From f97680a68d91d988cd9c96e0071e6ee0bee55cc2 Mon Sep 17 00:00:00 2001 From: Lunny Xiao Date: Sat, 15 Aug 2026 19:41:04 +0000 Subject: [PATCH] chore: drop AWS S3 release upload, keep Cloudflare R2 only (#1169) Release artifacts were uploaded to both AWS S3 and Cloudflare R2 during the migration period. Drop the goreleaser `blobs:` S3 pipe and the AWS_*/S3_* secrets from the release workflows, so artifacts are published to Cloudflare R2 only. Assisted-by: Codet:GPT-5.1-Codex Reviewed-on: https://gitea.com/gitea/runner/pulls/1169 Reviewed-by: bircni Co-authored-by: Lunny Xiao --- .gitea/workflows/release-nightly.yml | 12 +++--------- .gitea/workflows/release-tag.yml | 12 +++--------- .goreleaser.yaml | 24 ++++++------------------ scripts/upload-r2.sh | 12 ++++-------- 4 files changed, 16 insertions(+), 44 deletions(-) diff --git a/.gitea/workflows/release-nightly.yml b/.gitea/workflows/release-nightly.yml index e34cefa5..b9baf97f 100644 --- a/.gitea/workflows/release-nightly.yml +++ b/.gitea/workflows/release-nightly.yml @@ -20,11 +20,10 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: fetch-depth: 0 - # Custom publishers (the R2 mirror below) run as the very last + # Custom publishers (the R2 upload below) run as the very last # step of goreleaser's publish pipeline, after the Gitea release - # has already been created and every artifact already uploaded - # to S3. Fail here instead, before anything is built or - # published, if the R2 secrets are missing. + # has already been created. Fail here instead, before anything + # is built or published, if the R2 secrets are missing. - name: check R2 configuration run: sh scripts/upload-r2.sh --check-config env: @@ -43,11 +42,6 @@ jobs: args: release --nightly env: GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }} - AWS_REGION: ${{ secrets.AWS_REGION }} - AWS_ACCESS_KEY_ID: ${{ secrets.AWS_KEY_ID }} - AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} - S3_REGION: ${{ secrets.AWS_REGION }} - S3_BUCKET: ${{ secrets.AWS_BUCKET }} R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }} R2_BUCKET: ${{ secrets.R2_BUCKET }} R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }} diff --git a/.gitea/workflows/release-tag.yml b/.gitea/workflows/release-tag.yml index df6bfb79..d60f8173 100644 --- a/.gitea/workflows/release-tag.yml +++ b/.gitea/workflows/release-tag.yml @@ -12,11 +12,10 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: fetch-depth: 0 # all history for all branches and tags - # Custom publishers (the R2 mirror below) run as the very last + # Custom publishers (the R2 upload below) run as the very last # step of goreleaser's publish pipeline, after the Gitea release - # has already been created and every artifact already uploaded - # to S3. Fail here instead, before anything is built or - # published, if the R2 secrets are missing. + # has already been created. Fail here instead, before anything + # is built or published, if the R2 secrets are missing. - name: check R2 configuration run: sh scripts/upload-r2.sh --check-config env: @@ -42,11 +41,6 @@ jobs: args: release env: GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }} - AWS_REGION: ${{ secrets.AWS_REGION }} - AWS_ACCESS_KEY_ID: ${{ secrets.AWS_KEY_ID }} - AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} - S3_REGION: ${{ secrets.AWS_REGION }} - S3_BUCKET: ${{ secrets.AWS_BUCKET }} R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }} R2_BUCKET: ${{ secrets.R2_BUCKET }} R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }} diff --git a/.goreleaser.yaml b/.goreleaser.yaml index d6e454e5..39fa4744 100644 --- a/.goreleaser.yaml +++ b/.goreleaser.yaml @@ -83,24 +83,12 @@ builds: - cmd: sh .goreleaser.checksum.sh {{ .Path }} - cmd: sh .goreleaser.checksum.sh {{ .Path }}.xz -blobs: - - - provider: s3 - bucket: "{{ .Env.S3_BUCKET }}" - region: "{{ .Env.S3_REGION }}" - directory: "gitea-runner/{{.Version}}" - extra_files: - - glob: ./**.xz - - glob: ./**.sha256 - -# Mirrors the S3 `blobs:` upload above into Cloudflare R2 during the -# parallel S3+R2 period (S3 will be removed once migration completes). -# A second `blobs:` entry is impossible here since the blob pipe -# authenticates from the global AWS_* env with no per-entry -# credentials; `publishers:` supports per-entry `env:` instead, so -# it's used to invoke scripts/upload-r2.sh once per artifact. Custom -# publishers inherit almost nothing from the environment, hence the -# explicit R2_* forwarding below. +# Uploads every release artifact to Cloudflare R2. The `blobs:` pipe +# isn't usable here since it authenticates from the global AWS_* env +# with no per-entry credentials; `publishers:` supports per-entry +# `env:` instead, so it's used to invoke scripts/upload-r2.sh once per +# artifact. Custom publishers inherit almost nothing from the +# environment, hence the explicit R2_* forwarding below. # # This publisher fires 109 times for 73 distinct keys because # goreleaser's release pipe already registers `release.extra_files` diff --git a/scripts/upload-r2.sh b/scripts/upload-r2.sh index efab8edc..05f0f119 100755 --- a/scripts/upload-r2.sh +++ b/scripts/upload-r2.sh @@ -6,13 +6,9 @@ # Cloudflare R2 bucket, using curl's built-in AWS SigV4 signer (R2 is # S3-API compatible). # -# This is the R2 half of the release process's parallel S3+R2 upload -# period: goreleaser's `blobs:` pipe still uploads every release -# artifact to AWS S3, and this script is invoked once per artifact -# (via a goreleaser `publishers:` entry) to mirror the same artifact -# into R2. Once the migration away from S3 is complete, the `blobs:` -# block and the AWS_* secrets can be dropped without touching this -# script. +# It is invoked once per release artifact via a goreleaser +# `publishers:` entry, and is the only object storage upload of the +# release process. # # Usage: # upload-r2.sh @@ -24,7 +20,7 @@ # preflight step in CI: goreleaser custom publishers run as the very # last step of the publish pipeline, so without a preflight check a # missing R2_* secret would only be discovered after the Gitea release -# has already been created and every artifact already uploaded to S3. +# has already been created. # # Required environment variables: # R2_ENDPOINT Base URL of the R2 endpoint, e.g.