[Security] publish.yml workflow allows manual dispatch without environment protection

[cocallaw]

Summary

The publish.yml workflow has a workflow_dispatch trigger with no GitHub Environment gate or approval requirement. Anyone with write access can manually trigger a publish to PowerShell Gallery at any time, bypassing the tag-based release flow.

Impact

Accidental or unauthorized module publication to PSGallery.

Location

• .github/workflows/publish.yml — workflow_dispatch trigger

Suggested fix

Add a GitHub Environment (e.g., production) with required reviewers to the publish job:

jobs:
  publish:
    runs-on: ubuntu-latest
    environment: production   # Requires approval before running
    steps:
      # ...