From 61b8536e4a3e04d9db74b05b4d9cd489d07d8d50 Mon Sep 17 00:00:00 2001 From: Lunny Xiao Date: Sun, 26 Jul 2026 03:21:03 +0000 Subject: [PATCH] ci(goreleaser): mirror release artifacts to Cloudflare R2 (#1063) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Ports the Cloudflare R2 release mirror from [gitea.com/gitea/runner](https://gitea.com/gitea/runner) to `tea`, so release artifacts land in R2 alongside S3 for the duration of the migration away from S3. Two commits, meant to be reviewed in order. ## 1. `ci(goreleaser): migrate release config to goreleaser v2` A purely mechanical migration, no behaviour change intended: - add `version: 2` - `blobs.folder` -> `blobs.directory` - `snapshot.name_template` -> `snapshot.version_template` - `nightly.name_template` -> `nightly.version_template` - `version: "~> v1"` -> `"~> v2"` in both release workflows This is a prefactor rather than scope creep. Under goreleaser v1 the custom-publisher pipe runs *4th*, before the `release` pipe; under v2 it runs *last*. That ordering difference matters for the change below: on v1 a failed R2 upload would abort the publish after every artifact had already gone to S3 but **before** the Gitea release was created, leaving a half-finished release. On v2 the R2 mirror runs after the release exists, which matches the behaviour the runner repo already has in production. The pre-existing `archives.format` deprecation warning is deliberately left alone; it is orthogonal to this change and the runner repo has not addressed it either. ## 2. `ci(goreleaser): mirror release artifacts to Cloudflare R2` - **`scripts/upload-r2.sh`** — uploads one local file to one R2 object key using curl's built-in AWS SigV4 signer (R2 is S3-API compatible). Credentials are fed through `curl --config -` so they never appear in `ps` output. Also provides a `--check-config` preflight mode. This file is byte-identical to the runner repo's copy. - **`.goreleaser.yaml`** — a `publishers:` entry mirroring the existing S3 `blobs:` upload into R2. A second `blobs:` entry is not usable here: the blob pipe authenticates from the global `AWS_*` environment and has no per-entry credentials, whereas `publishers:` supports per-entry `env:`. - **Both release workflows** — forward the R2 secrets, plus an early `check R2 configuration` step. Custom publishers run as the very last step of goreleaser's publish pipeline, so without a preflight a missing secret would only surface after the release had been created and every artifact already uploaded to S3. ### Deviation from the runner implementation The publisher here also sets `signature: true` in addition to `checksum: true`. `tea` has a `signs:` block that GPG-signs the checksum file, and the S3 blob pipe uploads the resulting `checksums.txt.sig`; without `signature: true` the R2 mirror would carry the artifacts and their checksums but no signature to verify them against. The object key prefix is `tea/{{ .Version }}/...`, matching the existing S3 `directory: "tea/{{.Version}}"`. ## Required repository secrets This PR is inert until these are configured. The preflight step will fail the release loudly if they are missing: - `R2_ENDPOINT` — e.g. `https://.r2.cloudflarestorage.com` - `R2_BUCKET` - `R2_ACCESS_KEY_ID` - `R2_SECRET_ACCESS_KEY` ## Verification - `goreleaser check` against the migrated config (with the pro-only `nightly:` block temporarily stripped, since the check ran with the OSS v2 binary): *configuration is valid*, the only deprecation being the pre-existing `archives.format`. - A real `goreleaser build --snapshot --clean --single-target` against the v2 config: succeeded, including the `xz` and `.goreleaser.checksum.sh` post-hooks. - `scripts/upload-r2.sh`: clean under `sh -n` and `shellcheck`; all four `--check-config` cases exercised (all vars unset, one missing, all set, wrong argument count). - The actual upload path was not exercised end to end, since that needs live R2 credentials. Reviewed-on: https://gitea.com/gitea/tea/pulls/1063 Reviewed-by: Zettat123 <39446+zettat123@noreply.gitea.com> --- .gitea/workflows/release-nightly.yml | 18 ++++- .gitea/workflows/release-tag.yml | 18 ++++- .goreleaser.yaml | 47 ++++++++++- scripts/upload-r2.sh | 112 +++++++++++++++++++++++++++ 4 files changed, 190 insertions(+), 5 deletions(-) create mode 100755 scripts/upload-r2.sh diff --git a/.gitea/workflows/release-nightly.yml b/.gitea/workflows/release-nightly.yml index 046aa7d7..24f9ec9e 100644 --- a/.gitea/workflows/release-nightly.yml +++ b/.gitea/workflows/release-nightly.yml @@ -12,6 +12,18 @@ jobs: with: fetch-depth: 0 - run: git fetch --force --tags + # Custom publishers (the R2 mirror below) run as the very last + # step of goreleaser's publish pipeline, after the Gitea release + # has already been created and every artifact