From 65250a9896ad51cbb54010938464a71753af9287 Mon Sep 17 00:00:00 2001
From: JohnBraham <22159126+SkyBlade1978@users.noreply.github.com>
Date: Wed, 2 Sep 2026 15:44:10 +0100
Subject: [PATCH 1/2] Align release dispatcher with organisation secrets

---
 .github/workflows/deploy-release.yml                     | 2 --
 docs/REPOSITORY.md                                       | 9 ++++-----
 .../moddev/mc/skysgrassslabs/ProjectContractTest.java    | 6 +++++-
 3 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/deploy-release.yml b/.github/workflows/deploy-release.yml
index 3c2ab54..1d13f67 100644
--- a/.github/workflows/deploy-release.yml
+++ b/.github/workflows/deploy-release.yml
@@ -340,8 +340,6 @@ jobs:
       - build
     runs-on: ubuntu-latest
     timeout-minutes: 10
-    environment:
-      name: release
     steps:
       - name: Confirm publication and release-secret access
         env:
diff --git a/docs/REPOSITORY.md b/docs/REPOSITORY.md
index 5cbc62d..5fdfb65 100644
--- a/docs/REPOSITORY.md
+++ b/docs/REPOSITORY.md
@@ -60,12 +60,11 @@ the Gradle wrapper and run CodeQL.
 The manual release dispatcher lives on `master-1.18.2` so GitHub can route a
 four-component version to its matching version/loader branch. It checks the
 branch metadata and successful audited CI result, builds one immutable bundle,
-then requires both the exact live-publication confirmation and approval of the
-`release` environment. Only that bundle may be sent to Maven, CurseForge
-project `1677588`, and the GitHub release. GitHub publication runs last.
+then requires the exact live publication confirmation. Only that bundle may be
+sent to Maven, CurseForge project `1677588`, and the GitHub release. GitHub
+publication runs last.
 
-MMD administrators must expose the existing organisation Maven and CurseForge
-secrets and configure the protected `release` environment for this repository.
+The dispatcher uses the existing organisation Maven and CurseForge secrets.
 No secret belongs in source control.
 
 ## Commits and local context
diff --git a/src/test/java/zone/moddev/mc/skysgrassslabs/ProjectContractTest.java b/src/test/java/zone/moddev/mc/skysgrassslabs/ProjectContractTest.java
index fb0540b..3415647 100644
--- a/src/test/java/zone/moddev/mc/skysgrassslabs/ProjectContractTest.java
+++ b/src/test/java/zone/moddev/mc/skysgrassslabs/ProjectContractTest.java
@@ -54,7 +54,11 @@ public void releaseDispatcherIsExplicitAndUsesTheImmutableBundle() throws Except
         assertTrue(properties.contains("loader_code=1"));
         assertTrue(properties.contains("curseforge_project_id=1677588"));
         assertTrue(workflow.contains("confirm_live_publication:"));
-        assertTrue(workflow.contains("name: release"));
+        assertFalse(workflow.contains("    environment:\n      name: release"));
+        assertTrue(workflow.contains("CURSEFORGE_TOKEN: ${{ secrets.CURSEFORGE_TOKEN }}"));
+        assertTrue(workflow.contains("MAVEN_UPLOAD_URL: ${{ secrets.MAVEN_UPLOAD_URL }}"));
+        assertTrue(workflow.contains("MAVEN_UPLOAD_USERNAME: ${{ secrets.MAVEN_UPLOAD_USERNAME }}"));
+        assertTrue(workflow.contains("MAVEN_UPLOAD_PASSWORD: ${{ secrets.MAVEN_UPLOAD_PASSWORD }}"));
         assertTrue(workflow.contains("-PpreparedReleaseDir="));
         assertTrue(workflow.contains("MinecraftModDevelopmentMods/SkysGrassSlabs"));
         assertTrue(workflow.indexOf("  publish_maven:") <

From c40d09ca94d2805e62ef5927e4479e4f10c37b0c Mon Sep 17 00:00:00 2001
From: JohnBraham <22159126+SkyBlade1978@users.noreply.github.com>
Date: Wed, 2 Sep 2026 15:54:43 +0100
Subject: [PATCH 2/2] Ensure CodeQL compiles production sources

---
 .github/workflows/codeql-analysis.yml                      | 2 +-
 .../zone/moddev/mc/skysgrassslabs/ProjectContractTest.java | 7 +++++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index ab3c857..df7723d 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -42,7 +42,7 @@ jobs:
       - name: Compile production code
         run: |
           chmod +x ./gradlew
-          ./gradlew clean classes --no-daemon --stacktrace
+          ./gradlew clean classes --rerun-tasks --no-daemon --stacktrace
 
       - name: Analyze
         uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4
diff --git a/src/test/java/zone/moddev/mc/skysgrassslabs/ProjectContractTest.java b/src/test/java/zone/moddev/mc/skysgrassslabs/ProjectContractTest.java
index 3415647..ead0e05 100644
--- a/src/test/java/zone/moddev/mc/skysgrassslabs/ProjectContractTest.java
+++ b/src/test/java/zone/moddev/mc/skysgrassslabs/ProjectContractTest.java
@@ -68,6 +68,13 @@ public void releaseDispatcherIsExplicitAndUsesTheImmutableBundle() throws Except
         assertTrue(build.contains("if (preparedReleaseDir.isPresent())"));
     }
 
+    @Test
+    public void codeQlCannotReuseCachedCompilationOutput() throws Exception {
+        String workflow = Files.readString(
+                Path.of(".github/workflows/codeql-analysis.yml"), StandardCharsets.UTF_8);
+        assertTrue(workflow.contains("clean classes --rerun-tasks --no-daemon"));
+    }
+
 
     @Test
     public void commonConfigAndWorldStateUsePermanentKeys() throws Exception {