From cc5e7fd7da7557c1dc29c8d4fb7ee4a3eb02e11b Mon Sep 17 00:00:00 2001
From: Pigbibi <20649888+Pigbibi@users.noreply.github.com>
Date: Thu, 5 Nov 2026 13:30:35 +0800
Subject: [PATCH 1/2] ci: Bind session renewal workflows to protected
 environment

---
 .github/workflows/ft-session-renew-verify.yml | 1 +
 .github/workflows/invoke-cloud-run.yml        | 1 +
 2 files changed, 2 insertions(+)

diff --git a/.github/workflows/ft-session-renew-verify.yml b/.github/workflows/ft-session-renew-verify.yml
index 9a81322..0375a7b 100644
--- a/.github/workflows/ft-session-renew-verify.yml
+++ b/.github/workflows/ft-session-renew-verify.yml
@@ -19,6 +19,7 @@ jobs:
   verify:
     name: Read probe logs and session-cache metadata
     runs-on: ubuntu-latest
+    environment: PROJECT_ID
     timeout-minutes: 10
     permissions:
       contents: read
diff --git a/.github/workflows/invoke-cloud-run.yml b/.github/workflows/invoke-cloud-run.yml
index b584334..b9e8f11 100644
--- a/.github/workflows/invoke-cloud-run.yml
+++ b/.github/workflows/invoke-cloud-run.yml
@@ -43,6 +43,7 @@ jobs:
   invoke:
     name: Invoke Firstrade Cloud Run
     runs-on: ubuntu-latest
+    environment: PROJECT_ID
     timeout-minutes: 15
     permissions:
       contents: read

From 5be66fb3452f8d55e5b727bd67a2f1e0cbd500c6 Mon Sep 17 00:00:00 2001
From: Pigbibi <20649888+Pigbibi@users.noreply.github.com>
Date: Thu, 5 Nov 2026 20:35:01 +0800
Subject: [PATCH 2/2] fix: Resolve Firstrade workflow environment from
 repository variable

---
 .github/workflows/ft-session-renew-verify.yml | 2 +-
 .github/workflows/invoke-cloud-run.yml        | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ft-session-renew-verify.yml b/.github/workflows/ft-session-renew-verify.yml
index 0375a7b..557b4fd 100644
--- a/.github/workflows/ft-session-renew-verify.yml
+++ b/.github/workflows/ft-session-renew-verify.yml
@@ -19,7 +19,7 @@ jobs:
   verify:
     name: Read probe logs and session-cache metadata
     runs-on: ubuntu-latest
-    environment: PROJECT_ID
+    environment: ${{ vars.FIRSTRADE_STEP5_ENVIRONMENT }}
     timeout-minutes: 10
     permissions:
       contents: read
diff --git a/.github/workflows/invoke-cloud-run.yml b/.github/workflows/invoke-cloud-run.yml
index b9e8f11..0df5e71 100644
--- a/.github/workflows/invoke-cloud-run.yml
+++ b/.github/workflows/invoke-cloud-run.yml
@@ -43,7 +43,7 @@ jobs:
   invoke:
     name: Invoke Firstrade Cloud Run
     runs-on: ubuntu-latest
-    environment: PROJECT_ID
+    environment: ${{ vars.FIRSTRADE_STEP5_ENVIRONMENT }}
     timeout-minutes: 15
     permissions:
       contents: read