From cb58fab7049a1b9a49012f48972c537625309ed7 Mon Sep 17 00:00:00 2001
From: Tim Hess <thess@vmware.com>
Date: Wed, 7 Feb 2024 13:52:33 -0600
Subject: [PATCH] set concurrency, token perms, env name

---
 .github/workflows/build-and-stage.yml | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build-and-stage.yml b/.github/workflows/build-and-stage.yml
index 58ef32b..6eb8af7 100644
--- a/.github/workflows/build-and-stage.yml
+++ b/.github/workflows/build-and-stage.yml
@@ -10,6 +10,14 @@ env:
   DOTNET_CLI_TELEMETRY_OPTOUT: 1
   DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true
   DOTNET_VERSION: '8.0'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build and publish app
@@ -51,7 +59,7 @@ jobs:
       run: dotnet publish src/NetCoreToolService/Steeltoe.NetCoreToolService.csproj -o publish
 
     - name: Upload artifact for deployment job
-      if: github.event_name != 'PullRequest'
+      if: ${{ github.event_name != 'PullRequest' }}
       uses: actions/upload-artifact@v4
       with:
         name: published-app
@@ -59,10 +67,11 @@ jobs:
 
   deploy:
     name: Deploy
+    environment: production
     needs:
     - build
     runs-on: ubuntu-latest
-    if: github.event_name != 'PullRequest'
+    if: ${{ github.event_name != 'PullRequest' }}
     steps:
     - name: Download artifact from build job
       uses: actions/download-artifact@v4