Check job environment scope when only reusable CI loses auth

When a GitHub Actions parent job authenticates successfully but a reusable release job fails against the same Supabase API, compare their selected GitHub environments before rotating credentials. Identical secret names do not prove identical resolved values: an environment override may exist for one job while another falls back to a repository secret. Align the release job with the intended credential boundary, retain its branch protections, and verify required non-database credentials before deployment. This diagnosis requires evidence from both jobs; an authentication error alone does not establish a scope mismatch.

Applies when: reusable release jobs and their parent validations select different GitHub environments. Keywords: GitHub Actions reusable workflow environment secrets Supabase PAT authentication