From 07843086c21d43fab37c8774d04c82b5d09031e0 Mon Sep 17 00:00:00 2001 From: Lunny Xiao Date: Fri, 14 Aug 2026 12:50:27 -0700 Subject: [PATCH] ci: remove AWS S3 uploads from release workflows (#38928) Release binaries and downloads have been served from Cloudflare R2 for a while now, so the AWS S3 upload is redundant. This removes the `configure aws` and `upload binaries to s3` steps from the nightly, RC and version release workflows. Since `configure-aws-credentials` no longer runs in those jobs, the `AWS_REGION: auto` workaround in the R2 step can be dropped as well. The `AWS_*` secrets for S3 can be removed from the repository settings afterwards. --- .github/workflows/release-nightly.yml | 16 +--------------- .github/workflows/release-tag-rc.yml | 16 +--------------- .github/workflows/release-tag-version.yml | 16 +--------------- 3 files changed, 3 insertions(+), 45 deletions(-) diff --git a/.github/workflows/release-nightly.yml b/.github/workflows/release-nightly.yml index a666ffc435e..e65e255db15 100644 --- a/.github/workflows/release-nightly.yml +++ b/.github/workflows/release-nightly.yml @@ -49,7 +49,7 @@ jobs: cosign sign-blob "$f" --bundle "$f.sigstore.json" --yes echo "$GPG_PASSPHRASE" | gpg --pinentry-mode loopback --passphrase-fd 0 --batch --yes --detach-sign -u "$GPG_FINGERPRINT" --output "$f.asc" "$f" done - # clean branch name to get the folder name in S3 + # clean branch name to get the folder name in the object storage - name: Get cleaned branch name id: clean_name env: @@ -58,25 +58,11 @@ jobs: REF_NAME=$(echo "$REF" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\///' -e 's/release\/v//') echo "Cleaned name is ${REF_NAME}" echo "branch=${REF_NAME}-nightly" >> "$GITHUB_OUTPUT" - - name: configure aws - uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3 - with: - aws-region: ${{ secrets.AWS_REGION }} - aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} - aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} - - name: upload binaries to s3 - env: - AWS_S3_BUCKET: ${{ secrets.AWS_S3_BUCKET }} - BRANCH: ${{ steps.clean_name.outputs.branch }} - run: | - aws s3 sync dist/release "s3://$AWS_S3_BUCKET/gitea/$BRANCH" --no-progress - # configure-aws-credentials exports AWS_REGION job-wide and it wins over AWS_DEFAULT_REGION, so pin it here - name: upload binaries to cloudflare r2 env: AWS_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_ACCESS_KEY_ID }} AWS_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_SECRET_ACCESS_KEY }} AWS_DEFAULT_REGION: auto - AWS_REGION: auto CLOUDFLARE_R2_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_R2_ACCOUNT_ID }} CLOUDFLARE_R2_BUCKET: ${{ secrets.CLOUDFLARE_R2_BUCKET }} BRANCH: ${{ steps.clean_name.outputs.branch }} diff --git a/.github/workflows/release-tag-rc.yml b/.github/workflows/release-tag-rc.yml index c56f9404f59..598d8ff26e6 100644 --- a/.github/workflows/release-tag-rc.yml +++ b/.github/workflows/release-tag-rc.yml @@ -50,7 +50,7 @@ jobs: cosign sign-blob "$f" --bundle "$f.sigstore.json" --yes echo "$GPG_PASSPHRASE" | gpg --pinentry-mode loopback --passphrase-fd 0 --batch --yes --detach-sign -u "$GPG_FINGERPRINT" --output "$f.asc" "$f" done - # clean branch name to get the folder name in S3 + # clean branch name to get the folder name in the object storage - name: Get cleaned branch name id: clean_name env: @@ -59,25 +59,11 @@ jobs: REF_NAME=$(echo "$REF" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\/v//' -e 's/release\/v//') echo "Cleaned name is ${REF_NAME}" echo "branch=${REF_NAME}" >> "$GITHUB_OUTPUT" - - name: configure aws - uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3 - with: - aws-region: ${{ secrets.AWS_REGION }} - aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} - aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} - - name: upload binaries to s3 - env: - AWS_S3_BUCKET: ${{ secrets.AWS_S3_BUCKET }} - BRANCH: ${{ steps.clean_name.outputs.branch }} - run: | - aws s3 sync dist/release "s3://$AWS_S3_BUCKET/gitea/$BRANCH" --no-progress - # configure-aws-credentials exports AWS_REGION job-wide and it wins over AWS_DEFAULT_REGION, so pin it here - name: upload binaries to cloudflare r2 env: AWS_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_ACCESS_KEY_ID }} AWS_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_SECRET_ACCESS_KEY }} AWS_DEFAULT_REGION: auto - AWS_REGION: auto CLOUDFLARE_R2_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_R2_ACCOUNT_ID }} CLOUDFLARE_R2_BUCKET: ${{ secrets.CLOUDFLARE_R2_BUCKET }} BRANCH: ${{ steps.clean_name.outputs.branch }} diff --git a/.github/workflows/release-tag-version.yml b/.github/workflows/release-tag-version.yml index 003fedd6c4b..e6479fa8272 100644 --- a/.github/workflows/release-tag-version.yml +++ b/.github/workflows/release-tag-version.yml @@ -53,7 +53,7 @@ jobs: cosign sign-blob "$f" --bundle "$f.sigstore.json" --yes echo "$GPG_PASSPHRASE" | gpg --pinentry-mode loopback --passphrase-fd 0 --batch --yes --detach-sign -u "$GPG_FINGERPRINT" --output "$f.asc" "$f" done - # clean branch name to get the folder name in S3 + # clean branch name to get the folder name in the object storage - name: Get cleaned branch name id: clean_name env: @@ -62,25 +62,11 @@ jobs: REF_NAME=$(echo "$REF" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\/v//' -e 's/release\/v//') echo "Cleaned name is ${REF_NAME}" echo "branch=${REF_NAME}" >> "$GITHUB_OUTPUT" - - name: configure aws - uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3 - with: - aws-region: ${{ secrets.AWS_REGION }} - aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} - aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} - - name: upload binaries to s3 - env: - AWS_S3_BUCKET: ${{ secrets.AWS_S3_BUCKET }} - BRANCH: ${{ steps.clean_name.outputs.branch }} - run: | - aws s3 sync dist/release "s3://$AWS_S3_BUCKET/gitea/$BRANCH" --no-progress - # configure-aws-credentials exports AWS_REGION job-wide and it wins over AWS_DEFAULT_REGION, so pin it here - name: upload binaries to cloudflare r2 env: AWS_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_ACCESS_KEY_ID }} AWS_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_SECRET_ACCESS_KEY }} AWS_DEFAULT_REGION: auto - AWS_REGION: auto CLOUDFLARE_R2_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_R2_ACCOUNT_ID }} CLOUDFLARE_R2_BUCKET: ${{ secrets.CLOUDFLARE_R2_BUCKET }} BRANCH: ${{ steps.clean_name.outputs.branch }}