runs-on: ubuntu-latest
@@ -276,6 +279,9 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     needs: [build-devextreme-all, publish-ES, publish-angular]
+    permissions:
+      contents: write
+    environment: gh-pages-demos
     steps: 
       - name: Download publish-demos artifact
         uses: actions/download-artifact@v8