ceremony-environments

Migration ceremony GitHub environments

Migration workflows are gated by four static GitHub Environments:

Environment	Workflows	Authorization boundary
walrus-memory-migration-governance-mainnet	publish, create caps, burn caps, finalize	Required reviewer before the workflow builds unsigned transaction artifacts
walrus-memory-migration-governance-testnet	same, on Testnet	Required reviewer
walrus-memory-migration-funding-mainnet	fund distribution	Required reviewer before the hot funder key is exposed
walrus-memory-migration-funding-testnet	fund distribution	Required reviewer before the hot funder key is exposed

Each environment must:

1. require harrymove-ctrl as an independent reviewer;
2. prevent self-review;
3. disable administrator bypass; and
4. keep migration/funder secrets environment-scoped rather than repository-scoped.

Configure the environments through the GitHub API. Run the following before every ceremony and after repository administration changes:

Source: migration/ceremony-environments.md

GH_TOKEN="$(gh auth token)" \
  EXPECTED_MIGRATION_REVIEWERS=user:harrymove-ctrl \
  scripts/verify-migration-environments.sh

The scheduled verify-migration-environments workflow performs the same check weekly. It requires the configured reviewer set to match the typed allowlist exactly (user:<login> or team:<slug>); GitHub treats multiple required reviewers as one-of, so any extra reviewer is a failure. A missing environment is also a failure: GitHub otherwise creates a referenced environment on first use without reviewer protection.

Workflow boundaries

• publish-tx, create-migration-caps-tx, burn-cap-tx, and finalize-tx only build unsigned transaction bytes. Signing remains an offline, hardware-wallet, or multisig operation.
• distribute-funds can submit a live transaction because it holds SUI_FUNDER_KEY. It defaults to dry_run: true; paid runs require fresh live-writer evidence and an uploaded prepared journal before submission.
• All ceremony jobs run only from the repository default branch.

Before a live run, attach the verifier output to the operator record and confirm the named reviewer is not the workflow initiator.