These workflows name an environment:: Deploy configuration site to Bunny, Rebuild and publish IDFM catalog, Roll back Bunny configuration site. Jobs declaring one DO receive that environment's secrets (they override same-named repository secrets), but rickub does not enforce environment protection rules: required reviewers, wait timers and deployment branches do not gate anything, so those jobs run without approval. To gate a deploy, use the secret-presence pattern in the migration guide.