feat(release): promote sealed stage from Actions with repo R2 secret - #30
Merged
Merged
Conversation
The operator promotion (scripts/promote-release.sh) needs the R2 write credential, which lives only as the repo secret CLOUDFLARE_API_TOKEN. Add a workflow_dispatch wrapper that downloads the sealed stage artifact by run id inside Actions and runs the same script there, so the credential never leaves GitHub. The script re-validates provenance against the sealed stage before any remote write; its immutable-asset preflight keeps re-runs idempotent (identical bytes skipped, differing bytes abort). Refs #337
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a workflow_dispatch wrapper (.github/workflows/promote-release.yml) that downloads a sealed client-release-stage artifact by run id inside Actions and runs the unchanged scripts/promote-release.sh there, with CLOUDFLARE_API_TOKEN from the repo secret so the R2 credential never leaves GitHub.
Inputs: version, staged_run_id, expected_source_sha, correlation_id. The script re-validates provenance (version/SHA/correlation vs provenance.json) before any remote write; the immutable-asset preflight makes re-runs idempotent (the already-published 21 GitHub assets will be compared and skipped byte-for-byte, then the R2 object puts, rollback-pointer snapshot, and stable.json/stable-v2.json advances run).
Permissions are minimal: actions:read (artifact fetch by run id) and contents:write (only exercised if a release asset is missing and must be re-uploaded). Wrangler pinned at 4.140.0.
Immediate use: finish the v1.21.16 promotion (stage from seal run 36181486363, cf23b9b, correlation release-v1.21.16-clients-cf23b9b).
Refs #337