already uploaded + # to S3. Fail here instead, before anything is built or + # published, if the R2 secrets are missing. + - name: check R2 configuration + run: sh scripts/upload-r2.sh --check-config + env: + R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }} + R2_BUCKET: ${{ secrets.R2_BUCKET }} + R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }} + R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }} - uses: actions/setup-go@v6 with: go-version-file: "go.mod" @@ -28,7 +40,7 @@ jobs: uses: goreleaser/goreleaser-action@v7 with: distribution: goreleaser-pro - version: "~> v1" + version: "~> v2" args: release --nightly env: SDK_VERSION: ${{ steps.sdk_version.outputs.version }} @@ -38,6 +50,10 @@ jobs: AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} S3_REGION: ${{ secrets.AWS_REGION }} S3_BUCKET: ${{ secrets.AWS_BUCKET }} + R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }} + R2_BUCKET: ${{ secrets.R2_BUCKET }} + R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }} + R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }} GORELEASER_FORCE_TOKEN: 'gitea' GPGSIGN_PASSPHRASE: ${{ secrets.GPGSIGN_PASSPHRASE }} GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }} diff --git a/.gitea/workflows/release-tag.yml b/.gitea/workflows/release-tag.yml index 476ccd60..7f2a37bd 100644 --- a/.gitea/workflows/release-tag.yml +++ b/.gitea/workflows/release-tag.yml @@ -13,6 +13,18 @@ jobs: with: fetch-depth: 0 - run: git fetch --force --tags + # Custom publishers (the R2 mirror below) run as the very last + # step of goreleaser's publish pipeline, after the Gitea release + # has already been created and every artifact already uploaded + # to S3. Fail here instead, before anything is built or + # published, if the R2 secrets are missing. + - name: check R2 configuration + run: sh scripts/upload-r2.sh --check-config + env: + R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }} + R2_BUCKET: ${{ secrets.R2_BUCKET }} + R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }} + R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }} - uses: actions/setup-go@v6 with: go-version-file: 'go.mod' @@ -29,7 +41,7 @@ jobs: uses: goreleaser/goreleaser-action@v7 with: distribution: goreleaser-pro - version: "~> v1" + version: "~> v2" args: release env: SDK_VERSION: ${{ steps.sdk_version.outputs.version }} @@ -39,6 +51,10 @@ jobs: AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} S3_REGION: ${{ secrets.AWS_REGION }} S3_BUCKET: ${{ secrets.AWS_BUCKET }} + R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }} + R2_BUCKET: ${{ secrets.R2_BUCKET }} + R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }} + R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }} GORELEASER_FORCE_TOKEN: 'gitea' GPGSIGN_PASSPHRASE: ${{ secrets.GPGSIGN_PASSPHRASE }} GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }} diff --git a/.goreleaser.yaml b/.goreleaser.yaml index 35546017..4ff38545 100644 --- a/.goreleaser.yaml +++ b/.goreleaser.yaml @@ -1,3 +1,5 @@ +version: 2 + before: hooks: - go mod tidy @@ -79,11 +81,50 @@ blobs: provider: s3 bucket: "{{ .Env.S3_BUCKET }}" region: "{{ .Env.S3_REGION }}" - folder: "tea/{{.Version}}" + directory: "tea/{{.Version}}" extra_files: - glob: ./**.xz - glob: ./**.sha256 +# Mirrors the S3 `blobs:` upload above into Cloudflare R2 during the +# parallel S3+R2 period (S3 will be removed once migration completes). +# A second `blobs:` entry is impossible here since the blob pipe +# authenticates from the global AWS_* env with no per-entry +# credentials; `publishers:` supports per-entry `env:` instead, so +# it's used to invoke scripts/upload-r2.sh once per artifact. Custom +# publishers inherit almost nothing from the environment, hence the +# explicit R2_* forwarding below. +# +# This publisher fires more than once per distinct key because +# goreleaser's release pipe already registers `release.extra_files` +# (./**.xz and ./**.xz.sha256, see the `release:` block below) as +# UploadableFile artifacts, and `internal/exec`'s filterArtifacts +# appends this block's own extra_files with no de-duplication. It +# can't be globbed away, since gobwas/glob (via goreleaser/fileglob) +# has no substring-exclusion matcher. It's harmless: PUT is +# idempotent, and the `./**.xz` glob below is kept deliberately so +# this publisher declares its own complete file set rather than +# implicitly depending on the `release:` block's globs. +# +# checksum: true mirrors goreleaser's generated checksums.txt; +# signature: true additionally mirrors checksums.txt.sig, which the +# `signs:` block below produces by GPG-signing that checksum file. +# Without signature: true, artifacts downloaded from the R2 mirror +# would have no signature file to verify against. +publishers: + - name: cloudflare-r2 + checksum: true + signature: true + extra_files: + - glob: ./**.xz + - glob: ./**.sha256 + cmd: sh scripts/upload-r2.sh {{ abs .ArtifactPath }} tea/{{ .Version }}/{{ .ArtifactName }} + env: + - R2_ENDPOINT={{ index .Env "R2_ENDPOINT" }} + - R2_BUCKET={{ index .Env "R2_BUCKET" }} + - R2_ACCESS_KEY_ID={{ index .Env "R2_ACCESS_KEY_ID" }} + - R2_SECRET_ACCESS_KEY={{ index .Env "R2_SECRET_ACCESS_KEY" }} + archives: - format: binary name_template: "{{ .Binary }}" @@ -104,10 +145,10 @@ signs: args: ["--batch", "-u", "{{ .Env.GPG_FINGERPRINT }}", "--output", "${signature}", "--detach-sign", "${artifact}"] snapshot: - name_template: "{{ .Branch }}-devel" + version_template: "{{ .Branch }}-devel" nightly: - name_template: "{{ .Branch }}" + version_template: "{{ .Branch }}" gitea_urls: api: https://gitea.com/api/v1 diff --git a/scripts/upload-r2.sh b/scripts/upload-r2.sh new file mode 100755 index 00000000..efab8edc --- /dev/null +++ b/scripts/upload-r2.sh @@ -0,0 +1,112 @@ +#!/bin/sh +# Copyright 2026 The Gitea Authors. All rights reserved. +# SPDX-License-Identifier: MIT +# +# upload-r2.sh uploads a single local file to a single object key in a +# Cloudflare R2 bucket, using curl's built-in AWS SigV4 signer (R2 is +# S3-API compatible). +# +# This is the R2 half of the release process's parallel S3+R2 upload +# period: goreleaser's `blobs:` pipe still uploads every release +# artifact to AWS S3, and this script is invoked once per artifact +# (via a goreleaser `publishers:` entry) to mirror the same artifact +# into R2. Once the migration away from S3 is complete, the `blobs:` +# block and the AWS_* secrets can be dropped without touching this +# script. +# +# Usage: +# upload-r2.sh +# upload-r2.sh --check-config +# +# The second form only validates that the required environment +# variables below are set (it does not touch the network or the +# filesystem beyond that), and is meant to be run as an early +# preflight step in CI: goreleaser custom publishers run as the very +# last step of the publish pipeline, so without a preflight check a +# missing R2_* secret would only be discovered after the Gitea release +# has already been created and every artifact already uploaded to S3. +# +# Required environment variables: +# R2_ENDPOINT Base URL of the R2 endpoint, e.g. +# https://.r2.cloudflarestorage.com +# R2_BUCKET Destination bucket name. +# R2_ACCESS_KEY_ID R2 access key id. +# R2_SECRET_ACCESS_KEY R2 secret access key. + +set -eu + +# check_env validates that all required R2_* environment variables are +# set and non-empty, printing a single "missing required environment +# variable(s): ..." message and exiting non-zero otherwise. Used by +# both the normal upload mode and --check-config, so the validation +# logic only exists in one place. +check_env() { + missing="" + + if [ -z "${R2_ENDPOINT:-}" ]; then + missing="$missing R2_ENDPOINT" + fi + if [ -z "${R2_BUCKET:-}" ]; then + missing="$missing R2_BUCKET" + fi + if [ -z "${R2_ACCESS_KEY_ID:-}" ]; then + missing="$missing R2_ACCESS_KEY_ID" + fi + if [ -z "${R2_SECRET_ACCESS_KEY:-}" ]; then + missing="$missing R2_SECRET_ACCESS_KEY" + fi + + if [ -n "$missing" ]; then + echo "upload-r2.sh: missing required environment variable(s):$missing" >&2 + exit 1 + fi +} + +if [ "$#" -eq 1 ] && [ "$1" = "--check-config" ]; then + check_env + echo "upload-r2.sh: R2 configuration OK" + exit 0 +fi + +if [ "$#" -ne 2 ]; then + echo "usage: upload-r2.sh " >&2 + echo " upload-r2.sh --check-config" >&2 + exit 1 +fi + +local_file="$1" +remote_key="$2" + +if [ ! -f "$local_file" ]; then + echo "upload-r2.sh: local file not found: $local_file" >&2 + exit 1 +fi + +check_env + +# Strip a single trailing slash from the endpoint, if present, so that +# building the path-style URL below never produces a double slash. +endpoint="${R2_ENDPOINT%/}" +url="$endpoint/$R2_BUCKET/$remote_key" + +# Credentials are passed to curl through a config file read from +# stdin rather than as a command-line argument, so they never show up +# in `ps` output. +# +# --fail-with-body (instead of plain --fail) still exits non-zero on +# HTTP errors, but also prints R2's XML error body, which is where the +# actual error code lives (SignatureDoesNotMatch, NoSuchBucket, +# AccessDenied, ...); with plain --fail that body is discarded and the +# failure is silent. --retry 3 (without --retry-all-errors) still +# retries the transient cases (5xx, 408, 429, connection failures); +# --retry-all-errors would additionally retry permanent 4xx responses +# three times with backoff, which only delays an inevitable failure. +printf 'user = "%s:%s"\n' "$R2_ACCESS_KEY_ID" "$R2_SECRET_ACCESS_KEY" | curl \ + --config - \ + --fail-with-body \ + --silent \ + --show-error \ + --retry 3 \ + --aws-sigv4 "aws:amz:auto:s3" \ + --upload-file "$local_file" \ + "$url"