From 11cd8ff69ab70c26e9d51ea2bc466d9b878ac95e Mon Sep 17 00:00:00 2001 From: Lunny Xiao Date: Fri, 14 Aug 2026 16:55:21 -0700 Subject: [PATCH] ci: remove AWS S3 uploads from release workflows (#38928) (#38929) Backport #38928 to `release/v1.27`. The automatic backport failed because `release/v1.27` still pins an older `aws-actions/configure-aws-credentials` SHA, so the change is applied manually here. Release binaries have been served from Cloudflare R2 for a while, so the `configure aws` and `upload binaries to s3` steps are removed from the nightly, RC and version release workflows. Since `configure-aws-credentials` no longer runs in those jobs, the `AWS_REGION: auto` workaround in the R2 step is dropped as well. --- .github/workflows/release-nightly.yml | 16 +--------------- .github/workflows/release-tag-rc.yml | 16 +--------------- .github/workflows/release-tag-version.yml | 16 +--------------- 3 files changed, 3 insertions(+), 45 deletions(-) diff --git a/.github/workflows/release-nightly.yml b/.github/workflows/release-nightly.yml index 1112cc7eb9f..bf6f46ebde6 100644 --- a/.github/workflows/release-nightly.yml +++ b/.github/workflows/release-nightly.yml @@ -51,7 +51,7 @@ jobs: cosign sign-blob "$f" --bundle "$f.sigstore.json" --yes echo "$GPG_PASSPHRASE" | gpg --pinentry-mode loopback --passphrase-fd 0 --batch --yes --detach-sign -u "$GPG_FINGERPRINT" --output "$f.asc" "$f" done - # clean branch name to get the folder name in S3 + # clean branch name to get the folder name in the object storage - name: Get cleaned branch name id: clean_name env: @@ -60,25 +60,11 @@ jobs: REF_NAME=$(echo "$REF" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\///' -e 's/release\/v//') echo "Cleaned name is ${REF_NAME}" echo "branch=${REF_NAME}-nightly" >> "$GITHUB_OUTPUT" - - name: configure aws - uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0 - with: - aws-region: ${{ secrets.AWS_REGION }} - aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} - aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} - - name: upload binaries to s3 - env: - AWS_S3_BUCKET: ${{ secrets.AWS_S3_BUCKET }} - BRANCH: ${{ steps.clean_name.outputs.branch }} - run: | - aws s3 sync dist/release "s3://$AWS_S3_BUCKET/gitea/$BRANCH" --no-progress - # configure-aws-credentials exports AWS_REGION job-wide and it wins over AWS_DEFAULT_REGION, so pin it here - name: upload binaries to cloudflare r2 env: AWS_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_ACCESS_KEY_ID }} AWS_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_SECRET_ACCESS_KEY }} AWS_DEFAULT_REGION: auto - AWS_REGION: auto CLOUDFLARE_R2_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_R2_ACCOUNT_ID }} CLOUDFLARE_R2_BUCKET: ${{ secrets.CLOUDFLARE_R2_BUCKET }} BRANCH: ${{ steps.clean_name.outputs.branch }} diff --git a/.github/workflows/release-tag-rc.yml b/.github/workflows/release-tag-rc.yml index 83cb5f56d85..9093c9f5e97 100644 --- a/.github/workflows/release-tag-rc.yml +++ b/.github/workflows/release-tag-rc.yml @@ -52,7 +52,7 @@ jobs: cosign sign-blob "$f" --bundle "$f.sigstore.json" --yes echo "$GPG_PASSPHRASE" | gpg --pinentry-mode loopback --passphrase-fd 0 --batch --yes --detach-sign -u "$GPG_FINGERPRINT" --output "$f.asc" "$f" done - # clean branch name to get the folder name in S3 + # clean branch name to get the folder name in the object storage - name: Get cleaned branch name id: clean_name env: @@ -61,25 +61,11 @@ jobs: REF_NAME=$(echo "$REF" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\/v//' -e 's/release\/v//') echo "Cleaned name is ${REF_NAME}" echo "branch=${REF_NAME}" >> "$GITHUB_OUTPUT" - - name: configure aws - uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0 - with: - aws-region: ${{ secrets.AWS_REGION }} - aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} - aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} - - name: upload binaries to s3 - env: - AWS_S3_BUCKET: ${{ secrets.AWS_S3_BUCKET }} - BRANCH: ${{ steps.clean_name.outputs.branch }} - run: | - aws s3 sync dist/release "s3://$AWS_S3_BUCKET/gitea/$BRANCH" --no-progress - # configure-aws-credentials exports AWS_REGION job-wide and it wins over AWS_DEFAULT_REGION, so pin it here - name: upload binaries to cloudflare r2 env: AWS_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_ACCESS_KEY_ID }} AWS_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_SECRET_ACCESS_KEY }} AWS_DEFAULT_REGION: auto - AWS_REGION: auto CLOUDFLARE_R2_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_R2_ACCOUNT_ID }} CLOUDFLARE_R2_BUCKET: ${{ secrets.CLOUDFLARE_R2_BUCKET }} BRANCH: ${{ steps.clean_name.outputs.branch }} diff --git a/.github/workflows/release-tag-version.yml b/.github/workflows/release-tag-version.yml index 7a44bb6c5c2..b24c93b1885 100644 --- a/.github/workflows/release-tag-version.yml +++ b/.github/workflows/release-tag-version.yml @@ -55,7 +55,7 @@ jobs: cosign sign-blob "$f" --bundle "$f.sigstore.json" --yes echo "$GPG_PASSPHRASE" | gpg --pinentry-mode loopback --passphrase-fd 0 --batch --yes --detach-sign -u "$GPG_FINGERPRINT" --output "$f.asc" "$f" done - # clean branch name to get the folder name in S3 + # clean branch name to get the folder name in the object storage - name: Get cleaned branch name id: clean_name env: @@ -64,25 +64,11 @@ jobs: REF_NAME=$(echo "$REF" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\/v//' -e 's/release\/v//') echo "Cleaned name is ${REF_NAME}" echo "branch=${REF_NAME}" >> "$GITHUB_OUTPUT" - - name: configure aws - uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0 - with: - aws-region: ${{ secrets.AWS_REGION }} - aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} - aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} - - name: upload binaries to s3 - env: - AWS_S3_BUCKET: ${{ secrets.AWS_S3_BUCKET }} - BRANCH: ${{ steps.clean_name.outputs.branch }} - run: | - aws s3 sync dist/release "s3://$AWS_S3_BUCKET/gitea/$BRANCH" --no-progress - # configure-aws-credentials exports AWS_REGION job-wide and it wins over AWS_DEFAULT_REGION, so pin it here - name: upload binaries to cloudflare r2 env: AWS_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_ACCESS_KEY_ID }} AWS_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_SECRET_ACCESS_KEY }} AWS_DEFAULT_REGION: auto - AWS_REGION: auto CLOUDFLARE_R2_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_R2_ACCOUNT_ID }} CLOUDFLARE_R2_BUCKET: ${{ secrets.CLOUDFLARE_R2_BUCKET }} BRANCH: ${{ steps.clean_name.outputs.branch }}