The way this works is
1. `release-gate` is an environment which requires approval from another
person in the organization
2. Once approved, the release can continue
3. GitHub then requires approval for every subsequent job, which we use
the `release` environment for
4. We do not require team members to approve on the `release`
environment because we run _many_ child jobs during releases
5. The `release` environment uses a deployment protection rule which
queries a GitHub App we manage
6. The GitHub App checks if the `release-gate` job was successful in the
same workflow and approves or denies accordingly
The GitHub App's source is at
https://github.com/open-security-tools/ost-environment-gate and includes
another explanation of what's going on in this process.
We don't make the release-gate block everything, so builds can start at
least while we wait for the release-gate to be approved.
Zanie Blue
6b1ebc33dc