From cddfd4165465b7492c2ee7c910494c712b085973 Mon Sep 17 00:00:00 2001
From: nutcas3 <mauricee423@gmail.com>
Date: Tue, 21 Apr 2026 11:05:44 +0300
Subject: [PATCH] feat: Add production environment configuration with
 protection rules, approvals, and deployment restrictions

- Add production.yml with environment name/URL and protection rules configuration
- Add required_reviewers (cto/head-of-operations/security-lead) and prevent_force_pushes setting
- Add required_status_checks with strict mode for build-and-push/test-suite/security-scan/performance-tests contexts
- Add deployment_restrictions limiting deployments to specific users (cto/head-of-operations/devops-lead) and platform
---
 .github/environments/production.yml | 53 +++++++++++++++++++++++++++++
 1 file changed, 53 insertions(+)
 create mode 100644 .github/environments/production.yml

diff --git a/.github/environments/production.yml b/.github/environments/production.yml
new file mode 100644
index 0000000..5917658
--- /dev/null
+++ b/.github/environments/production.yml
@@ -0,0 +1,53 @@
+# Production Environment Configuration
+name: production
+url: https://telecom-platform.com
+
+# Environment protection rules
+protection_rules:
+  # Require approval from production team
+  required_reviewers:
+    - cto
+    - head-of-operations
+    - security-lead
+  
+  # Prevent force pushes
+  prevent_force_pushes: true
+  
+  # Require status checks
+  required_status_checks:
+    strict: true
+    contexts:
+      - build-and-push
+      - test-suite
+      - security-scan
+      - performance-tests
+  
+  # Require branches to be up to date
+  require_branch_up_to_date: true
+  
+  # Limit who can deploy
+  deployment_restrictions:
+    users:
+      - cto
+      - head-of-operations
+      - devops-lead
+    teams:
+      - platform-engineers
+
+# Environment variables
+environment_variables:
+  API_BASE_URL: https://api.telecom-platform.com
+  DATABASE_URL: postgresql://prod-user:prod-pass@prod-db.internal:5432/telecom_prod
+  REDIS_URL: redis://prod-redis.internal:6379
+  LOG_LEVEL: warn
+  ENVIRONMENT: production
+
+# Secrets (configured in GitHub repository settings)
+# These are referenced but not stored in the file
+secrets:
+  - PROD_DB_PASSWORD
+  - PROD_API_KEY
+  - PROD_JWT_SECRET
+  - KUBECONFIG_PRODUCTION
+  - SSL_CERTIFICATE
+  - SSL_PRIVATE_KEY