ci: Drop AWS S3 release upload, keep only Cloudflare R2 (#1092)

The release pipeline uploaded artifacts to both AWS S3 (goreleaser `blobs:`) and Cloudflare R2 (custom publisher) during the migration period. The migration is done, so this removes the S3 half:

- drop the `blobs:` block from `.goreleaser.yaml`
- drop the `AWS_*` / `S3_*` env from the nightly and tag release workflows
- update the comments in `.goreleaser.yaml` and `scripts/upload-r2.sh` accordingly

Cloudflare R2 upload (including the early `--check-config` preflight step) is unchanged, and the `AWS_*` repo secrets are no longer used.

Reviewed-on: https://gitea.com/gitea/tea/pulls/1092
Reviewed-by: bircni <bircni@icloud.com>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>

.gitea/workflows/release-nightly.yml

@@ -12,11 +12,10 @@ jobs:
         with:
           fetch-depth: 0
       - run: git fetch --force --tags
-      # Custom publishers (the R2 mirror below) run as the very last
+      # Custom publishers (the R2 upload below) run as the very last
       # step of goreleaser's publish pipeline, after the Gitea release
-      # has already been created and every artifact already uploaded
+      # has already been created. Fail here instead, before anything
-      # to S3. Fail here instead, before anything is built or
+      # is built or published, if the R2 secrets are missing.
-      # published, if the R2 secrets are missing.
       - name: check R2 configuration
         run: sh scripts/upload-r2.sh --check-config
         env:
@@ -46,11 +45,6 @@ jobs:
         env:
           SDK_VERSION: ${{ steps.sdk_version.outputs.version }}
           GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
-          AWS_REGION: ${{ secrets.AWS_REGION }}
-          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          S3_REGION: ${{ secrets.AWS_REGION }}
-          S3_BUCKET: ${{ secrets.AWS_BUCKET }}
           R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
           R2_BUCKET: ${{ secrets.R2_BUCKET }}
           R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}

.gitea/workflows/release-tag.yml

@@ -13,11 +13,10 @@ jobs:
         with:
           fetch-depth: 0
       - run: git fetch --force --tags
-      # Custom publishers (the R2 mirror below) run as the very last
+      # Custom publishers (the R2 upload below) run as the very last
       # step of goreleaser's publish pipeline, after the Gitea release
-      # has already been created and every artifact already uploaded
+      # has already been created. Fail here instead, before anything
-      # to S3. Fail here instead, before anything is built or
+      # is built or published, if the R2 secrets are missing.
-      # published, if the R2 secrets are missing.
       - name: check R2 configuration
         run: sh scripts/upload-r2.sh --check-config
         env:
@@ -47,11 +46,6 @@ jobs:
         env:
           SDK_VERSION: ${{ steps.sdk_version.outputs.version }}
           GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
-          AWS_REGION: ${{ secrets.AWS_REGION }}
-          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          S3_REGION: ${{ secrets.AWS_REGION }}
-          S3_BUCKET: ${{ secrets.AWS_BUCKET }}
           R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
           R2_BUCKET: ${{ secrets.R2_BUCKET }}
           R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}

.goreleaser.yaml

@@ -76,24 +76,13 @@ builds:
       - cmd: sh .goreleaser.checksum.sh {{ .Path }}
       - cmd: sh .goreleaser.checksum.sh {{ .Path }}.xz
 
-blobs:
+# Uploads the release artifacts to Cloudflare R2. A `blobs:` entry is
-  -
+# not used here since the blob pipe authenticates from the global
-    provider: s3
+# AWS_* env with no per-entry credentials; `publishers:` supports
-    bucket: "{{ .Env.S3_BUCKET }}"
+# per-entry `env:` instead, so it's used to invoke
-    region: "{{ .Env.S3_REGION }}"
+# scripts/upload-r2.sh once per artifact. Custom publishers inherit
-    directory: "tea/{{.Version}}"
+# almost nothing from the environment, hence the explicit R2_*
-    extra_files:
+# forwarding below.
-      - glob: ./**.xz
-      - glob: ./**.sha256
-
-# Mirrors the S3 `blobs:` upload above into Cloudflare R2 during the
-# parallel S3+R2 period (S3 will be removed once migration completes).
-# A second `blobs:` entry is impossible here since the blob pipe
-# authenticates from the global AWS_* env with no per-entry
-# credentials; `publishers:` supports per-entry `env:` instead, so
-# it's used to invoke scripts/upload-r2.sh once per artifact. Custom
-# publishers inherit almost nothing from the environment, hence the
-# explicit R2_* forwarding below.
 #
 # This publisher fires more than once per distinct key because
 # goreleaser's release pipe already registers `release.extra_files`

scripts/upload-r2.sh

@@ -6,13 +6,9 @@
 # Cloudflare R2 bucket, using curl's built-in AWS SigV4 signer (R2 is
 # S3-API compatible).
 #
-# This is the R2 half of the release process's parallel S3+R2 upload
+# It is invoked once per release artifact via a goreleaser
-# period: goreleaser's `blobs:` pipe still uploads every release
+# `publishers:` entry, and is the only artifact storage upload in the
-# artifact to AWS S3, and this script is invoked once per artifact
+# release process.
-# (via a goreleaser `publishers:` entry) to mirror the same artifact
-# into R2. Once the migration away from S3 is complete, the `blobs:`
-# block and the AWS_* secrets can be dropped without touching this
-# script.
 #
 # Usage:
 #   upload-r2.sh <local-file> <remote-key>
@@ -24,7 +20,7 @@
 # preflight step in CI: goreleaser custom publishers run as the very
 # last step of the publish pipeline, so without a preflight check a
 # missing R2_* secret would only be discovered after the Gitea release
-# has already been created and every artifact already uploaded to S3.
+# has already been created.
 #
 # Required environment variables:
 #   R2_ENDPOINT          Base URL of the R2 endpoint, e.g.